Researchers in software safety have adapted standard system safety tech-
niques, e.g. fault trees and failure modes and effects analyses to software, but
with mixed success. Perhaps the most fully developed approach is due to Leve-
son [28, 29] who pioneered the application of fault trees to software. In essence
software fault-tree analysis is a modified form of wp-calculus, but focusing on
causes of HFCs or violations of DSRs, not establishing partial correctness. Our
experience, and that of others, is that software fault trees work well in particular
circumstances, but are difficult to apply to large programs, without mechanical
support for expression evaluation, etc. There is a growing view that the use of
static code analysis and proof techniques is much more cost-effective, especially
when tool supported. (we consider testing below.)