Carlos M. Roman Gary De Palma Robert P. Kurshan Model checking without hardware drivers. 127 1997 conf/charme/1997 CHARME db/conf/charme/charme1997.html#RomanPK97