Analysis of Critical Systems Certification

We introduce the filter model of regulatory certification of safety-critical systems. This model characterizes the certification process itself as a safety-critical system in which incorrectly certifying a system that should be rejected is an accident. The role of certification is modeled as the identification of faults in the system being certified, i.e., a filter for system faults. Application of safety-engineering techniques to the certification process allows assessment of certification and offers the possibility of correction of weaknesses.