Gerard J. Holzmann (1997). The model checker SPIN. IEEE Transactions on Software Engineering. https://doi.org/10.1109/32.588521