K. Suzanne Barber Thomas J. Graser Jim Holt Evaluating Dynamic Correctness Properties of Domain Reference Architectures Using a Combination of Simulation and Model Checking. 19-28 2001 conf/seke/2001 SEKE db/conf/seke/seke2001.html#BarberGH01