A Formal Approach To Specifying And Verifying Spacecraft Behavior