&gt; Do you have some pointers to your work?<p>At the moment we&#x27;re not open-sourcing the spec (I&#x27;m an engineer, not an academic) but we might in the future. We&#x27;ve opted not to even try to prove the system&#x27;s correctness, as that might take decades (it&#x27;s far more complex than, say, seL4). Instead, we&#x27;re just formally specifying it, and model-checking it with a finite model. The software in question, however, is itself open-source and is described here: <a href="http:&#x2F;&#x2F;blog.paralleluniverse.co&#x2F;2012&#x2F;08&#x2F;20&#x2F;distributed-b-tree&#x2F;" rel="nofollow">http:&#x2F;&#x2F;blog.paralleluniverse.co&#x2F;2012&#x2F;08&#x2F;20&#x2F;distributed-b-tre...</a><p>&gt; All the constructions I know use at least second order logic<p>Concurrent algorithms are specified with TLA+ (in the industry, I mean) quite frequently. Also, specifying the memory consistency properties does require second order logic, but as I&#x27;ve shown in another comment, TLA+ handles second-order logic gracefully and in a very straightforward matter (trivially, I would say). You simply write:<p>∃ ordering ∈ [operations → SequenceOf(Op)] : ConsistencyProperty(ordering[operations])