Patterns in Property Specifications for Finite-State Verification
The synchronous dataflow programming language LUSTRE