This paper discusses the use of formal methods in the development of the control system for the Maeslant Kering. The Maeslant Kering is the movable dam which has to protect Rotterdam from floodings while, at (almost) the same time, not restricting ship traffic to the port of Rotterdam. The control system, called BOS, completely autonomously decides about closing and opening of the barrier and, when necessary, also performs these tasks without human intervention. BOS is a safety-critical software system of the highest Safety Integrity Level according to IEC 61508. One of the reliability increasing techniques used during its development is formal methods. This paper reports experiences obtained from using formal methods in the development of BOS. These experiences are presented in the context of Hall's famous "Seven Myths of Formal Methods".

the National Research Council. The opinions expressed are those of the authors and do not necessarily represent the views of the Corps, the Federal government or the NRC. The Integration and Application Network of the University of Maryland Center for Environmental Science was responsible for final preparation of the report. Copies can be obtained from the Center at the following address or electronically through the website www.umces.edu/la-restore.

This report addresses an important need for fundamental understanding of bicycle-automobile mixed-traffic. It presents models of (1) gap acceptance behavior and (2) bicyclist behavior at the onset of a yellow traffic signal indication, in addition to analysis of (3) coordinating traffic signals to provide (simultaneous) progression for both bicycles and automobiles. Fundamental insights into mixed-traffic behavior are derived and applied to selected problems in mixed-traffic engineering and operations. Discrete choice (probit) models are developed for both motorist and cyclist gap acceptance behavior. An important fundamental insight from these models is that both cyclists and motorists (on average) require a longer gap when the gap is closed by a large vehicle (e.g. bus), and both will accept a shorter gap when the gap is closed by a bicycle, relative to a gap closed by a passenger car. A methodology for determining and adequate clearance interval (normally consisting of part yellow change and part all-red clearance intervals) for bicycles is developed from a deterministic model based on kenematic