Graeme Smith Kirsten Winter Model checking action system refinements. 155-186 2009 21 Formal Asp. Comput. 1-2 http://dx.doi.org/10.1007/s00165-007-0053-4 db/journals/fac/fac21.html#SmithW09