FORMAL VERIFICATION OF BEHAVIORAL AADL MODELS BY STATEFUL TIMED CSP