Just as big as failing safe, is not failing silently. Thats the another key from the Therac-25 - it failed mostly silently - it displayed an strange message th

Just as big as failing safe, is not failing silently. Thats the another key from the Therac-25 - it failed mostly silently - it displayed an strange message that didnt make any sense, and there was no obvious detection of a failure. Software need not be bug free - for example, there is a reason we still include hardware watchdogs on embedded devices, and its largely because the watchdog is cheaper than bug free software, and will provide the same quality of service.