We have seen how to use TLA to write abstract programs and show that they satisfy simple safety and liveness properties. In this chapter, we pause in our development to consider two problems. The first is determining if an abstract program written in TLA expresses what we want it to. We consider an approach to this problem that is different from what we have been doing—determining what the program might do, rather than what it must or must not do. The second problem is describing and reasoning about the real-time behavior of systems. I hope that seeing how this problem is addressed with TLA helps you appreciate the power of thinking of an abstract program as a predicate on behaviors rather than a generator of behaviors.