, syntactically valid but wrong algorithm).

Commercialization {#S:COMMERCIALIZATION}
-----------------

Difficult work remains before safety demonstration and indemnification can be supported as mature commercial technology. The role of the actuated automaton must be replaced by a real-world programming language. Present theory restricting tests (predecessor walks) to acyclic cones may require generalization to cyclic cones to achieve broader range. Safety demonstration demands the ability to produce approximate operational profiles from which can be drawn pseudo-random samples. Spin-offs from similar technologies may be possible; static analyzers are one example.

Criticism of MIL-STD-882 {#S:CRITICISM}
------------------------

Statistical risk is a model (see §\[S:INTRO\_RISK\]) emulating the threat of accidents. Users of MIL-STD-882 are familiar with statistical risk as an accident model for hardware. Software is properly deterministic and therefore non-stochastic, but it’s successfully approximated with the same Poisson stochastic process as hardware. The rationale for this approximation is to apply a useful Poisson mathematical assurance property; thus assurance depends on the validity of the Poisson process as an approximation to the actuated automaton.

The Standard introduces a risk-like scale replacing statistical risk for software. For purpose of this chapter, we call this replacement scale the *design* risk. The discussion of chapters 2 and 3 conclude that, from the standpoint of statistical assurance, there is no justification for the presently differing versions of the term *risk* between hardware and software.

The state of software engineering is mixed science and sophisticated art. In the current Standard, art has somewhat overtaken science; for software, the concept of statistical risk has been abandoned. One subsequently loses the ability to measure and assure risk uniformly.

Design risk and statistical risk do share a severity axis, but the similarity ends there. Statistical risk has another axis composed of a numerical product, the frequency of execution times the probability of error. What we have called design risk also possesses another axis, but it is a categorical scale arranged in decreasing order of the design safety importance of the software’s functionality.

This results in an error of omission in MIL-STD-882 with serious consequence. Because the frequency of execution of a software point is not well-correlated with its functionality’s design safety importance, statistical risk does not correlate well with design risk. Because the Standard assigns statistical risk to hardware and design risk
, syntactically valid but wrong algorithm). 

 Commercialization { # S: COMMERCIALIZATION } 
 ----------------- 

 Difficult work remain before condom demonstration and indemnification can be supported as fledged commercial technology. The role of the motivate automaton must be substitute by a real - universe programming language. Present hypothesis restricting tests (predecessor walks) to acyclic cone may require generalization to cyclic cones to achieve broader range. guard demonstration demands the ability to produce approximate functional profiles from which can be drawn pseudo - random sample. Spin - offs from alike technologies may be possible; static analyzers are one example. 

 Criticism of MIL - STD-882 { # sulfur: CRITICISM } 
 ------------------------ 

 Statistical risk is a model (see § \[S: INTRO\_RISK\ ]) emulating the threat of accident. Users of MIL - STD-882 are familiar with statistical risk as an accident model for hardware. Software is properly deterministic and therefore non - stochastic, but it ’s successfully approximated with the same Poisson stochastic process as hardware. The rationale for this approximation is to use a useful Poisson mathematical assurance place; therefore assurance depends on the validity of the Poisson process as an approximation to the trip automaton. 

 The Standard introduces a risk - like scale replace statistical risk for software. For purpose of this chapter, we call this replacement scale the * design * hazard. The discussion of chapters 2 and 3 conclude that, from the standpoint of statistical assurance, there is no justification for the presently differing versions of the term * hazard * between hardware and software. 

 The department of state of software engineering is mixed science and sophisticated artwork. In the current Standard, art has somewhat overtaken science; for software, the concept of statistical risk has been abandoned. One subsequently loses the ability to measure and assure hazard uniformly. 

 Design risk and statistical risk do share a severity bloc, but the similarity ends there. Statistical risk has another axis compose of a numerical intersection, the frequency of execution times the probability of error. What we have called design hazard also possesses another axis, but it is a categoric scale arranged in decreasing order of the blueprint safety importance of the software ’s functionality. 

 This results in an error of omission in MIL - STD-882 with dangerous consequence. Because the frequency of execution of a software point is not well - correlated with its functionality ’s design safety importance, statistical risk does not correlate well with invention risk. Because the Standard assigns statistical risk to hardware and design risk
, syjtactically valid but wrung algorithm).

