Model Checking, Tla Plus, TLC, Java, Concurrency.
this, the strengths and limitations of the tool are obvious. On the one hand, it doesn’t rely on luck to find bugs; on the other hand, even small nondeterministic systems can have too many states to be model-checked. This problem — the exponential growth in the number of states — has been the bête