Challenges in Model Checking of Fault-tolerant Designs in TLA

Although, historically, fault tolerance is connected to safetycritical systems, there has been an increasing interest in fault tolerance in mainstream application such as the cloud. There is a need for formal specification and verification of industrial fault-tolerant designs, since they integrate, in a non-trivial way, the ideas from distributed algorithms, whose correctness is usually based on very subtle mathematical arguments. More and more fault-tolerant designs are formally specified in TLA. Based on our experience in model checking of fault-tolerant distributed algorithms, we propose a research agenda towards model checking of fault-tolerant designs in TLA.