The model checker SPIN (1997)

by G J Holzmann
Venue:IEEE transaction on software engineering