CIP model-checking - Moglestue, Andreas Hubert (2004)