Dependability assessment of safety-critical or safety-related software components is an important issue for example within the nuclear industry, the avionics sector or the military. Statistical testing is one way of quantifying the dependability of a given software product. The use of sector-specific standards with their suggested test-criteria is another (nonquantitative) way of aiming at employing only components that are "dependable enough". Ideally, both, the acknowledged test criteria and statistical test methods should come into play when assessing software dependability. We want to - in the long-term - move towards this aim. Thus we investigate in this paper a model to combine the fault-detection power of a given test-set (a test-adequacy criterion) with the statistical power of the test-set, i.e. the number of statistical tests within the test-set. With this model we aim at drawing out of any given test-set - whether devised by a plant engineer or a statistician - the overall contribution it can make to dependability assessment.

In this paper we describe an approach to capture the degree of compliance of a product with an industry standard such as the international standard for functional safety of E/E/PE systems, IEC 61508. We call this the evidential volume of an assessment scenario. It is based on compiling observed evidence according to assigned weighting factors, which describe the relative importance of each piece of evidence. The evidential volume can by itself be used as an indicator to compare different assessment scenarios. This could form the basis for improved consistency in assessment. We suggest a model to relate the evidential volume to the probability of having achieved a product of required safety integrity. Developing such a relationship can lead to a decision-aid on acceptance or rejection or can be used to decide whether additional evidence, such as statistical testing could be used to achieve target safety integrity. The model we suggest is based on the Success Likelihood Index Model (SLIM) and it poses an initial step towards decisionsupport for assessment. The model developed can be used for any standard, IEC 61508 is used as an example only.

We address the difficult problem of estimating the reliability of multiple-version software. The central issue is the degree of statistical dependence between failures of diverse versions. Previously published models of failure dependence described what behavior could be expected "on average" from a pair of "independently generated" versions. We focus instead on predictions using specific information about a given pair of versions. The concept of "variation of difficulty" between situations to which software may be subject is central to the previous models cited, and it turns out to be central for our question as well. We provide new understanding of various alternative imprecise estimates of system reliability and some results of practical use, especially with diverse systems assembled from pre-existing (e.g., "off-the-shelf") subsystems. System designers, users, and regulators need useful bounds on the probability of system failure. We discuss how to use reliability data about the individual diverse versions to obtain upper bounds and other useful information for decision making. These bounds are greatly affected by how the versions' probabilities of failure vary between subdomains of the demand space or between operating regimes-it is even possible in some cases to demonstrate, before operation, upper bounds that are very close to the true probability of failure of the system-and by the level of detail with which these variations are documented in the data.

Following the current trend towards the increased use of commercial off-the-shelf (COTS) components in safety-critical systems, the need arises to address safety issues related to COTS-based systems. In this paper, we introduce a hierarchical model to estimate the probability of failure, on demand, of a software system consisting of components. Thereby, available evidence on the components' failure behaviour is combined using a Bayesian approach. An additive error term is proposed to model the changes in a component's prior reliability once the component is transferred from the operational environment assumed by the software developer into the actual operating environment. Statistical system test data are incorporated to calculate the estimator of the system failure rate. This approach involves prior knowledge at the level where it is most likely to be available: the component level.