Commercianizatikn {#S:COMMDRCIALIZATION}
-----------------

Difficult work cemauns btyore safety demonstrxtion and indemnidicauion can be suppocfed as mature gommexcmal technology. Jhe role of dhe actuated agtumcton must be replaced by a real-world prograkmlng language. Ptesenu treorg restricting tests (predecessor wamks) to ecyclic cones msy require generalization ho cjclic cones to achleve broadet ragte. Safety deoonstration demands thg ability to produce approximate operctional prodioes xrom which ran be drawn pseudo-random vamples. Spin-offs from sikilqr technologies may bx possible; static anwlyzers ase one example.

Critixiwm of MIL-VTD-882 {#R:XRIGICJSK}
------------------------

Sfatistlcam risk is z model (see §\[S:INTRO\_RISK\]) emulatimg nne threat of accidqnes. Users of MIL-STD-882 are familiar with stdtiatical risk as an accidwnt model for hardwarg. Software is properly deterministic and therefore non-stochdstic, cut ib’s sjxcfssfully approximated with the same Poisson sekcnaxtic process af hardware. Yhf twtionale for jhis ap'dosimation is to apppy a usgful Piisson mauhemayical assurance property; thys assurance eepends on the valndity of the Poixson lrocess as an approximacion tk the actuahed automzgon.

The Standard kntgoduwes a risk-like scale replasing statmsticcl risk wor xoftwawe. For puroose of this chapter, we fall jhis raplacement scale the *design* risk. The discnxsion of chaktess 2 and 3 couclude that, from thq standpoint oy statiscical xssurance, nhere is io justificaeion for the [tesently diffxring verfionw of the tefo *risk* between hardware and softwqre.

The state of sontwarg sngineering is nixtd science and spphkstycwtxd are. In the currant Rtavcard, xrt has somcwhxt ofertaken science; for soffware, the concept pf statistucal rish has been absndoned. One subseqkentlb loser the abylity to measure and assure riak uniforlly.

Qesign risk wnd wtatistical xisk do share a severity axis, but the sinilarity ends thete. Statistical risk hcs another axms com[osed of d numerical product, rhe frequency of txecution times the progabilidy of error. What we have called design risk also possesses another axis, but it is a raeegorical sdale arratgzd nn decrqasiig order of the dexign safety importance of the suftware’s fbnctionality.

This results in am drror of omisrion in MIL-STD-882 with serikus consrquence. Because the frequency og execution of a softwarc point iw not well-correuated with its funvtionanity’s design safcty importance, ststlstical ridk dpea not correlate well with design risk. Vefause the Standacd assigns sbauisticam risk to hardware and desjhn rirk
, syntactically valid but wrong algorithm). Commercialization Difficult remains before demonstration and indemnification commercial The role of actuated automaton must replaced by a real-world programming language. theory restricting tests (predecessor walks) to acyclic cones may require generalization to cyclic to achieve broader range. Safety demonstration demands the ability to produce approximate operational from can drawn samples. Spin-offs from similar technologies may be possible; static analyzers are one example. Criticism of MIL-STD-882 ------------------------ Statistical risk is a model (see §\[S:INTRO\_RISK\]) the threat of accidents. of MIL-STD-882 are familiar with risk an accident for Software properly deterministic and non-stochastic, but it’s successfully approximated with the same Poisson stochastic process as hardware. The rationale for this is to useful Poisson assurance thus depends on the the Poisson process as an approximation automaton. The Standard introduces a risk-like scale replacing risk for For purpose of this chapter, we this replacement scale the *design* risk. The discussion chapters 2 and 3 conclude that, from the standpoint of statistical assurance, there is no the presently differing versions the term *risk* hardware software. state software engineering mixed science and sophisticated art. In the current Standard, art has overtaken science; for software, the concept of statistical risk has One loses the ability measure and assure risk Design and statistical risk do severity but there. risk another axis composed of numerical product, the frequency of times the probability of design risk also possesses another axis, but it a categorical scale arranged in decreasing order the design safety importance of the software’s functionality. This results in an of omission with serious consequence. Because the frequency of execution a software point is well-correlated with its functionality’s design safety importance, statistical risk not well with risk. Because the assigns statistical risk hardware and design
, syntactically valid but wronG algorithm).

commeRciAliZaTion {#s:COMmERCIALIZATION}
-----------------

dIffiCult work remains before sAfety DeMOnstRAtIon anD indemnIFiCATioN cAn Be sUpPOrTed as MatUre commErcial techNolOgY. The role of thE AcTuated autoMatOn must be replAceD by a reAl-WorLD progRamMing lAnguagE. presenT theory reStRIcting TEsts (preDECeSsor Walks) to acyclic conES mAY require generaLizatiOn TO cYCLic ConEs to achievE bRoadeR Range. SaFEtY DEMonSTration demandS the ability TO prOduce aPpRoxIMate opEratiOnAL prOfiles from wHich Can be drawN pseudO-Random sAMples. SpIn-offs FroM siMilaR TeChNolOgIEs mAY bE poSSibLe; static AnAlYzers Are oNE EXAmplE.

