Text this: SPIN model checking and software verification :