NASA NPR 7150.2D Software Engineering Requirements SWE-134: Build the safe-state and integrity behaviours into safety-critical and mission-critical software

What does SWE-134 require?

Where the project's software includes safety-critical or mission-critical components, the project manager implements in the software: initialisation to a known safe state at first start and restarts; safe transitions between all predefined known states; termination to a known safe state; operator overrides requiring at least two independent operator actions; rejection of out-of-sequence commands where their execution could cause a hazard; detection of inadvertent memory modification with recovery to a safe state; integrity checks on inputs and outputs; prerequisite checks before safety-critical commands execute; no single software event or action able to initiate an identified hazard; response to off-nominal conditions fast enough to head off a hazardous event; error handling; and the ability to place the system in a safe state.