Model checking of a NASA Flight Control System