A method implemented by a network element (NE) in a distributed system, the method comprising tracing an execution of a program in the distributed system to produce a record of the execution of the program, wherein the record indicates states of shared resources at various times during the execution of the program, identifying a vulnerable operation that occurred during the program execution based on the record, wherein the record indicates that a first shared resource of the shared resources is in a flawed state after a node that caused the first shared resource to be in the flawed state crashed, and determining that the vulnerable operation results in a time of fault (TOF) bug based on performing a fault-tolerance mechanism.