José Creissac Campos Michael D. Harrison Karsten Loer Verifying user interface behaviour with model checking. 87-96 2004 conf/vveis/2004 VVEIS db/conf/vveis/vveis2004.html#CamposHL04