Evidence & audit
What an IV&V reviewer or certification specialist will ask, answered from the schema — including what SPARC does not claim.
01 · LINKS
Every cross-reference is a typed, directional, bidirectional row — most in one traceability table, GSN evidence citations and STPA-hazard links in tables of their own — and one entity registry cascade-cleans all of them. The key transitions create them automatically — function → FHA, FHA → fault tree, FMEA → basic event, dependence diagram → FHA, STPA → FHA, GSN → evidence run — and deleting either end cascade-cleans the link in both directions. Manual links are supported through the same API.
Known limit: entity mutations carry the audit record. The dependence-diagram row sync does not write its own audit event yet.
02 · FRESHNESS
A GSN solution node cites a computation run. Whether that citation is still good is derived on every read — GSNEvidenceLink has no status column, so there is nothing to hand-set and nothing persisted to rot. Each link keeps the baseline it was captured against; the verdict is derived from it on every read.
03 · VERDICTS
The compliance matrix derives each failure condition's status from the linked analyses. Today it returns INCOMPLETE (linked, but no typed per-flight-hour result), NOT ASSESSED (nothing linked) or NOT APPLICABLE (no safety effect); COMPLIANT and NON-COMPLIANT are reserved for a typed Average Probability per Flight Hour result the engine does not yet compute. compliance_status is absent from the update schema, so the strongest form of the claim is the literal one: there is nowhere — for any role, at any privilege — to type a verdict. The status is recomputed on refresh.
The one qualitative check in force is the catastrophic single-failure screen over the pinned minimal cut sets — a statement about the computed model, never about the system, and never certification evidence.
04 · AUDIT
Every entity change writes an audit event capturing who, when, and the before/after state of the fields that moved. The audit log ships inside each exported FTA, FHA and FMEA workbook as its own worksheet — the reviewer gets the history with the data, in the same file.
05 · DELIVERABLES
DOCX reports and formatted XLSX workbooks are produced from the analyses as they stand — FTA reports carry the tree diagrams, cut sets and importance rankings; covers carry the document reference and date. Every export from a demonstration-marked project prints DEMONSTRATION DATA — NOT A SAFETY RECORD in the document and as a footer on every worksheet page.
Stated limits
A certification audience checks the omissions first. Here they are.
SPARC is not a qualified tool. No Tool Qualification Level has been determined and no DO-330 tool qualification data exists. What is built toward the evidence a qualification argument needs: database-level append-only guards on the three safety ledgers, a published and versioned mathematics specification, and a debt register that names what those guards still need — a least-privilege runtime database role among them.
There is no classification handling today. The specified design — markings across every document producer and a fail-closed instance ceiling the server enforces — is written and awaiting ratification.
Self-hosting works today on an ordinary connected host. An offline install bundle, and reconnection sync for disconnected working, are recorded roadmap items.
Excluded by a ratified architectural decision: one deployment serves one organisation. Hosted means a dedicated instance, not a shared one.
None are issued today. The FTA mathematics specification is v1.3, a draft not approved for compliance use; no Average Probability per Flight Hour quantity is computed, and every comparison path fails closed and says why. When an independent review found the engine comparing a dimensionless unavailability with per-flight-hour objectives, the product withdrew the verdict on every surface that issued it and migrated the persisted ones closed. Verdicts return only when a typed quantity exists — never before.
Single-organisation deployment today, one analyst per project. Team sharing on flat projects is the next platform stage; what's built today is per-job compute isolation with cross-worker cancellation.
The claim boundary
Four sentences that appear in full here and are linked from the footer of every page. They are the boundary of every claim on this site.
SPARC is a safety-analysis tool. It supports the ARP4761A safety assessment process and the ARP4754B development assurance process. It does not confer compliance on any product.
SPARC is not a qualified tool. No Tool Qualification Level has been determined and no DO-330 tool qualification data exists. Users remain responsible for verifying SPARC outputs by independent means. SPARC output is not certification evidence unless the applicant has verified it under their own approved processes.
The SPARC FTA mathematics specification (SPARC-SPEC-FTA-MATH-001) was independently reviewed on 16 August 2026. That review covered the specification and a static composition review of the implementation at a pinned baseline. It was a technical review, not a certification approval.
Artefacts marked "DEMONSTRATION DATA — NOT A SAFETY RECORD" are never certification evidence.