In the real world, software does not fail in every use. Yet current standards recommend using a probability value of 1. What is the best approach for analyzing risk of medical software?