Not only that, but simply testing your system will not provide any sort of safety guarantee. Software errors are not just "show stopping bug" variety, but crit

Not only that, but simply testing your system will not provide any sort of safety guarantee. Software errors are not just "show stopping bug" variety, but critical errors in odd corner cases that are not exercised until there's a fatal crash. See the Toyota unintended acceleration discussion: https://news.ycombinator.com/item?id=6636811 https://news.ycombinator.com/item?id=6636811 There's an entirely different way to write safety critical code that also specifies a process (IEC61508, MISRA C, etc). It isn't a guarantee, but it is required to have any sort of certainty in your system. This is before testing and validation.