Fail-closed policy gates
Every consequential request is evaluated against identity, mandate, purpose and data class; when no explicit decision exists the gate denies, and the denial is recorded.
GCRI · Foundry
Safety-critical software engineering
Software and safety-critical systems engineering applies rigorous practice where a software fault could reach a decision with real consequences. In this field it means fail-closed defaults, verified builds, known components, tested recovery, and an assurance case that states what has and has not been shown.
01Register
Safety-critical software engineering on the record.
Method recordSTEM method
- MethodSoftware and safety-critical systems engineering
- Applied inFoundry
- Data5 inputs
- Checks4 validation steps
- Canonical pageSTEM Commons
02Application
What software and safety-critical systems engineering does here.
Software and safety-critical systems engineering develops software whose failure could cause harm, loss of life or major disruption. It applies rigorous processes to control-system, medical, aviation and infrastructure software. In data and compute and methods and modelling, safety-critical software practice limits the chance that a software fault cascades through physical infrastructure. It informs assurance requirements for automated control in interconnected systems. The canonical description is on the STEM Commons.
Build provenance and bills of materials
Releases are built by a controlled pipeline that signs provenance attestations and produces a software bill of materials, so a deployed artefact can be traced to its source and components.
Assurance cases
Claims about a system, such as tenant isolation or kill-switch effectiveness, are argued from evidence in a structured case, with gaps and residual risks stated rather than assumed away.
03Methods and evidence
How safety-critical software engineering is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Model, equations and assumptions
The model structure used for safety-critical software engineering, the assumptions it makes and how each is tested.
Risk of element i
Ri = f(Hi, Ei, Vi, Ci)hazard, exposure, vulnerability and coping capacityExpected annual loss
EAL = ∑k pk · Lkover events k with annual probability pkCoupled systems
xt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| Assumption | Why it is made | How it is tested |
|---|---|---|
| Hazard and exposure are independent within an event | Keeps the loss integral tractable | Compare with a copula fit on joint records |
| Couplings are linear near the operating point | Lets shocks propagate through A | Perturb beyond the linear range and compare |
| Vulnerability curves transfer between places | Local curves are rarely available | Validate against observed losses where they exist |
- Inputs
- versioned datasets with provenance
- Outputs
- distributions, never single numbers
- Code
- released with the model card and tests
- Reproduction
- same data, code, environment and seed
FAIR guiding principles · GO FAIR and FORCE11W3C PROV · World Wide Web ConsortiumGuidance on consistent treatment of uncertainties · IPCCCEOS Analysis Ready Data · Committee on Earth Observation Satellites
04Data
What the method consumes.
Datasets and records used by software and safety-critical systems engineering on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
| Data | Role | Label |
|---|---|---|
| Source repositories and review records | Change history and approval | OBSERVED |
| Test coverage and mutation results | Verification depth | OBSERVED |
| Software bills of materials | Component inventory | OBSERVED |
| Vulnerability advisories | Exposure of components | REPORTED |
| Incident and fault logs | Failure analysis | OBSERVED |
05Process
How the process runs.
Process
Safety-critical software engineering: Risk management process
ISO 31000:2018 sets out an iterative risk management process, from scope, context and criteria through assessment and treatment to monitoring, review and reporting.
01 Frame
- 01Scope, context and criteriaDataset · Project ownerThe frame for the process: the scope, the external and internal context, and the risk criteria. Later steps are read against this frame.
02 Risk assessment
- 04Risk identificationStep · Project ownerThe first part of risk assessment. Risk is usually expressed by risk sources, potential events, their consequences and likelihood.
- 05Risk analysisModel · Project ownerThe second part of risk assessment. It considers consequences and likelihood of the identified risks, with guidelines, not a formula.
- 06Risk evaluationStep · Project ownerThe last part of risk assessment. Results of the analysis are compared with the risk criteria to see where more action is needed.
03 Treatment
- 07Risk treatmentStep · Project ownerTreatment options are selected, then plans are prepared and implemented. Residual risk is documented and goes to monitoring and review.
04 Across the process
- 02Communication and consultationStep · Project ownerCommunication and consultation with stakeholders is its own process element. The standard draws it alongside the others, not in sequence.
- 03Monitoring and reviewStep · Project ownerMonitoring and review take place at every stage. New experience, knowledge and analysis can revise elements, actions and controls.
05 Record and report
- 08Recording and reportingRecord · Project ownerThe process and its outcomes are documented and reported. The standard does not name who receives the report in the clauses read.
Outline of an external standard or method, from its public sources. It describes what the framework says, not a record of any run. It does not show that Nexus or any partner performs, certifies or approves a step. A gate is a step of the method, never a Nexus approval.
06Validation
How results are checked.
Software is verified through reviews, testing to defined coverage criteria and formal proofs where justified. Independent assessment examines the safety case.
| Check | How it is done |
|---|---|
| Deny-by-default tests | Requests without an explicit policy decision are tested to confirm they fail closed |
| Provenance verification | Deployed artefacts are checked against signed attestations before they run |
| Fault injection | Dependencies are failed deliberately to test recovery and isolation |
| Independent assessment | The assurance case is reviewed by an assessor outside the development team |
Complex software interacting with uncertain environments cannot be exhaustively tested. Updates and third-party components introduce new failure paths.
07Connections
Topics that rely on this method.
08Stewardship
Who maintains the method.
Cybersecurity and Digital Resilience stewards software and safety-critical systems engineering for the Consortium and reviews how it is applied across platforms.
09Connected
Where this page leads across the Consortium.
10Questions
Questions and answers.
What are the limits of software and safety-critical systems engineering in this field?
Complex software interacting with uncertain environments cannot be exhaustively tested. Updates and third-party components introduce new failure paths.
How are results checked?
Software is verified through reviews, testing to defined coverage criteria and formal proofs where justified. Independent assessment examines the safety case.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method’s use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRIFoundryFoundry Build and Readiness
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Foundry
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.