Safety-Critical Systems
CHERI can make memory-access and isolation properties explicit, providing useful evidence within a wider safety and security case.
A safety-critical system must control both random faults and systematic design errors. As connectivity grows, it must also consider whether a security compromise can cause an unsafe outcome.
Properties that can be tested
CHERI provides architectural mechanisms for bounded memory access with controlled permissions. With suitable software, it can also isolate components within an address space. An assurance argument may use these mechanisms to support claims about:
- spatial memory safety for capability-mediated accesses;
- controlled access to code, data, and devices;
- reduced authority for lower-assurance components;
- explicit interfaces between components of different criticality;
- detection of invalid accesses close to their source.
The claim must be narrower than “the system is memory safe.” Temporal safety depends on allocation and revocation mechanisms. Unsafe language operations, assembly, device behaviour, concurrency, logic errors, and availability hazards require separate treatment.
Integrate safety and security
A capability fault stops an invalid operation, but the resulting trap or component termination can itself affect service. Define how the system contains, reports, restarts, degrades, or enters a safe state after a fault. Test the response under realistic timing and load.
Compartment design should follow hazards and trust boundaries. A lower-assurance diagnostics service might receive read-only access to selected measurements, while the control loop retains exclusive access to actuator state.
Evidence for a pilot
Record:
- the safety and security claims being evaluated;
- the precise hardware, toolchain, runtime, and configuration;
- the code and accesses covered by capabilities;
- the authority granted to every compartment;
- tests for boundary violations, lifetime errors, overload, and recovery;
- performance, worst-case timing, diagnostic, and resource results;
- assumptions and residual risks outside the mechanism.
Certification remains specific to a sector, product, and authority. Engage the relevant assessor early to determine how CHERI evidence can fit the applicable lifecycle and assurance standard.