Symbolic model checking an approach to the state explosion problem - McMillan, Kenneth L. (1992)