Anthony Cant Katherine A. Eastaughffe Maris A. Ozols A Tool for Practical Reasoning about State Machine Designs. 16-26 1996 conf/async/1996 ASYNC http://csdl.computer.org/comp/proceedings/aswec/1996/7635/00/76350016abs.htm db/conf/async/async1996.html#CantEO96