Juan Ignacio Perna Chris George Model Checking RAISE Applicative Specifications. 257-268 2007 conf/sefm/2007 SEFM http://doi.ieeecomputersociety.org/10.1109/SEFM.2007.25 db/conf/sefm/sefm2007.html#PernaG07