Title: Formal Verification of a Fault Tolerant Clock Synchronization Algorithm