Model-driven generation of runtime checks for system properties