The SPIN model checker (1997)

by G J Holzmann
Venue:IEEE Transactions on Software Engineering