The Transmission Control Protocol (TCP) was designed to provide a reliable end-to-end network connection. The most up-to-date TCP version, SACK TCP, was designed to be capable of surviving multiple segment loss. However, it has been found that if too many segments in one transmission window are lost, even if SACK TCP transitions into Fast Recovery, it is still possible that timeout will finally occur and the performance will be degraded significantly. In this paper we propose a change in TCP that decreases the impact of lost segments by at least 75%. We modeled the improved SACK TCP with Design/CPN and verified formally that this change leaves TCP "correct" in the sense that all states are bounded and the desired final state is always reachable from the initial state.