STADIUM: a new tool for high assurance in systems design. - Rufus H. Cofer; T. J. Sanders (ICECCS, 1995)