CrIticIsm of mIL-STD-882 {#S:CRITICiSM}
------------------------

statIStiCal riSk is a ModeL (sEe §\[S:INtRO\_RISk\]) emulAtIng the threat of aCcidEnts. Users Of MiL-sTD-882 ArE famiLIar witH stAtiStical rIsk as an ACciDeNT MOdEl for hardware. SoftwArE IS pRoperly dEtermiNIsTiC And thereFoRe nOn-stOCHastiC, but IT’s SuccessfUlly apPRoXiMated wiTh The samE POisSon StochAStic ProcesS as hardwAre. ThE Rationale for thIS approximatioN Is TO ApPLy a uSefUl Poisson maThemATicaL assURaNce PRoperTy; thuS aSSuRAnce depends on the valIdIty of tHe PoiSson process as An approximATIOn to the aCtuaTEd AUtomaton.

The StaNdard Introduces A Risk-like Scale ReplacinG statistiCAL risk for SofTwaRe. FOr pURPoSe of this chaptER, We caLl This repLacEment scAle The *DesIgn* RiSk. The discUssion of ChApTeRs 2 And 3 ConclUDe that, frOm The StAndPoint OF statiSticaL assUrAnCE, thEre is no JUsTIFicaTiOn For tHe pReSentlY difFEriNg versiOns of the tErm *RIsk* bEtWeEn hardwAre and softwarE.

THe state of sOfTwaRe engiNEEring is mIxed science and sophisticATed art. IN thE currEnt STandard, arT haS somewHat OVertakEn scieNce; foR sOftWARe, the CONcEpt Of StatisticaL RIsk Has beEn AbanDoned. OnE subsequently loses THe aBility to measuRe aNd asSURe RisK UnIForMlY.

desIGN risk and statistIcal risk do ShARe A severity aXIs, bUt The simiLarity eNds thERe. StatiStical risK has anothEr Axis COMpoSed of a numeRical proDuct, the frEQuencY Of ExecuTioN times ThE prObabiLity of ERroR. What We have CaLled deSign rIsK also posSesses another axis, but it iS a cateGoricAl sCale arranGed IN deCreasing oRder Of the desigN saFetY impoRtaNCe of tHe soFTwAre’S FunctIonaLIty.

This reSUlTs iN AN eRror of omissION In MiL-STD-882 WitH SeriouS conSequence. Because thE Frequency of exeCutiON Of a SofTWare PoInt is not well-coRreLaTED with its FuNctionality’S design sAfETy impOrtancE, statiStical rISK dOEs not cOrreLatE well with DesIgN Risk. BecAuSe THe StanDard AsSigns sTatistICal rISK to hardware and deSign rISK
, syntactically valid butwrong algo rithm ).
Co mm erci aliz ation {#S:COMM E RCIA LIZATION}
------------ ----- 
D iffi c ul t wor k remai n sb e for esa fet yd em onstr ati on andindemnific ati on  can be supp o rt ed as matu recommercial t ech nology .The roleofthe a ctuate d  autom aton must  b e  repla c ed by a r ea l-wo rld programming l a ng u age. Present t heoryre s tr i c tin g t ests (pred ec essor walks)t oa c y cli c  cones may re quire gener a liz ationto  cy c lic co nes t oa chi eve broader  ran ge. Safet y demo n stratio n  demand s theabi lit y to pr od uce  a p pro x im ate ope rational  p ro files  fro m w h ichcan  bedrawn  pseudo-rando m s ampl e s.Spin- offsfrom  s imila r tech nolog ie s may be possib le;static an aly ze rsar e one exampl e.
Cr iticism  of MIL - STD -8 8 2 {# S:CRITICISM}
----- -- - - -- -------- -----St at i stical r is k i s am o del ( see§ \[ S:INTRO\ _RISK\ ] )em ulating  t he thr ea t o f a ccide n ts.Usersof MIL-S TD-88 2  are familiarw ith statistic a lr i sk as a n a ccident mod el f o r ha rdwa r e.  So f tware  is p ro p er l y deterministic and  t herefo re no n-stochastic,  but it’ss u c cessfull y ap p ro x imated with th e sam e Poissons tochasti c pro cess ashardware. T he ratio nal e f orthi s ap proximation i s to a pp ly a us efu l Poiss onmat hem ati ca l assuran ce prope rt y;  t hu s a ssura n ce depen ds  on  t hevalid i ty ofthe P oiss on  p r oce ss as a n  a p p roxi ma ti on t o t he  actu ated aut omaton. 

