Centre of Finland Model checking as a protective method against spurious actuation of industrial control systems