Nikos Aréchiga Sarah M. Loos André Platzer Bruce H. Krogh Using theorem provers to guarantee closed-loop system properties. 3573-3580 2012 ACC https://doi.org/10.1109/ACC.2012.6315388 conf/amcc/2012 db/conf/amcc/acc2012.html#ArechigaLPK12