Kaustuv Chaudhuri Damien Doligez Leslie Lamport Stephan Merz Verifying Safety Properties with the TLA+ Proof System. 142-148 2010 IJCAR http://dx.doi.org/10.1007/978-3-642-14203-1_12 conf/cade/2010 db/conf/cade/ijcar2010.html#ChaudhuriDLM10