Improving system safety with Temporal Logic of Actions (TLA+)