selected publications conference paper Model checking a fault-tolerant startup algorithm: from design exploration to exhaustive fault simulation 2004