The top documents tagged [model checker promela]