TECH Signal 390
Depot Registry uses TLA+ model checking to catch garbage collector bug
↗
Depot Registry applied TLA+ model checking to its garbage collector and discovered a real concurrency bug that had escaped testing and review.
The finding shows that automated model checking can uncover subtle interleaving bugs that tests miss, improving system safety for distributed storage. It also demonstrates how integrating TLA+ into development can force precise reasoning about design assumptions, such as the relationship between immutable blobs and S3 versioning.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The team rebuilt the Depot Registry garbage collector and checked it with the TLA+ model checker TLC.
TLC identified a real bug caused by a check-then-act race that had not been caught by existing tests or code reviews.
To make modeling feasible, they automated spec generation by having an agent read the implementation and produce a TLA+ model.
THE CLUSTER