José Creissac Campos Michael D. Harrison Formally verifying interactive systems: A review. 109-124 1997 conf/dsvis/1997 DSV-IS db/conf/dsvis/dsvis1997.html#CamposH97