Testing Generation at UPenn Model-Based Test Generation Temp. Prop. Translator Controller Model Checker ---------------------- Witness generator 1 Æ.