> I'll be honest, I'd probably trust code that's gone through DO-178C more than I would trust code that's been formally verified. Well... depends on the compan

> I'll be honest, I'd probably trust code that's gone through DO-178C more than I would trust code that's been formally verified. Well... depends on the company/team :-) But I think the instinct is fundamentally reaosnable because even the most abusive interpretations of DO-178C tend to demand a lot more attention to quality than even very well-run software projects in other industries. > For the most part cars and medical devices and stuff don't use FM because there's pretty much no oversight. This is starting to change, maybe. The automotive companies have been snapping up verification people (and letting them work on verification). > But any FM stuff has to go through DO-330 and DO-333, which are just as rigorous and intense as DO-178C. The only stuff that has so far is, unsurprisingly, very expensive and very proprietary. So, it's been a while, but I seem to remember DO-333 being written in such a way that if Tool X went through the process, and if you could produce a deep embedding of Tool Y's logic into that Tool X, then you could piggy back on tool X's certification by using the Tool X embedding. Which is still a lot of work, but hopefully substantially easier than getting a new tool approved from scratch. Also, I could just be mis-remembering or confusing a dream for reality... its been a while.