With the growingubiquity of computing systems it is essentialthat we canplace reliance on the services they deliver. This is particularly obvious and important in areas like aircraft avionics, global ?nancial transaction processing, or nuclear power plant control where human lives or large ?nancial values are at stake. But also the worldwide daily nuisances of computer viruses or data corruptions caused by crashing operating systems collectively impose high costs on society, which are beginning to become economically relevant. Within computer science, the termdependability has been introduced as a general term to cover all critical quality aspects of computing systems. Foll- ing the terminology of Laprie [26, 293], a system is dependable if trust can justi?ably be placed in the service it delivers (we will de?ne dependability and related terms more precisely later in this book). In the early days of computer science, researchers thought thatprogram correctness was the key to depe- ability meaning that a programalways terminates and satis?es its postcondition if it is started in a state where its precondition holds. Today we knowthat many other factors in?uence the well-functioning of a computer system. Examples of these factors are: - Hardware reliability: The occurrence of hardware faults, which cannot be neglected in critical systems. - Non-functional properties: The growingimportance of properties which c- not be expressed so easily as pre- and postconditions. As an example, c- sider the performance requirement that the averageresponse time should be below some value.