Formal Specifcation and Refinement of a Safe Train Control Function. - Victor L. Winter; Deepak Kapur; G. Fuehrer (Formal Methods for Embedded Distributed Systems, 2004)