Abstract: Mathematical models and formal methods can be used for verifying/falsifying a discrete event controller just before it is put into operation. If the controller model is verified successfully ...