Ashish Tiwari Natarajan Shankar John M. Rushby Invisible formal methods for embedded control systems. 29-39 2003 91 Proceedings of the IEEE 1 db/journals/pieee/pieee91.html#TiwariSR03