Using a Model Checker to Test Safety Properties. - Paul Ammann; Wei Ding 003; Daling Xu (ICECCS, 2001)