William Chan Richard J. Anderson Paul Beame Steve Burns Francesmary Modugno David Notkin Jon Damon Reese Model Checking Large Software Specifications. 498-520 http://csdl.computer.org/comp/trans/ts/1998/07/e0498abs.htm 1998 24 IEEE Trans. Software Eng. 7 db/journals/tse/tse24.html#ChanABBMNR98