Logic Verification of ANSI-C code with SPIN
Bandera: extracting finite-state models from Java source code