TLA+ model checking and an implementation that follows the spec as closely as possible.