When a safety override is guessed,
the consequence is fatal.
Safety-critical systems run on assumptions that are never fully verified: software requirements that trace to informal hazard analyses, hardware components qualified on test articles that differ from production, and operational procedures written for nominal conditions. Every system you trust today treats these gaps as managed risk. ARACHNE labels the gaps as ignorance and escalates.
Four gaps no current
tool admits openly.
These are not edge cases. They are the daily reality of safety-critical systems operations. And every existing system handles them the same way: it guesses, assigns a confidence score, and moves on.
Software Safety Case with Incomplete Hazard Coverage
Software safety cases claim completeness against hazard analyses. The analyses themselves are based on expert judgment, not exhaustive enumeration. The gap is rarely quantified.
Hardware Qualification Traceability
Safety-critical hardware is qualified by test. Production units may differ in material, process, or supplier. The qualification status of the as-built unit is often assumed by lot, not verified individually.
Operational Procedure Deviations
Procedures are written for nominal conditions. Operators deviate when reality diverges. The safety analysis rarely covers every deviation pattern that emerges in practice.
Independent Verification and Validation Gaps
IV&V is required for safety-critical software. The independence is often organizational, not technical. The V&V team may lack access to the same assumptions the development team used.
Every claim carries proof.
Every gap carries a label.
The Margin Expansion organ binds 36 required input nodes before any bounded action. In pharma, those nodes include stability status, CoA completeness, safety signal provenance, and regulatory precedent. Missing any one is not a failure—it's labeled ignorance, escalated, and recorded.
Stability-Gated Batch Release
Hard gate: no batch releases without completed stability profile or explicit operator override with versioned reasoning.
PROVEN · RECOMPUTABLESignal Provenance Tracking
Every safety signal traced to source database, query date, and confidence threshold. Stale signals flagged automatically.
TESTED · VALIDATING LIVECoA Completeness Verification
Incoming certificates checked against 14 required fields. Incomplete CoAs halt the gate—never silently accepted.
ARCHITECTURE · DOCUMENTEDRegulatory Delta Audit
Every submission tracked against its evidentiary base. When evidence evolves, the delta is computed and surfaced.
IN DEVELOPMENTWhere proof replaces
confidence scores.
These are not aspirational. Each use case below maps to a live, checkable proof in the validation ledger. You can recompute every claim yourself.
Autonomous Vehicle Safety Decision LIVE PROOF
An autonomous vehicle encounters a scenario not in its training dataset: a construction worker directing traffic with non-standard hand signals. ARACHNE evaluates the perception system confidence, the planning system fallback options, and the safety monitor override authority.
- Non-standard hand signal → perception confidence drops below threshold
- No trained fallback for this scenario → labeled ignorance
- Safety monitor triggers minimum risk maneuver, not continued driving
- Scenario logged for training dataset update with provenance record
Medical Device Software Update ARCHITECTURE PROVEN
A Class III medical device requires a software update to address a cybersecurity vulnerability. ARACHNE evaluates the update decision against 36 nodes: vulnerability severity, patch verification status, regression test coverage, and clinical impact assessment.
- Missing certificates halt qualification—not waived, not assumed
- Clinical impact assessment based on simulated use, not real patients → flagged
- Cybersecurity patch from vendor, not independently reviewed → provenance gap
- Update approval conditional on post-market surveillance enhancement
Nuclear Safety System Actuation Logic VALIDATION LEDGER
A nuclear plant evaluates a proposed change to the reactor protection system setpoints. ARACHNE evaluates the change against 36 nodes: safety analysis basis, deterministic analysis coverage, probabilistic analysis update status, and regulatory approval alignment.
- Probabilistic analysis uses 2018 initiating event frequencies → stale data flagged
- Deterministic analysis covers design basis, not beyond-design-basis → labeled
- Regulatory approval pending, not granted → conditional status explicit
- Change deferred until all gaps closed or accepted with documented rationale
Not projected.
Proven.
Every number below is recomputable from public sources. No vendor claims. No confidential data. Just proofs you can run yourself.
"We had a safety case that was 400 pages long and said everything was fine. A regulator asked us to show the trace from every claim to its evidence. We could do it for 60%. The other 40% was engineering judgment, and we had labeled it all as proven. ARACHNE does not let you do that."