mmiao·8 เดือนที่ผ่านมา·discussimho, model checker suits for the problem with many different states and complex state transformation. But in this case, it's a simple toctou problem.. Using model checker sounds weird for me