Email Record: Principles of the Spin model checker /