Fred Spiessens Peter Van Roy A Practical Formal Model for Safety Analysis in Capability-Based Systems. 248-278 2005 conf/tgc/2005 TGC http://dx.doi.org/10.1007/11580850_14 db/conf/tgc/tgc2005.html#SpiessensR05