Gerard J. Holzmann Rajeev Joshi Alex Groce Model driven code checking. 283-297 2008 15 Autom. Softw. Eng. 3-4 http://dx.doi.org/10.1007/s10515-008-0033-9 db/journals/ase/ase15.html#HolzmannJG08