Wilfried Steiner John M. Rushby Maria Sorea Holger Pfeifer Model Checking a Fault-Tolerant Startup Algorithm: From Design Exploration To Exhaustive Fault Simulation. 189-198 2004 conf/dsn/2004 DSN http://csdl.computer.org/comp/proceedings/dsn/2004/2052/00/20520189abs.htm db/conf/dsn/dsn2004.html#SteinerRSP04