Model Checking, Tla Plus, TLC, Java, Concurrency.
machines), TLC does not get stuck between possibilities; it explores all of them. More specifically, TLC tries to calculate all the reachable states of a system in a breadth-first manner. This is in contrast to the testing our programmer did before, which only tried some randomly chosen paths. From