Gerald Lüttgen Victor Carreño Analyzing Mode Confusion via Model Checking. 120-135 1999 conf/spin/1999 SPIN http://link.springer.de/link/service/series/0558/bibs/1680/16800120.htm db/conf/spin/spin1999.html#LuttgenC99