Symbolic model checking