The size of S is often exponential in the size of the design. This phenomenon is typically referred to as the state explosion problem. Once we have our formal design, a representation of the transition system can be automatically generated. We may now wish to write some simple correctness conditions in a formal language. Doors are not opened between stations.
Division is performed correctly.
The motor is not turned on during maintenance. Model checkers are being hailed as great debugging aides. We can write a simple property that our system should satisfy and press the button. If it does not satisfy the property then we will be told so. Typical model checking programs will present a counter-example run of the system, i.e., they produce the explicit bug.