It has been said before but it bears repeating: Writing defect-free software is exceedingly diffi cult. Proof of correctness of real systems is still well beyond our abilities, and specifi cation of behavior is equally challenging. Predicting fut