  Alerting experience with a well-acknowledged safety analysis code initiated
the authors to pay attention to safety issues of complex systems. Their first
concern was the statistical characteristics of such a code. We point out a
remarkable weakness of the so called 0.95/0.95 methodology: when repeating the
search for the tolerance limit, we get a higher value with non-negligible
probability. We propose the sign test as an alternative method. We point out
the correct form of Wilks' formula when the number of parameters subjected to
limitation is two or more.
