Using a formal specification and a model checker to monitor and direct simulation