Boundary coverage criteria for test generation from formal models | IEEE Conference Publication | IEEE Xplore