Safety profiles at compile time — the July state of a memory leak being a compile error

Fifteen years of safety-critical rail delivery leaves you with one habit that doesn't go away: you stop trusting "it passed the tests" and start asking for a reason the unsafe version could never have been built at all. This is the dated notebook entry for the point that habit became a compiler flag.

What it was

qc2 --safety nasa-p10.safety is QUANTA's safety certifier: a compile-time gate that runs six static checkers against a NASA/JPL "Power of Ten"-style profile and refuses to build a program that violates one. Clean code gets a certificate. The mechanism is general — a .safety profile parser reads a named profile file, and profiles form a lattice, with nasa-p10 sitting under SIL4, which sits under DO-178C.

What we built

✅Shipped & measured

Six static checkers run under the profile: no heap allocation after initialisation, bounded loops only, no recursion, a function-length ceiling, a minimum assertion density, and checked return values on every call. A program breaking any one of these does not compile — not a lint warning, a build failure. The mechanism is grounded in real delivery, not theory: roughly fifteen years of safety-critical work across global rail and metro systems, where "wrong" is a safety risk and every claim gets assessed by someone whose job is to disbelieve it by default.

What we learned — including the honest gaps

The line between built and designed is held deliberately, and it matters more here than almost anywhere else on this site, because the claim is "certifiable." Only the nasa-p10 rung of the lattice actually compiles and certifies today. SIL4, DO-178C, and the further-out rungs above them are designed, not proven — the lattice shape exists, the rung that runs does not yet extend that far.

A WCET (worst-case execution time) certificate — bounding time, not just memory and control-flow shape — is the named next build, not a shipped capability. For a hard-real-time assessor, bounding time is often the more important half of the safety story, and this entry says plainly that half is still ahead.

And the six checkers are exactly what they say: six specific, named properties. A safety property that isn't on that list — something outside no-heap-after-init, bounded loops, no recursion, assert density, checked returns, and function length — is not covered by this mechanism as it stands today.

Where it went / status

Live and running as of this entry's date, and the lab's clearest example of "a memory leak is a compile error" holding up as a literal, checkable statement rather than a slogan. The fuller measured detail — including the specific arena-bug reduction this mechanism made possible in practice — is tracked on the linked research page, which updates as the remaining rungs of the lattice and the WCET certificate move from designed to built.