A graphics processing system configured to use a rendering space which is subdivided into a plurality of tiles to render a scene that includes safety-critical elements of geometry, the graphics processing system being configured to: receive elements of geometry of the scene to be rendered, one or more of the elements of geometry being a safety-critical element of geometry; process elements of geometry, in a geometry processing phase, so as to form, for each tile of the rendering space, a respective tile list indicating the elements of geometry included in that tile; and for each of a plurality of the tiles, process elements of geometry in the tile, in a fragment processing phase (409, 410), so as to generate a respective fragment-processed output; wherein the graphics processing system comprises a controller configured to: cause a set of one or more safety-critical elements of geometry to be processed in the geometry processing phase; identify as protected tiles one or more tiles for which the corresponding one or more tile lists are modified due to processing the set of one or more safety-critical elements of geometry in the geometry processing phase; cause each of the protected tiles to be processed first and second times in the fragment processing phase so as to, respectively, generate first and second fragment-processed outputs; and raise a fault signal if the first and second fragment-processed outputs of a protected tile do not match. receive elements of geometry of the scene to be rendered, one or more of the elements of geometry being a safety-critical element of geometry; process elements of geometry, in a geometry processing phase, so as to form, for each tile of the rendering space, a respective tile list indicating the elements of geometry included in that tile; and for each of a plurality of the tiles, process elements of geometry in the tile, in a fragment processing phase (409, 410), so as to generate a respective fragment-processed output; wherein the graphics processing system comprises a controller configured to: cause a set of one or more safety-critical elements of geometry to be processed in the geometry processing phase; identify as protected tiles one or more tiles for which the corresponding one or more tile lists are modified due to processing the set of one or more safety-critical elements of geometry in the geometry processing phase; cause each of the protected tiles to be processed first and second times in the fragment processing phase so as to, respectively, generate first and second fragment-processed outputs; and raise a fault signal if the first and second fragment-processed outputs of a protected tile do not match. cause a set of one or more safety-critical elements of geometry to be processed in the geometry processing phase; identify as protected tiles one or more tiles for which the corresponding one or more tile lists are modified due to processing the set of one or more safety-critical elements of geometry in the geometry processing phase; cause each of the protected tiles to be processed first and second times in the fragment processing phase so as to, respectively, generate first and second fragment-processed outputs; and raise a fault signal if the first and second fragment-processed outputs of a protected tile do not match.