Testing the Fault Tolerance of a Wide Area Backup Protection System using SPIN