One living model carries the whole programme
Requirements, hazards, architecture, tests and evidence are one graph, graded against the live rule, from the first hazard to the sealed case
A link is not proof
Most requirements tools only confirm a link is there, CertProve checks whether it holds, so a broken, orphaned or unverified trace cannot hide behind a green tick
Only a passed test is evidence
A requirement with a failing or unrun test is not verified, however many links it carries
Trace runs both ways
A test that verifies nothing and a component nothing allocates to are gaps too, not clutter to ignore
A broken link is not a link
A trace pointing at an artefact that no longer exists is flagged as broken, never counted as healthy
Assurance cannot silently weaken
DAL flow-down is checked against ARP4754B, so implementation never carries less assurance than the hazard demands
The authority asks this first
A certification basis clause that no requirement cites is flagged before the review, not discovered in it
The whole aircraft, one model
Requirements, geometry, analysis and evidence resolve to a single connected model, not a folder of files that drift apart
Everything certification needs, already connected
From requirement to proof, one thread
A requirement, the components that implement it and the test that closes it, connected as structure. Pull any node and the whole chain answers.
Derived from the model, graded against the rule
Six analyses in one linked flow, every verdict graded against the 25.1309 ceiling, catastrophic ≤ 1e-9
Functional Hazard Assessment
Failure Modes & Effects
Preliminary System Safety
Fault Tree Analysis
Common Cause Analysis
System Safety Assessment
You do not page through it, you fly it
Fly the model
A spatial canvas with semantic zoom, pull back to the whole programme constellation, push in to a single requirement’s trace
Command by intent
Type what you want done and the cockpit navigates and acts, the fast path through a dense programme
A crew that cites or abstains
Every drafted row, requirement and gap arrives with its sources attached, and it refuses to invent a number
A cockpit that breathes
Readiness recomputes live as evidence lands, and a briefing greets you with exactly what changed overnight
