Deriving operational software specifications from system goals
Patterns in Property Specifications for Finite-State Verification