Testing Safety-Related Software

As software is very complex, we can only test a limited range of the possible states of the software in a reasonable time frame. In 1972, Dijkstra [1] claimed that 'program testing can be used to show the pres­ ence of bugs, but never their absence' to persuade us that a testing approach alone is not acceptable. This frequently quoted statement represented our knowledge about software testing at that time, and after over 25 years intensive practice, experiment and research, although software tes