From Technical Report CSL-91-3.
June, 1991.

Abstract:

We present a formal model for fault-masking and transient-recovery among the replicated computers of digital flight-control systems. We establish conditions under which majority voting causes the same commands to be sent to the actuators as those that would be sent by a single computer that suffers no failures. The model and its analysis have been subjected to formal specification and mechanically checked verification using the Ehdm system.

@techreport{csl-91-3,
    AUTHOR = {John Rushby},
    TITLE = {Formal Specification and Verification of a Fault-Masking and Transient-Recovery Model for Digital Flight-Control Systems},
    YEAR = {1991},
    MONTH = {jun},
    URL = {http://www.csl.sri.com/papers/csl-91-3/},
    BOOKTITLE = {Technical Report {CSL-91-3}}
}

csl-91-3.ps.gz Compressed PostScript

csl-91-3.dvi.gz Compressed DVI