February 6, Novell Inc.
High Assurance Comes with Knowledge
What do you want the system to do?
Is the system designed to do that?  Only that?
What else does it do that you don't want?
Minimalist system design
everything is BOTH necessary AND sufficient
nothing extra you don't know about
Modular, Layered, Understood, Well Defined Interfaces

The Evidence is in the documentation, the formal design, the detailed analysis, and the insistence that nothing is there that isn't necessary
the knowledge of what it does and doesn't do