Matthew B. Dwyer Software Model Checking: The Bandera approach. 3-4 2002 conf/fmoods/2002 FMOODS db/conf/fmoods/fmoods2002.html#Dwyer02