Using model checking to generate tests from requirements specifications | Synapse