tla+ formal methods software testing
Tout plus