model checking and spin