M. Edwin Johnson Model Checking Safety Properties of Servo-Loop Control Systems. 45-50 2002 conf/dsn/2002 DSN http://computer.org/proceedings/dsn/1597/15970045abs.htm db/conf/dsn/dsn2002.html#Johnson02