Reference. Model Checking of Safety Properties [kupferman-vardi-2001]