Gravar-mail: On the use of CEP in safety-critical systems