When to stop verification?: Statistical trade-off between expected loss and simulation cost