Validating Requirements for Fault Tolerant Systems using Model Checking. - Francis Schneider; Steve M. Easterbrook; John R. Callahan; Gerard J. Holzmann (ICRE, 1998)