Verification of Fault-Tolerant Clock Synchronization Algorithms