selected publications conference paper Model checking a fault-tolerant startup algorithm: from design exploration to exhaustive fault simulation. . 2004