Model Checking, Tla Plus, TLC, Java, Concurrency.
desired properties. TLC is a model checker for TLA+. Although it is very useful, conceptually, TLC is a fairly dumb tool. When confronted with several possibilities (as in the behaviors of nondeterministic systems), it refuses to choose. Unlike Buridan’s ass (and more like nondeterministic Turing