Principles of the Spin Model Checker