Managing Uncertainty in the Design of Safety-Critical Aviation Systems