Using Formal Models to Plan Control System Testing | AMiner