Formal verification of concurrent software: Two case studiesHana ChocklerEitan Farchiet al.2006PADTAD 2006