What TLA+ can and can't check
Summary
The article explains TLA+ capabilities and limitations for verifying software properties, covering invariants, safety, and liveness, and detailing what cannot be expressed (existence of a behavior, hyperproperties, multi-step properties). It discusses practical hacks and comparisons to other verification tools, concluding that TLA+ is useful but not a universal solution.