Author: Germany) NATO Advanced Study Institute on Tools for Analysis and Verification of Software Safety and Security (2011 Bayrischzell