15.11: Model Checking