A statistical software testing model is proposed in which white box factors have a role. The model combines test adequacy notions with statistical analysis, and in so doing provides a rudimentary treatment of dependencies between test results caused by the execution of common code during the tests. The model is used to estimate the probability of failure on demand for software performing safety shutdown functions on large plants and concerns the case where extensive test results are available on the latest version of the software, none of which have resulted in software failure. According to the model, there are circumstances in which some current statistical models for dynamic software testing are too conservative, and others are not conservative, depending on the software architecture.>