Wolf, goat and cabbage problem TLA+ modeling
blog.fponzi.me