model checking.pdf