Uml State Machine - how many final states?

• In terms of semantics, there is only one final state

• In terms of depicting, you can draw as many final state symbols as you like, they all represent the similar one-and-only final state. I think most (if not all) UML tools will allow this.

In other words: both of these diagrams are valid and express the same meaning:

Hence using more than just one final state symbol in a diagram is semantically not necessary. Still it can be useful to avoid overlaps of the final transition arrows, when the state nodes before the final state are located at different areas of the diagram. It can also be useful to mark these predecessors more explicitly, because they represent the real different "final outcomes" of the state machine.

Note if you read Arseni's answer thoroughly, it seems he refers to those predecessors as "final state", not to the state represented by the black-circle symbol itself. That is a perfectly valid point of view, and it should be obvious that state machines can describe different outcomes, otherwise the notation would lose much of its usefulness.

As you asked for the official UML standard: you can find the official UML spec 2.5.1 here. Chapter 14 (about state machines) is somewhat sparse on examples, but as Ewan has pointed out correctly in chapter 15 (about activity diagrams), figures 15.23 and 15.44 show examples with more than one "final activity" symbol in a single diagram, and I don't see any reason why this should not be allowed for classic state diagrams as well.

You already have the answer in your own question, I quote:

A state machine can contain any number of final states and terminators.

The diagram you posted is a great example of that. The user can, in this specific case, attend a booking our cancel a booking, which leads to two possible final states.

Similarly, an UML diagram that explains how a user purchases a product on an e-commerce site may have more than one final state:

• Purchase is made.
• The user cancels the purchase.
• The workflow times out (for instance if the user leaves the website before competing the purchase).
• The user encounters a technical error that prevents the completion of a purchase (such as the inability to perform the actual payment).

There are a couple of interesting answers already. But you seem to look for a formal answer, which can only be found in the UML specs, and your quotes are from authors who have their own interpretation of the UML specs. This is why I add this answer for the records, with some formal references.

The UML 2.5.1 specifications are ambiguous about your question. Indeed, several statements suggest there should be one final state, using a singular pronoun or a determined article. But several places use an undetermined article, suggesting that it's one final state among several.

Examples of wording with singular pronouns and determined article, suggesting a single final state:

14.2.3.2: (...) Each Region owns a set of Vertices and Transitions, which determine the behavioral flow within that Region. It may have its own initial Pseudostate as well as its own FinalState.

14.2.3.4.4: (...) when the State has not been entered before (i.e., no prior history) or it had reached its FinalState, [note: it doesn't say "a FinalState"]

14.2.3.4.5: (...) the most recently active substate is the FinalState (...) *[note: it doesn't say "a FinalState"].

14.2.3.4.7: (...) Similarly, a submachine Statemachine can be exited as a result of: reaching its FinalState, (...)

Example of wording suggesting possible existence of multiple final states are mainly present in the explanation of how the state machine and its transitions work:

14.2.3.8.3: (...)

• if the State is a composite State, all its orthogonal Regions have reached a FinalState [note: it doesn't they "their FinalState"], or
• if the State is a submachine State, the submachine StateMachine execution has reached a FinalState. [note: it doesn't say "its FinalState"]

Moreover, the abstract UML syntax defines FinalState as a special kind of State. So there could be several instances of it, including in the same state machine - and it would formally be different states not just visual cues of the same state). The UML specs absolutely do not constrain the number of final states in a region, whereas such a restriction is explicitly specified for the initial pseudo-state (section 14.5.8.6, constraint initial_vertex: "A Region can have at most one initial Vertex") and in many other places of the specs where a maximum matters (e.g. composite aggregation where an instance of a classifier cannot be at the same time in two different composite aggregation).

Considering that what is not forbidden is allowed, you can therefore assume that it is allowed to have several FinalState per state machine Region. This is apparently also the interpretation of most UML tool makers who leave flexibility about the number of final states.

The fact that the UML specifications explicitly refers to be an object oriented variant of David Harel's state charts, and that these have no constraint either on the number of final states, only reinforces this understanding.