A. Prasad Sistla Proving Correctness with Respect to Nondeterministic Safety Specifications. 45-49 1991 39 Inf. Process. Lett. 1 db/journals/ipl/ipl39.html#Sistla91