TLC is an explicit state model checker for specifications written in TLA+. The TLA+Toolbox is an IDE for TLA+. - View it on GitHub