Using TLA+ in the Development of a Safety-Critical Fault-Tolerant Middleware
Uppaal in a nutshell