A great deal of effort, money, and time are spent in the creation of software and hardware, and much also depends upon their correct performance. It is not at all uncommon for there to be situations where the loss of life and property would be the result of non-performance or incorrect performance of either hardware or software. Testing of the program or hardware prototype is not itself sufficient to guarantee correct behavior--how can we be certain it behaves correctly under all possible operating conditions? This can often be difficult to determine from testing alone, as operating conditions may vary widely, and sometimes may not be fully known in advance. It is also possible that certain very rare combinations of factors may occur to disrupt performance, but that these combinations may not be forecast in advance.

Thus, it becomes highly advisable to have a rigorous method by which one...