where possible, pre-tested separately, the expected 
behaviors documented, and roll-back procedures prepared. After changes, the systems should 
be monitored for unexpected and unacceptable behavior. If such behavior is discovered the 
changes and their consequences should be reversed. Whole-system testing or unit testing can 
address this requirement; complex safety-type tests are not required. Testing can be very 
expensive, but there should be some recognition of the fact that a completely open regime 
w