A Domain-Specific Design Tool for Verifying Spacecraft System Behavior