Loading: TLA+ model checking made symbolic