Yet I'd be more comfortable in the knowledge that e.g. the hardware control loop and the HCI are running in isolation on medical devices. Typically, the critica

Yet I'd be more comfortable in the knowledge that e.g. the hardware control loop and the HCI are running in isolation on medical devices. Typically, the critical control code is kept small and is developed to higher standards than the UI code. Often, errors in the interface are seen as lesser risks, which allows that part of the code to be developed to lower standards, while at the same time being more complex. That is at least what I've seen done in practice.