Larch: Languages and Tools for Formal Specification