What TLA+ can and can't check

Automated excerpt

Example: light="green" && light'="red" is true if the light changes from green to red. <>P ("eventually P") is true if P is true in the current state or in at least one future state. So if we check the property []P, that means that []P is true in every initial state, and then by the definition of "always" means that P is true in every future state from that initial state, meaning it is true in every state of every behavior. TLA+ properties are implicitly quantified over all behaviors.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.