Formal verification for fault-tolerant architectures: Prolegomena to the design of PVS (1995)

by S Owre, J Rushby, N Shankar, F von Henke
Venue:IEEE Transactions on Software Engineering