Model Checking Time Triggered CAN Protocols