Tla Plus, Resilience, Software Development, DevOps.
<<>> /\ load = FALSE If both our VMs are at 80% usage and the kill process runs before the scale up process, they will both be killed. VMs := SelectSeq(VMs, LAMBDA x: x < 8); selects a new sequence from the original VMs, picking only the elements where the lambda returns true, in this case only VMs