What the paperwork Buys.

Flight software is written against a standard, and which standard decides a surprising amount about schedule and cost. In Europe that is ECSS; in the United States, the NASA procedural requirements. They agree on the essentials and differ in structure.

Traceability, in both directions. Every requirement reaches code and a test; every piece of code traces back to a requirement. Code that traces to nothing is as much a finding as a requirement that was never implemented.

Structural coverage. At the highest criticality it is not enough that tests pass. You must show which branches and conditions were exercised, and account for any that were not.

Coding standards with justified deviations. Usually a MISRA-style subset. Dynamic allocation after initialisation, recursion and unbounded loops are the usual casualties.

Independence. At high criticality, verification is done by people who did not write the code, and assurance reports outside the project chain. The point is not distrust of the developer but the fact that the person who misread a requirement while writing the code will misread it the same way while testing it. Independence is what stops a shared assumption from being verified against itself.

Failure analysis. FMEA and fault trees that include the software, not just the hardware it commands. The interesting cases are rarely the software faulting outright. They are the software behaving exactly as specified while a sensor lies to it, a timing assumption stops holding, or two components each do the right thing and the combination does not.

The cost driver is criticality, not size. The same algorithm at Category A and Category D can differ by an order of magnitude in effort, entirely in evidence rather than code. This is why establishing criticality early matters more than almost any other early decision.

• Deciding criticality late. Retrofitting Category A evidence onto code written without it is close to a rewrite.
• Traceability as an afterthought. Reconstructing it at the end costs several times what maintaining it would have.
• Autocoded models without generator qualification. Generated code inherits the standard’s requirements, and the generator itself becomes something to justify.
• Assuming tailoring is automatic. ECSS permits tailoring; it does not grant it. It is negotiated and recorded.