Philippe A. Palanque Rémi Bastide Fabio Paternò Formal Specification as a Tool for Objective Assessment of Safety-Critical Interactive Systems. 323-330 1997 conf/interact/1997 INTERACT db/conf/interact/interact1997.html#PalanqueBP97