NUSMV: a new symbolic model checker