Gravar-mail: Formal modelling and analysis of Clock-SI with TLA+