(Note: this provides much of the capability we identified at
the end of section 4.) Interestingly, relatively few anomalies have been found,
and there are questions about the cost-effectiveness of the approach, especially
as the specifications being used as the basis for verification are very low level.