Sebastian Burckhardt, Rajeev Alur, Milo M. K. Martin: Verifying Safety of a Token Coherence Implementation by Parametric Compositional Refinement. VMCAI 2005: 130-145