the requirements into the formalisms. Thus formal methods, while promising,
are only feasible for small projects or small, critical subsets of projects, or when
mandated, i.e., for software that must meet higher assurance levels.
There is promise, because the benefits of formal methods make