https://jack-vanlightly.com/blog/2019/1/27/building-a-simple-distributed-system-formal-verification
http://roscidus.com/blog/blog/2019/01/01/using-tla-plus-to-understand-xen-vchan/