> because there is no current requirement for any software to be certified by an engineer Certifying software is difficult, even under the best of circumstance

> because there is no current requirement for any software to be certified by an engineer Certifying software is difficult, even under the best of circumstances. Edit: Er, I didn't substantiate the first sentence. So here's an example. Apparently the reason that most medical devices run on Windows NT (as opposed to, say, Linux) is that Windows NT is already certified for that use, so it becomes easier to certify your custom MRI scanner because you can just include the pre-certified Windows NT part and only have to get the new code your company wrote certified. Similarly, seL4 is the only OS I can think of that has been formally verified (i.e. proven correct mathematically); I'm quite certain none of {Windows, Darwin, Linux} has been formally proven to be correct. When I attended a recent talk at my local university, I found out that the shutdown routines for a local nuclear power plant were running on 40-year-old mainframes because those mainframes were certified to survive earthquakes and things. Work was in progress to find new hardware and rewrite those routines, although the Engineer I spoke to was under the impression that none of the hardware made in the last decade was certified to operating under the same level of confidence.