Alessandro Cimatti Fausto Giunchiglia Giorgio Mongardi Dario Romano Fernando Torielli Paolo Traverso Formal Verification of a Railway Interlocking System using Model Checking. 361-380 1998 10 Formal Asp. Comput. 4 http://dx.doi.org/10.1007/s001650050022 db/journals/fac/fac10.html#CimattiGMRTT98