Using model checkers in an introductory course on operating systems