“Program testing can be a very effective way to show the presence of bugs, but it is hopelessly inadequate for showing their absence.”