LaTex
The SPIN model checker