Hans Eveking Christoph Mai Formal verification of timing conditions. 512-517 1990 EURO-DAC http://doi.acm.org/10.1145/949970.950086 conf/eurodac/1990 db/conf/eurodac/euro-dac1990.html#EvekingM90