Planning under uncertainty in safety-critical systems