Safety Requirements and Fault Trees Using Retrenchment. - Richard Banach; R. Cross (SAFECOMP, 2004)