Radu Siminiceanu Gianfranco Ciardo Formal verification of the NASA runway safety monitor. 63-76 2007 9 STTT 1 http://dx.doi.org/10.1007/s10009-006-0004-z db/journals/sttt/sttt9.html#SiminiceanuC07