Title: Formal Specification and Verification of a Fault-Masking and Transient-Recovery Model for Digital Flight-Control Systems