Formal verification of the interactive convergence clock synchronization algorithm using EHDM - Rushby, John; Henke, Friedrich (1989)