You are correct in those points, and implementation rules like these do not gain you a safety accreditation. There is a lot of upfront analysis of the system a

You are correct in those points, and implementation rules like these do not gain you a safety accreditation. There is a lot of upfront analysis of the system as a whole and the algorithms before a line of code is written. Complexity and dynamism is minimised and all code paths are checked in the final code. This is one of the few places where 100% code-coverage is needed. you need to account for every path in the code, all the way down to bare-metal. Also, a common thing to so is to have h/w fail-safe systems (iff possible), due to the difficulty in getting s/w approved.