publicações Design and Formal Verification of a Fault-tolerant Clock Synchronization Subsystem for the Controller Area Network. Documento