Tag: proof-testing a redundant system