Klaus Havelund Willem Visser Program model checking as a new trend. 8-20 2002 4 STTT 1 http://link.springer.de/link/service/journals/10009/bibs/2004001/20040008.htm db/journals/sttt/sttt4.html#HavelundV02