Using SPIN to check Simulink Stateflow models | IEEE Conference Publication | IEEE Xplore