The SPIN Model Checker - Holzmann, GJ (Addison-Wesley, 2004)