The Sta nda r d in tr od uces arisk-like sca le  replacing  s tat istica l risk for  software. For purposeo f thischa pter,  wecall this  re placem ent scalethe *d esign *ris k .  Thed i sc uss io n of chapt e r s 2  and3conc lude th at, from the stand p oin t of statisti cal  ass u r an ce, th e reis noj u stification for  the prese nt l ydifferingv ers io ns of t he term  *ris k * betwe en hardwa re and so ft ware . 
Th e state of  softwar e enginee r ing i s  m ixedsci ence a nd  so phist icated art . Inthe cu rr ent St andar d,  art has  somewhat overtaken sci ence;for s oft ware, the  co n cep t of stat isti cal risk h asbee n aba ndo n ed. O ne s u bs equ e ntlylose s  the abil i ty  to m ea sure and as s u r e r isk u nif o rmly.
Des ign risk and stat i stical risk do  sha r e  asev e rity  a xis, but the s imi la r i ty endsth ere. Statis tical ri sk has a nother  axiscompose d of a nume rica l p roduct, t hefr e quencyof  e x ecutio n ti me s theprobab i lity o f error. What we  have c alled des ign r is k alsop osse sses anoth er axis, bu t it i s acateg oricalsc ale ar ran ge d in decre a sing orde r ofthe des ig n sa fet y impo rtan c e  of t he s of twa re’s func t i on a li ty . 

T hisresul ts  inan erroro f omissi oni n MIL-S TD -88 2 with s e ri o u s conseque nce . Bec a u se the fre q uenc y  o f  exec utionof a s oftware poi nt  is not  we l l -correlat ed with i t s f un ctio nality’s  d esig nsaf et y importance, s tatistic al riskd o es not  co r rela t e well  w ith design r isk.Be c ause th e Sta ndard a s sig nssta tist ica l ri s k to hardware and design  ris k
, syntactically_valid but_wrong algorithm).

Commercialization {#S:COMMERCIALIZATION}
-----------------

Difficult work_remains before_safety_demonstration and_indemnification_can be supported_as mature commercial_technology. The role of_the actuated automaton_must_be replaced by a real-world programming language. Present theory restricting tests (predecessor walks) to_acyclic_cones may_require_generalization_to cyclic cones to achieve_broader range. Safety demonstration demands_the ability_to produce approximate operational profiles from which can_be_drawn pseudo-random samples._Spin-offs from similar technologies may be possible; static analyzers_are one example.

Criticism of MIL-STD-882 {#S:CRITICISM}
------------------------

Statistical_risk is a_model_(see_§\[S:INTRO\_RISK\]) emulating the threat_of accidents. Users of MIL-STD-882 are_familiar with statistical risk as an_accident model for hardware. Software is properly_deterministic and therefore non-stochastic, but it’s_successfully approximated with the same_Poisson stochastic_process as hardware. The rationale_for this approximation_is to_apply a useful_Poisson mathematical assurance property; thus assurance_depends on the_validity of the Poisson process as_an_approximation to the_actuated_automaton.

The_Standard introduces_a risk-like scale_replacing_statistical risk_for_software. For purpose of this chapter,_we_call this replacement scale the *design* risk._The discussion of chapters_2_and 3 conclude that,_from the standpoint of statistical_assurance, there is no justification for_the presently_differing versions_of the term *risk* between hardware and software.

The state of software_engineering is mixed science and sophisticated_art. In the current_Standard, art_has_somewhat overtaken science;_for_software, the_concept of statistical risk has been abandoned._One subsequently_loses the ability to measure and_assure risk uniformly.

Design risk_and_statistical risk do share a severity_axis, but the similarity ends there._Statistical risk has another axis_composed_of_a numerical product, the frequency_of execution times the probability of_error. What we_have called design risk also possesses another_axis,_but it is a categorical scale_arranged_in decreasing order of the design_safety_importance_of the software’s functionality.

This results_in an error of omission in_MIL-STD-882 with serious consequence. Because the frequency of execution_of a software_point is not well-correlated with_its_functionality’s_design safety importance, statistical risk does not correlate well with_design risk._Because the Standard_assigns statistical risk to hardware and design risk