Justification of formal methods for system specification | Synapse