> in those cases, the unit test might not catch anything because the spec is wrong!
That's why you have three different, independent parties design everything important thrice, and compare the results. I'm serious. If you're not convinced this is necessary, just take a look at https://ghostwriteattack.com/riscvuzz.pdf.
(Your other suggestions are also necessary, and I don't think that would be sufficient.)
That's why you have three different, independent parties design everything important thrice, and compare the results. I'm serious. If you're not convinced this is necessary, just take a look at https://ghostwriteattack.com/riscvuzz.pdf.
(Your other suggestions are also necessary, and I don't think that would be sufficient.)