Software becomes ever more ubiquitous and complex. Its use in safety-critical environments, where errors may harm people or cost great amounts of money, requires a high level of con dence in its correctness. In order to ...