1. 3

Apalache is a symbolic model-checker for TLA+.