Formal Modeling and Analysis of an Avionics Triplex Sensor Voter. - Samar Dajani-Brown; Darren D. Cofer; Gary Hartmann; Steve Pratt (SPIN, 2003)