TLA+ and the like could help here. You model the system, and run a simulation to see if it hits a failure state.