and F von Henke. Formal verification of the interactive convergence clock synchronization algorithm (1989)

by J Rushby