Model Checking Abstract State Machines by Kirsten Winter