The use of formal methods for safety-critical systems. - Paul Joseph Trafford (1997)