Model Checking in Practice

Write a real spec, understand exhaustive state-space exploration, and see a genuine concurrency bug a model checker catches before code exists.

1. Writing a Real Spec Specify a mutual-exclusion lock completely: state, transitions, a safety property, and a liveness property, in enough detail to actually check.
2. Exhaustive State-Space Exploration How a model checker actually walks a state graph, why that's fundamentally different from testing, and why state explosion is a real ceiling you work around rather than ignore.
3. A Real Concurrency Bug, Caught Before Code A worked lost-update race in a connection pool's reference count, the interleaving a model checker finds that human review misses, and the honest limits of model checking.