Amer Saeed Rogério de Lemos Tom Anderson 0001 The Role of Formal Methods in the Requirements Analysis of Safety-Critical Systems: A Train Set Example. 478-487 1991 conf/ftcs/1991 FTCS db/conf/ftcs/ftcs91.html#SaeedLA91 https://doi.org/10.1109/FTCS.1991.146704