Here are some model-checking papers that we considered reading.

Automatically validating temporal safety properties of interfaces
Thomas Ball and Sriram K. Rajamani
This is the first SLAM paper.  It is difficult but good.
For CSE 490, we read sections 1 and 2.
A key to understanding those sections is why the error trace [A, A, SLIC_ERROR] is infeasible.  Bebop returns the predicate "nPackets - npacketsOld" as the explanation.

SLAM and Static Driver Verifier:  technology transfer of formal methods inside Microsoft
Thomas Ball, Byron Cook, Vlademir Levin, and Sriram K. Rajamani
This is mostly historical and not very helpful from a technical point of view, except half a page in section 3.2 which concisely and clearly describes SLAM as an "Abstract - Check - Refine" loop.

From symptom to cause:  localizing errors in counterexample traces
Thomas Ball, Mayur Naik, and Sriram K. Rajamani
Combines model checking and fault localization.  Model checking gives a counterexample that shows a property is useful, and this shows which parts of the (possibly large) counterexample are the important parts.

Finding and reproducing Heisenbugs in concurrent programs
This describes the Chess system, which is an explicit state model checker for finding concurrency bugs.

Using predicate abstraction to reduce object-oriented programs for model checking
Willem Visser, SeungJoon Park, John Penix
Predicate abstraction is a technique based on abstract interpretation to reduce the state-space for model checking.  This paper uses the Spin explicit-state model checker.  Its case study is a real-time operating system kernel written in C++.

The Model Checker Spin
Gerard J. Holzmann
This is the canonical reference for the influential Spin model checker.

CMC: a pragmatic approach to model checking real code
Another explicit-state model checker

Symbolic model checking: 10^{20} states and beyond
A canonical reference for symbolic model checking, this is not very readable as an introduction to the concepts.