Willem Visser Klaus Havelund Guillaume P. Brat Seungjoon Park Model Checking Programs. 3-12 2000 ASE http://computer.org/proceedings/ase/0710/07100003abs.htm db/conf/kbse/ase2000.html#VisserHBP00