You can apply every fancy safety model (V cycle, iso262626, ASIL, MIRSA) and nothing can guarantee you write one-shot bug free software when your software is slightly more complex than just controlling some lights, sensors or actuators.

But you’d catch cases like this where the hardware is immediately bricked during driving. If you didn’t, your tests aren’t up to snuff.

Let’s not let perfection obstruct progress.

>your tests aren’t up to snuff

Yup, my test is not perfect, but "Let’s not let perfection obstruct progress".

Are you suggesting the “does it drive” test after an update isn’t a reasonable test that should be a fairly common sense one to add in?

In all scenarios, tricky bugs will happen. Something inconceivable will go untested. But that’s not what happened here. This is basically functionality being lost that very obviously should have been tested.

In that sense, they could have made progress. Nobody is expecting perfection. You seem to be hung up on the distinction

This is not a case of 'absolutely bug free', more a case of 'not obviously and stupidly broken'.