SPIN constraint checking