Model Checking, Tla Plus, TLC, Java, Concurrency.
checking) remain the only way to deal with infinite (or large) state spaces. The lesson here is that a formal model can be used for many purposes, and simple model checking can be a way to discover bugs that result from nondeterminism, for which testing can be very tricky (and requires patience,