Reducing Uncertainty About Software Safety