Patrick Cousot Proving the absence of run-time errors in safety-critical avionics code. 7-9 2007 EMSOFT http://doi.acm.org/10.1145/1289927.1289932 conf/emsoft/2007 db/conf/emsoft/emsoft2007.html#Cousot07