this looks pretty sweet. tla+ looks scary and mathy at first, but it's really a pretty simple concept: define some state machines, explore the state space, see if you run into trouble. with this you get a nice classic sequence diagram to show how things went down.