Functional safety standards are performance based standards, which means they are shades of grey rather than prescriptive "follow these design clauses".
The designers get together and in a formal process try and come up with every possible adverse outcome and the probability it is likely to occur.
They then rank and use this info to assign performance requirements to various safety aspects and functions.
But a key part of the overarching parent IEC61508 standard is that there is a safety lifecycle - the designers make their best guess but the manufacturer has to at regular intervals compare actual gathered data against the predicted design data used and adjust accordingly, iterating to a better place.
Just like you might win the lottery first time you buy a ticket, under a performance based standard you might experience an adverse outcome in the first day of use, doesn't mean the design was necessarily deficient.
Infinite safety takes infinite cost, which would mean no cars, and what would the cost of that be to society.
Like I said,it's all shades of grey.
