Model checking safety of Ben-Or’s Byzantine consensus with Apalache

Why I use TLA+ and not(TLA+)

Specification and Model-checking of the ZKsync Governance Protocol