Model checker, to verify and debug control software