How Is Critical Life or Death Software Tested?
I wrote software for Radars.  Kind of important (not like plane software). 
We used Ada alot, which in my estimation helped.  Software was reviewed.  Tests were reviewed.  Reliability was favored over other things (for example recursion was discouraged).  We used Ada's constrained types (this value is between 1 and 99, if it goes out of range, throw an exception).<p>For external hardware inputs, we had software simulating the messages when we couldn't get the real equipment in the lab.  We were writing software for a radar that didn't yet exist.<p>And it was tested and tested and tested and tested.....<p>The when the pieces came together in integration.  They tested and tested.  An when they built the physical radar, the software worked.  A few configuration things here and there needed adjusting.<p>Actually testing was built into the software. When it came up it would talk to the physical parts to make sure everything was communicating ok before it could start running.<p>Was it bug free?  Probably not.  You can't test every possible scenario.  But we took the work seriously.  It took longer to get code done than any other environment I've been in, but the code ended up very solid quality.