That is only impossible if you have not meticulously specified operational domain. Once you have operational domain specified, you can enumerate each and every

That is only impossible if you have not meticulously specified operational domain. Once you have operational domain specified, you can enumerate each and every tiny little detail that can interact. In safety critical systems design specifying operational domain is quite literally one of the first things that are done, even before any serious work on the design starts. The only reasonable phase where safety critical systems can be interacted with closely monitored public are acceptance testing that either validates the model or drags the team back at drawing board.