Unfortunately to test Redlock with a formal method is pretty useless. The algorithm is so trivial, for the part you can mathematically model it, that is a wasted effort to model it: even with a proof of the lock acquisition process it all boils down to &quot;is the system model credible&quot;? And that&#x27;s what we are debating. Note that similarly Martin don&#x27;t even try to address the problem of <i>how</i> the lock is acquired for the same reason I guess. Also note that if you try to model the problem adding unbound processes pauses, and put as a requirement mutual exclusivity with auto-release, I don&#x27;t think there is a way the model will ever be validated, <i>whatever</i> system you model implementing this.