The SPIN Model Checker: Primer and Reference Manual