Proving Safety Properties of the Steam Boiler Controller. - Gunter Leeb; Nancy A. Lynch (Formal Methods for Industrial Applications, 1995)