Larry Dighera writes:

The required level is determined from the safety assessment
process and hazard analysis by examining the effects of a failure
condition in the system.

In other words, nobody actually examines or formally verifies the
code.

--
Transpose mxsmanic and gmail to reach me by e-mail.