The value of model checking in distributed protocols design