identify the areas where domain modelers can struggle and present some guidelines to
avoid these pitfalls. We mainly address three questions about domain modeling: what to
specify, how to refine, and how to verify. We discuss the strategy to express domain
assumptions, protocols, time, and temporal properties. We also analyze the refinement and
proof system of Event-B in this realm. We advocate small incremental steps and alternative …