Author: Safety-Critical Systems Symposium (7th 1999 Huntingdon, England)