  Computers may control safety-critical operations in machines having embedded
software. This memoir proposes a regimen to verify such algorithms at
prescribed levels of statistical confidence. The United States Department of
Defense standard for system safety engineering (MIL-STD-882E) defines
development procedures for safety-critical systems. However, a problem exists:
the Standard fails to distinguish quantitative product assurance technique from
categorical process assurance method for software development. Resulting is
conflict in the technical definition of the term risk. The primary goal here is
to show that a quantitative risk-based product assurance method exists and is
consistent with hardware practice. Discussion appears in two major parts:
theory, which shows the relationship between automata and software; and
application, which covers demonstration and indemnification. Demonstration is a
technique for generating random tests; indemnification converts pass/fail test
results to compound Poisson parameters (severity and intensity). Together,
demonstration and indemnification yield statistical confidence that
safety-critical code meets design intent. Statistical confidence is the
keystone of quantitative product assurance. A secondary goal is resolving the
conflict over the term risk. The first meaning is an accident model known in
mathematics as the compound Poisson stochastic process, and so is called
statistical risk. Various of its versions underlie the theories of safety and
reliability. The second is called developmental risk. It considers software
autonomy, which considers time until manual recovery of control. Once these
meanings are separated, MIL-STD-882 can properly support either formal
quantitative safety assurance or empirical process robustness, which differ in
impact.
