In traditional software engineering methodologies, software correctness is established through testing and progressive fault mitigation. Safety properties are established by demonstrating that a sufficiently large number of test cases fail to violate them. In contrast, formal verification methods permit a systems design process where desired safety properties are stated outright in the system ...