Lessons Learned Modular feature verification must handle cross- modular data flows Some classes of feature-interaction errors can be detected modularly and algorithmically Generate property-specific, parameterized interfaces per module verification isn't the right goal
{}