How can we prove our machine is safe