John M. Rushby Analyzing Cockpit Interfaces Using Formal Methods. 2001 43 Electr. Notes Theor. Comput. Sci. http://www.elsevier.com/gej-ng/31/29/23/72/23/show/Products/notes/index.htt#002 db/journals/entcs/entcs43.html#Rushby01