Gudmund Grov Greg Michaelson Andrew Ireland Formal verification of concurrent scheduling strategies using TLA. 1-6 2007 ICPADS http://doi.ieeecomputersociety.org/10.1109/ICPADS.2007.4447839 conf/icpads/2007 db/conf/icpads/icpads2007.html#GrovMI07