Proofs that software systems meet standards for functional safety have depended on exhaustive testing. This method is inadequate for today’s multi-threaded systems, whose complexity precludes their being treated as deterministic systems in practice. In Part I of this whitepaper series we discuss the limits of testing of complex software systems, and some factors that should be weighed when deciding how to build complex software systems that must meet functional safety standards.