 Fetzer (1988) objected that deductive reasoning is only able to guarantee for the correctness of a program with respect to its specifications, but not for the correctness of a computational system, that is also accounting for the program’s physical implementation. Even if the program were correct with respect to any of the related upper LoAs (algorithms, specifications, requirements), its implementation could still violate one or more of the intended specifications due to a physical malfunctioning. The former kind of correctness can in principle be proved mathematically, but the correctness of the execution LoA requires an empirical assessment. As examined in  §6.2,  software testing can show only in principle the correctness of a computational system. In practice, the number of allowed executions of non-trivial systems are potentially infinite and cannot be exhaustively checked in a finite (or reasonable) amount of time (Dijkstra 1974). Most successful testing methods rather see both formal verification and testing used together to reach a satisfactory correction level.