A bakery oven-guard model, given the same thermal frame twice, can emit two slightly different “pull tray / leave tray” commands because of small input jitter or internal randomness. A safety assessor wants a guarantee of one exact command. What obstacle should the tester explain?

The same thermal frame twice, two slightly different pull-tray commands: non-determinism. That makes precise behavior hard to guarantee even after thorough testing. A safety assessor cannot treat a test pass as one exact command, and a conventional interlock is not equally non-deterministic.