Software model checking with SPIN