Verifying Multi-agent Programs by Model Checking