Using TLA+ in the Real World to Understand a Glibc Bug
A clarification:<p>&gt; Instead of writing proofs, it works using the simple method of running all possible executions of a program.<p>TLA+ is a formal mathematical language designed to describe digital (and hybrid digital-analog) systems. By itself it &quot;does&quot; nothing other than allow writing a formal description of a system, various propositions about it, and their proofs.<p>There are tools, however, for mechanically writing and checking TLA+ proofs with a proof assistant (TLAPS), as well as model-checking them (TLC). The author refers to the latter, but it should be noted that model checkers, including an explicit-state model checker like TLC, don&#x27;t only <i>not</i> run all possible executions of a program, they don&#x27;t even run it once. They are &quot;static.&quot; Indeed, TLC could, in some situations, check whether an uncountably infinite number of program executions, each of which of infinite length, satisfy some proposition within seconds.<p>Also, the author chose to specify their algorithm in PlusCal, rather than in TLA+, which is pseudocode-like a language that compiles to TLA+ in a straightforward manner and is sometimes more convenient than TLA+ to specify low-level concurrent algorithms (TLA+ is more convenient to specify a higher level view of an entire system).<p>TLA+ is, however, exceptionally pragmatic due to an availability of a model checker for it (in fact, there are now two model checkers for TLA+, TLC and Apalache, using very different algorithm), but mostly because it is exceptionally easy to learn compared to other formal mathematical languages.