Describir: Validating requirements for fault tolerant systems using model checking / Francis Schneider [and others].