For documentation purposes, a good starting point to think about this problem is probably chapter 2 of the TLA+ book.
We have supported something like this for some time - see current systems/ folder.
systems/