requirements that can then be model checked using the Spin model
checker. The Spin model checker results would then be verified by the
PBT to ensure they are not violated in the actual code. (Completion of
this effort depends on release by NASA of further funding.).