Using a model checker to test safety properties | IEEE Conference Publication | IEEE Xplore