TLA+ and Clojure, a Small Primer
summary
TLA+ model checking finds a race in a Clojure money transfer example where two concurrent transfers break the total balance invariant. The workflow uses TLC-style invariants and a liveness check, then fixes the bug by making the update an atomic step and adding fairness to processes. A Clojure helper library overrides TLA+ operators and replays counterexample traces so the bug reproduces in tests; after the changes both safety and liveness checks pass.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:23Syntax
- 3:06Language Helpers
- 6:40Concrete Operators
- 8:15Money Transfer
- 9:50The Specification
- 12:13Labels
