Sagar Chaki Sriram K. Rajamani Jakob Rehof Types as models: model checking message-passing programs. 45-57 2002 POPL http://doi.acm.org/10.1145/503272.503278 db/conf/popl/popl2002.html#ChakiRR02