The majority of errors within a software project are introduced during the requirements and design phases of the project, yet, usually, these errors remain undetected until the implementation and test phases of the Software Development Life Cycle, when the errors are most costly and difficult to correct. The use of Formal Methods during implementation has made possible the earlier detection of errors. Using Formal Methods during the design phase when the software architecture is produced has significant impact by ensuring properties of the requirements are properly represented in the architecture enabling even earlier detection. Tools supporting formal verification of architecture are now mature enough to allow for verification at multiple levels of the architecture. The Architecture Analysis and Design (AADL) language and its verification tools, AGREE, BLESS and Resolute, provide an excellent platform for representing an architecture and its verification requirements. However, determining what is necessary to declare a requirement as sufficiently verified is not well understood
