Verifying a scheduling protocol of safety-critical systems