The model checker SPIN. (1997)

by G J Holzmann
Venue:IEEE Transactions on Software Engineering,