A practical use of model checking for synthesis: generating a dam controller for flood management | Publicación