Model checking - Clarke Edmund M (1999)