Proving That A Procedure Does What You Claim It Does