Checking models based on an iterative co-specification process of a critical system
a tutorial on uppaal .