“…We have chosen the Petri net formalism, because it is well suited to model concurrency, choice, and causality, and because there is a wealth of formal verification techniques [15,18] that can exploit the inherent partial order properties explicitly captured in the model. However, a major problem when using Petri nets as a model for verification, is the lack of a formal mapping between constructs in the (system) specification language itself and Petri net operations.…”