SPIN model checker