Principles of Model Checking (The MIT Press)