Inspection of safety-critical software using program-function tables

Software whose failure could cause serious damage or loss of life must be carefully inspected before it enters service. To be confident that we have considered all cases and possible event sequences, we must follow a systematic procedure based on a sound mathematical model. This paper describes our experience with such a procedure.