NµSMV: a new symbolic model checker (2000)

by A Cimatti, E Clarke, F Giunchiglia, M Roveri