by Gerard J. Holzmann
How to design communication protocols using the Promela language and check them with the Spin model checker.