Using TLA+ in the Development of a Safety-Critical Fault-Tolerant Middleware
Modeling in Event-B: System and Software Engineering