Formal verification increasingly has become recognized as an answer to the problem of how to create ever more complex control systems, which nonetheless are required to behave reliably. To be acceptable in an industrial setting, formal verification must be highly algorithmic; to cope with design complexity, it must support a top-down design methodo