Antonio Cerone Peter A. Lindsay Simon Connelly Formal Analysis of Human-computer Interaction using Model-checking. 352-362 2005 conf/sefm/2005 SEFM http://doi.ieeecomputersociety.org/10.1109/SEFM.2005.19 db/conf/sefm/sefm2005.html#CeroneLC05