TLA+: modelling channel semantics