Originally Posted by alf
Perhaps both fractions require a better understanding of each others viewpoint and capabilities; the resultant educated compromise will benefit safety
Originally Posted by JohnT
Which is why there will always be a role for the certification TP.
Yes, but hisher role is limited, by virtue of the math. Given the complexity of today's designs and the dependence of almost every control-loop data path (in the sense in which I introduced the term) on SW, the prevalent reliability model must be the exponential model used for SW reliability.
Given that model, it is not possible to test statistically, through flight test or indeed veridical simulation, a design's resilience to major, hazardous or catastrophic effects - three out of the four classes of in-flight anomaly. That has to be performed entirely in the head.
That circumstance is what makes the airworthiness assessment fundamentally different nowadays from what it used to be a few decades ago. Or, rather, what should make it different.
PBL