Formal Verification With Frama-C: A Case Study in the Space Software Domain
Counterexample-guided abstraction refinement for symbolic model checking