The favored approach for the opponents seemed to by careful development and rigorous analysis of the software. A poll of the audience after the discussion showed that a large majority didn't feel that probabilistic thinking was reasonable for software. W.D. Ehrenberger, Tech Report EUR11147en, Commission of the European Communities, Nuclear Science and Technology, 1988. Lots of interesting summaries of the use of computers in various nations for nuclear and safety-related applications. There is some transfer of responsibility involved in the certification process, morally if not legally.
Certification is normally a large process, with much delegation and summarization.
The assembly code was mechanically translated into FDL for analysis, with annotation of proof obligations automatically inserted during the translation. A flow analysis of the FDL code raised queries that were resolved by the implementation team before the proof was conducted. The generation of further annotations for the proof was done automatically, but the proof itself involved substantial human interaction. Approximately 100 modules were proven. Total correctness was not proven for all modules, but only about 12 involved loops at all, and the certification team assured themselves that the loops had a fixed limit on the iterations.