On Model Checking Safety Properties (2003)
[BibTex]