Improving system safety with Temporal Logic of Actions (TLA+)
Summary
The article explains using Temporal Logic of Actions (TLA+) and the TLC model checker to model, verify, and reason about distributed systems. It covers Depot's garbage-collection GC example, invariants like ManifestNeedsData, ManifestCountNeverUndercounts, and S3HeadOK, and explains how S3 versioning acts as a delete fence to prevent race conditions. It also argues that formal verification can be performed with agent-assisted modeling and offers practical guidance on when to model and how to turn doubts into invariants.