Using a scenario model to derive the functions of a formal specification | IEEE Conference Publication | IEEE Xplore