Using model checking to debug device firmware