tla-model-checking

To verify a TLA+ specification using TLC, you prepare the spec, create a `.cfg` configuration file for constants and properties, run a smoke test, execute the full model check, and interpret the success or violation results.

Configure a TLC model checker file by writing a `.cfg` file that defines constants, specifies safety invariants and liveness properties, and sets state constraints to optimize the model checking process for your TLA+ specification.

Debug TLA+ invariant violations by analyzing the counterexample trace provided by TLC, identifying the state transition causing the property failure, and correcting the TLA+ specification logic or adjusting the model configuration constraints.

Handle TLC state space explosion by optimizing your `.cfg` configuration with state constraints, reducing constant sizes for initial smoke tests, and applying symmetry sets or view predicates to limit the explored state graph.

Yes, you can run a TLA+ smoke test before full model checking by configuring TLC with a smaller state space or depth limit, verifying basic invariants quickly to catch early specification errors before exhaustive verification.

A TLA+ model check fails with a property violation when TLC finds a behavior trace that violates your specified invariants or liveness properties, outputting a counterexample to guide debugging and specification correction.