Stephan Merz Model Checking: A Tutorial Overview. 3-38 2000 conf/movep/2000 MOVEP http://link.springer.de/link/service/series/0558/bibs/2067/20670003.htm db/conf/movep/movep2000.html#Merz00