The model checker SPIN (1997)

by Gerard J. Holzmann
Venue:IEEE Transactions on Software Engineering