Model Checking, Tla Plus, TLC, Java, Concurrency.
module, i.e., that the model satisfies the desired properties. TLA+ has proof rules — based on classic concepts like inductive invariants and well-founded sets — that can be used to formally derive the logical implication stated at the end of the module. As an alternative to proofs, model checking