[Gove91] Gove, Safety Criteria and Model for Mission-Critical Embedded Software Systems, IEEE CH3033-8/91/0000-0069, 1991. []