{The SPIN Model Checker: Primer and Reference Manual}