The FDR4 checker [1] looks pretty slick. I'm not that familiar with the area, though, so I'm wondering how it compares to model checkers? How does using a model checker compare to using a refinement checker? (I've read that there are model checkers for TLA+.)
[1] https://www.cs.ox.ac.uk/projects/fdr/