How does one demonstrate that a system is “safe enough” for application domains such as avionics, where a software failure can lead t...