CIP model checking. - Andreas Moglestue (2004)