Characterizing observability and controllability of software components
A specifier's introduction to formal methods