Code review, analysis, and change controls

Code review and analysis
- We do this all the time and work on provers
- I would not release security code without it
- Detailed review is complex and problematic
Sound Change Control
- Sound change control works for many cases
- Particularly good for high assurance systems
- Limits Turing capable programs (good thing)
- Means function is decided by designers

Code review and analysis