I am not talking about individual airframes. I am talking about quality of service over the entire fleet. Note that I will be using terminology more fit for IT

I am not talking about individual airframes. I am talking about quality of service over the entire fleet. Note that I will be using terminology more fit for IT than actual safety-critical system terminology to highlight the analogous elements. The DO-178 standards were instituted 30 years ago [1]. There are ~700 million passengers per year flying on commercial airlines in the US since 2003. Extrapolating that backwards to 1992, that would be ~20 billion service requests fulfilled. In 2019, the US averaged 1.57 trillion passenger miles over ~1 billion passengers resulting in a average flight of 1500 miles. That corresponds to around 3-4 hours on average at cruising speed. It takes around 3 minutes for a plane at cruising altitude to crash. So, since the DO-178 standards were introduced there have been 1.6 * 10^12 safety-critical service segments where a software failure over that period could cause a fatality. There have been exactly zero fatalities connected to software errors since the DO-178 standard has been introduced. So, over 1.6 * 10^12 service segments every single one of them was successfully delivered by the software without failure. 12 9s. Also, just in case it is not clear, calculating over multiple airframes does not result in redundancy reducing error rates. Every single airframe must succeed in their service of every single requested service. An analogous situation in IT would be having 10,000 servers with zero redundancy achieving 5 minutes of total downtime divided over all 10,000 servers resulting in 9 9s reliability. [1] https://en.wikipedia.org/wiki/DO-178B https://en.wikipedia.org/wiki/DO-178B