A copy of this work was available on the public web and has been preserved in the Wayback Machine. The capture dates from 2012; you can also visit the original URL.
The file type is
Lecture Notes in Computer Science
We explain the rationale behind the design of the TLA + specification language, and we describe our experience using it and the TLC model checker in industrial applications-including the verification of multiprocessor memory designs at Intel. Based on this experience, we challenge some conventional wisdom about high-level specifications.doi:10.1007/978-3-540-39656-7_10 fatcat:7psnwjf2p5g5pkfcvhmknrdlda