Engineering judgement

Engineers who develop safety-related systems are required to work to remarkably high standards: SIL 1, the lowest classification recognised by the international standard IEC 61508, requires a probability of failure/hour (pfh) of 10-5 or lower; and many systems are required to achieve several orders of magnitude lower failure rates than this. Yet SIL 1 is already so demanding that it is impractical to test a system for long enough to provide convincing evidence that the required failure probability has been achieved, and few systems have ever been mathematically proved to implement their specifications.Instead, safety engineers develop safety cases that argue, and seek to show, that the required pfh has been achieved.The safety authority then exercises their engineering judgement that the system will have the required safety properties. In the absence of convincing evidence, engineering judgement seems our only recourse, yet the great physicist, Richard Feynman, remarked in his book about the investigation of the accident that destroyed the Challenger space shuttle: "When I hear the words 'engineering judgement', I know they are just going to make up numbers" (Feynman, 1993).In the light of what we know, how should a professional engineer build and assure the safety of systems? Do we need different international standards and regulatory frameworks? Should there be international co-operation to develop the components and tools that could replace the proprietary, unsound and over-complex products currently available?