Symbolic Model Checking - Kenneth McMillan