Jonathan Jacky Specifying a Safety-Critical Control System in Z. 99-106 http://www.computer.org/tse/ts1995/e0099abs.htm 1995 21 IEEE Trans. Software Eng. 2 db/journals/tse/tse21.html#Jacky95