Architecture — Catastrophe Mode
nNormal operation vs. catastrophe mode
o Catastrophe mode Þ high assurance CCB
nCatastrophe mode requires
oClear, limited goals = limited functionality
▬Hence easier than security
oStrict bounds on complexity
▬Less than 50k lines of code?
nCatastrophe mode is not a retrofit