Generating PROMELA Models of Fault-Tolerant Distributed Algorithms