Evaluating fuzzy controller robustness using model checking