  A safety verification task involves verifying a system against a desired
safety property under certain assumptions about the environment. However, these
environmental assumptions may occasionally be violated due to modeling errors
or faults. Ideally, the system guarantees its critical properties even under
some of these violations, i.e., the system is \emph{robust} against
environmental deviations. This paper proposes a notion of \emph{robustness} as
an explicit, first-class property of a transition system that captures how
robust it is against possible \emph{deviations} in the environment. We modeled
deviations as a set of \emph{transitions} that may be added to the original
environment. Our robustness notion then describes the safety envelope of this
system, i.e., it captures all sets of extra environment transitions for which
the system still guarantees a desired property. We show that being able to
explicitly reason about robustness enables new types of system analysis and
design tasks beyond the common verification problem stated above. We
demonstrate the application of our framework on case studies involving a
radiation therapy interface, an electronic voting machine, a fare collection
protocol, and a medical pump device.
