316 model-checking "DIFFER" research jobs