Mark Bickford Mandayam K. Srivas Verification of a Fault-Tolerant Property of a Multiprocessor System: A Case Study in Theorem Prover-Based Verification. 225-251 1992 conf/tpcd/1992 TPCD db/conf/tpcd/tpcd1992.html#BickfordS92