Limor Fix Fifteen Years of Formal Property Verification in Intel. 139-144 2008 25 Years of Model Checking http://dx.doi.org/10.1007/978-3-540-69850-0_8 conf/spin/5000 db/conf/spin/lncs5000.html#Fix08