Rance Cleaveland S. Purushothaman Iyer Daniel Yankelevich Optimality in Abstractions of Model Checking 51-63 conf/sas/95 SAS 1995 db/conf/sas/sas95.html#CleavelandIY95