Holger Pfeifer Formal Verification of the TTP Group Membership Algorithm. 3-18 2000 conf/forte/2000 FORTE db/conf/forte/forte2000.html#Pfeifer00