The Infeasibility of Experimental Quanti cation of Life - CriticalSoftware

This paper aarms that quantiication of life-critical software reliability is infeasible using statistical methods whether applied to standard software or fault-tolerant software. The key assumption of software fault tolerance|separately programmed versions fail independently|is shown to be problematic. This assumption cannot be justiied by experimentation in the ultrareliability region and subjective arguments in its favor are not suuciently strong to justify it as an axiom. Also, the implications of the recent multiversion software experiments support this aarmation.