How to Keep 4-Eyes Principle in a Design and Property Generation Flow | VDE Conference Publication | IEEE Xplore