2David L P, John A, Kwan S P. Evaluation of safety-critical software [J]. Communication of ACM, 1990, 33(6): 636-648.
3Selding P B. Faulty software caused Ariane 5 failure [J].Space News, 1996, 25(7): 24-30.
4Leveson N G, Turner C S. An investigation of the Therac-25 accident [J]. IEEE Computer, 1993, 26(7): 18-41.
5IEC 61508, Functional safety of electrical/electronic/ programmable electronic safety-related systems [S]. International Electrotechnical Commission, 1998.
6Parnas D L, Asmis G J K, Madey J. Assessment of safety-critical software in nuclear power plants [J]. Nuclear Safety, 1991, 32(2): 189-198.
7Howden W E. Good enough versus high assurance software testing and analysis methods [A]. In: Regina S S ed. Proceedings of the Third IEEE International High-Assurance Systems Engineering Symposium [C]. Washington D C: IEEE Computer Society, 1998. 166-175.
8Miller W M, Morell L J, Noonan R E, et al. Estimating the probability of failure when testing reveals no failures [J]. IEEE Trans On Software Engineering, 1992, 18(1): 33-43.
9Littlewood B, Strigini L. Assessment of ultra-high dependability for software-based systems [J]. Communications of the ACM, 1993, 36(11): 69-80.
10Littlewood B, David W. Some conservative stopping rules for the operational testing of safety-critical software [J].IEEE Trans On Software Engineering, 1997, 23(11): 673-683.
