Safe Autonomy: The Insufficient Testing Pitfall for Autonomous System Safety

"Testing less than the target failure rate doesn't prove you are safe.  In fact you probably need to test for about 10x the target failure rate to be reasonably sure you've met it. For life critical systems this means too much testing to be feasible."

http://safeautonomy.blogspot.com/2019/03/the-insufficient-testing-pitfall-for.html