Specifying a safety-critical control system in Z | IEEE Journals & Magazine | IEEE Xplore