Proving properties of a safety-critical system. - Will Atkinson; Jim Cunningham (Softw. Eng. J., 1991)