Today
- 5+ tools, no shared data model
- Manual cross-referencing between methods
- Stale evidence discovered in audit
- Traceability gaps delay certification
Systems & safety analysis platform
The safety case that knows when it has gone out of date.
SPARC runs seven safety analysis methods — hazard assessment, fault trees, FMEA, dependence diagrams, STPA, common cause and the GSN argument — on one data model. Evidence freshness is computed on every read, never stored, so nothing goes stale silently.
FHA
SA90-FHA-32 Issue 2 · Hazardous
FTA
Top-event Q = 4.5 × 10⁻⁸ · run 41
CM
Objective 1 × 10⁻⁷ /fh recorded · INCOMPLETE — no typed per-flight-hour result yet
GSN
G3 cites run 41 · evidence CURRENT
DEMONSTRATION DATA — NOT A SAFETY RECORD · seeded SA-90 evaluation tenant
Built around the standards you certify against
ARP4761AARP4754BEASA CS-25.1309IEC 61025
The problem
Safety analysis is scattered across a dozen disconnected tools.
Fault trees in one application, FMEA in spreadsheets, the safety case in another editor, requirements in a fourth. When a failure rate changes, an engineer re-checks all of them by hand — and auditors find the gaps.
With SPARC
- One data model spanning all seven methods
- Links created at every methodology transition
- Evidence freshness computed on every read
- Append-only audit trail with before/after state
Provable claims
Three facts from the schema.
Each of these is a property of the data model — checkable against the schema and the API in minutes, and demonstrable on the live instance.
GSNEvidenceLink → no status column
CURRENT, STALE or MISSING is recomputed on every read from the computation runs each claim cites. A status that cannot be persisted cannot rot.
compliance_status → not writable
The status is derived from the linked analyses on refresh — today it reports INCOMPLETE or NOT ASSESSED and reserves COMPLIANT / NON-COMPLIANT for a typed per-flight-hour result. The field is absent from the update schema — there is nowhere to type an override.
one entity registry → every link cleaned
Links are created at each methodology transition — most in one traceability table, GSN evidence and STPA-hazard links in tables of their own — and one entity registry cascade-cleans all of them in both directions on delete. Manual links are supported through the same API.
The platform
The four claims.
-
01
Evidence freshness is computed, not stored.
GSN claims cite computation runs. Freshness derives on every read against the run each claim captured — nothing marks itself current.
Evidence → -
02
Verdicts are derived, never typed.
The compliance matrix records each failure condition's objective and derives its status from the linked analyses — enforced at the schema boundary, recomputed on refresh. Today that status is INCOMPLETE until a typed per-flight-hour quantity exists: SPARC states what it cannot yet conclude, and why.
Evidence → -
03
Two independent solvers must agree.
MOCUS and a from-scratch ROBDD, auto-selected by tree size and required to produce identical minimal cut sets across the regression suite.
Engine → -
04
One data model, links made at the transition.
Function → FHA, FHA → fault tree, FMEA → basic event, dependence diagram → FHA, STPA → FHA, GSN → evidence run — created automatically, cleaned in both directions on delete. Every entity mutation lands in the append-only audit trail.
Evidence →
Methodologies
Seven methods, operational today.
-
Functional Hazard Assessment
FHA
-
Fault Tree Analysis
FTA
-
Dependence Diagrams
DD
-
Failure Mode & Effects
FMEA
-
Systems-Theoretic Process Analysis
STPA
-
Common Cause Analysis
CCA · CMA / ZSA / PRA
-
Goal Structuring Notation
GSN
Seven more — PHA, HAZOP, Bow-Tie, ETA, Markov, RBD and ALARP — are specified in the architecture and not yet built. They are listed on the methods page, badged as roadmap, never mixed into the operational set.
How it works
From hazard to safety argument, in one thread.
The platform creates the traceability links at every transition — no manual cross-referencing between stages.
01
Identify hazards
FHA assigns severity and safety objectives, linked back to system functions.
02
Analyse
Fault trees, dependence diagrams, FMEA and common-cause analysis, quantified and cross-linked.
03
Evaluate risk
Objectives recorded and analysis coverage tracked in the compliance matrix, recomputed on refresh — what is not yet demonstrated is stated, never assumed.
04
Argue safety
A GSN argument cites the evidence directly — freshness recomputed on every read.
Standards & compliance
Built for the regulator in the room.
Every failure condition carries its safety objective, and the compliance matrix derives its status from the linked analyses — stating what has not yet been demonstrated. Every change lands in an append-only audit trail with before/after state — and the audit log ships inside each exported workbook as its own sheet.
- Project-configurable classifications and probability objectives
- Append-only audit trail with before/after state on every change
- Every demonstration-project export marked NOT A SAFETY RECORD
| Failure condition | Result / objective | Status |
|---|---|---|
| Inability to extend gear — any means | Objective 1×10⁻⁷ /fh · FTA run 41 linked | Incomplete |
| Misleading down-and-locked indication | Linked · awaiting computation | Incomplete |
| Gear doors fail to close after extension | No analysis linked | Not assessed |
Verdicts are derived only — compliance_status is not a writable field, for anyone. COMPLIANT and NON-COMPLIANT are reserved for a typed per-flight-hour result the engine does not yet compute.
SysML v2
In buildThe safety node of your digital thread.
SysML v2 made the system model the authoritative system definition. SPARC is being built to consume that definition, anchor every analysis to model elements at a pinned commit, and name the linked safety artefacts when the model moves. It will not compete with your modeller — it holds the safety analysis attached to it.
Model import ships together with the completeness checks that catch never-assessed imported functions — completeness cannot read green while that count is non-zero.
Built today
- An ingestion engine that reads the SysML v2 standard JSON serialisation — and refuses any run it cannot fully account for. Library-level today; the import screen is part of the build.
- Unknown model constructs are counted and reported, never silently dropped.
- Element references inside analyses are not written yet — that table, the completeness checks and drift reporting are the build.
Refusals
What SPARC refuses to do.
Each of these is deliberate, and each is enforced in code.
Approximate common-cause models it does not implement
MGL and alpha-factor CCF are rejected outright, not approximated. The engine implements beta factor, and that is all it accepts.
Ingest a model it cannot account for
An ingestion run that cannot account for every element is refused, not warned about. Unknown constructs are counted, never dropped.
Let demonstration data pass as evidence
Every export from a demonstration-marked project carries DEMONSTRATION DATA — NOT A SAFETY RECORD, in the document and as a print footer on every worksheet page.
Say which sign-in field was wrong
A failed sign-in returns the same message whether or not the account exists. Invitation and failure responses read identically from the outside.
See your safety case, fully connected.
Request access for a walkthrough of the live instance against your own analysis workflow — every claim on this page is demonstrable in the seeded SA-90 tenant.