automatically verify Promela models