| PVS: A prototype verification system S Owre, JM Rushby, N Shankar International Conference on Automated Deduction, 748-752, 1992 | 2406 | 1992 |
| Formal verification for fault-tolerant architectures: Prolegomena to the design of PVS S Owre, J Rushby, N Shankar, F Von Henke IEEE Transactions on Software Engineering 21 (2), 107-125, 1995 | 816 | 1995 |
| PVS: Combining specification, proof checking, and model checking S Owre, S Rajan, JM Rushby, N Shankar, M Srivas International Conference on Computer Aided Verification, 411-414, 1996 | 706 | 1996 |
| Design and verification of secure systems JM Rushby ACM SIGOPS Operating Systems Review 15 (5), 12-21, 1981 | 686 | 1981 |
| Noninterference, transitivity, and channel-control security policies J Rushby SRI International, Computer Science Laboratory, 1992 | 522 | 1992 |
| A tutorial introduction to PVS J Crow, S Owre, J Rushby, N Shankar, M Srivas WIFT, 1995 | 456 | 1995 |
| Bus architectures for safety-critical embedded systems J Rushby International Workshop on Embedded Software, 306-323, 2001 | 388 | 2001 |
| SAL 2 L De Moura, S Owre, H Rueß, J Rushby, N Shankar, M Sorea, A Tiwari International Conference on Computer Aided Verification, 496-500, 2004 | 369 | 2004 |
| Partitioning in avionics architectures: Requirements, mechanisms, and assurance J Rushby SRI INTERNATIONAL MENLO PARK CA COMPUTER SCIENCE LAB, 2000 | 335 | 2000 |
| PVS language reference S Owre, N Shankar, JM Rushby, DWJ Stringer-Calvert Computer Science Laboratory, SRI International, Menlo Park, CA 1 (2), 21, 1999 | 323 | 1999 |
| Avionics Architectures: Mechanisms, and Assurance J Rushby | 315 | 1999 |
| Using model checking to help discover mode confusions and other automation surprises J Rushby Reliability Engineering & System Safety 75 (2), 167-177, 2002 | 303 | 2002 |
| Formal methods and the certification of critical systems J Rushby SRI International, Computer Science Laboratory, 1993 | 285 | 1993 |
| An overview of SAL S Bensalem, V Ganesh, Y Lakhnech, C Munoz, S Owre, H Rueß, ... Proceedings of the 5th NASA Langley Formal Methods Workshop, 2000 | 249 | 2000 |
| Critical system properties: Survey and taxonomy J Rushby Reliability Engineering & System Safety 43 (2), 189-219, 1994 | 244 | 1994 |
| PVS prover guide N Shankar, S Owre, JM Rushby, DWJ Stringer-Calvert Computer Science Laboratory, SRI International, Menlo Park, CA 1, 11-12, 2001 | 218 | 2001 |
| The PVS proof checker: A reference manual (beta release) N Shankar, S Owre, JM Rushby Computer Science Laboratory, SRI International, Menlo Park, CA, 1993 | 214 | 1993 |
| Formal methods and their role in the certification of critical systems J Rushby Safety and Reliability of Software Based Systems, 1-42, 1997 | 212 | 1997 |
| PVS system guide S Owre, N Shankar, JM Rushby, DWJ Stringer-Calvert Computer Science Laboratory, SRI International, Menlo Park, CA 1 (5), 7, 1999 | 206 | 1999 |
| Subtypes for specifications: Predicate subtyping in PVS J Rushby, S Owre, N Shankar IEEE Transactions on Software Engineering 24 (9), 709-720, 1998 | 205 | 1998 |
Natarajan ShankarSRI International Computer Science LaboratoryVerified email at csl.sri.com
