Certification posture
The strongest claim we make
is the one we don't.
Kirra is designed in alignment with ISO 26262 ASIL-D and IEC 61508 SIL 3 requirements. Independent third-party assessment has not yet been performed. That sentence is in the repository's README, and it governs every word on this page: what follows is the evidence program — its real status, artifact by artifact.
The safety case, in the open
65 safety artifacts under version control
Most safety cases live in a filing cabinet. Kirra's lives in
docs/safety/ — versioned, reviewable, and honest about its own maturity. Draft means draft.
| Artifact | Standard | Doc ID | Status |
|---|---|---|---|
| Safe-state specification | ISO 26262 (ASIL-D scope) | KIRRA-SSS-001 | LIVE |
| Hazard analysis & risk assessment | ISO 26262 Part 3 | AEGIS-HARA-001 | DRAFT |
| UL 4600 safety case (GSN) | UL 4600 | KIRRA-OCCY-UL4600-001 | DRAFT |
| SOTIF analysis + ODD definition | ISO 21448 | KIRRA-OCCY-ODD-001 | DRAFT — ODD §1 signed off |
| Cybersecurity threat analysis | ISO/SAE 21434 | KIRRA-OCCY-TARA-001 | DRAFT |
| SIL 3 mapping | IEC 61508 | KIRRA-SIL3-001 | DRAFT — pre-assessment |
| Run-time assurance mapping | ASTM F3269-21 | KIRRA-RTA-001 | DRAFT |
| AI-safety alignment statement | ISO/IEC TR 5469 | KIRRA-TR5469-001 | DRAFT — explicitly not a certification claim |
| Assumptions of use (SEooC) | ISO 26262 Part 10 | KIRRA-OCCY-AOU-001 | DRAFT — living register |
| Requirements traceability matrix | — | AEGIS-RTM-001 | LIVE — CI-gated |
docs/safety/SAFE_STATE_SPECIFICATION.mddocs/safety/HARA.mddocs/safety/UL4600_SAFETY_CASE.mddocs/safety/OCCY_SOTIF.mddocs/safety/OCCY_TARA.mddocs/safety/ASSUMPTIONS_OF_USE.md
Traceability
Requirements that CI can see
Machine-extracted matrix
Safety requirements are tagged in source with // SAFETY: annotations, the traceability
matrix is auto-generated from them, and a CI gate keeps code and matrix from drifting apart.
Gaps stay visible
The RTM gap report tracks exactly which safety goals lack test evidence — and the stub policy is explicit: never falsify coverage with a passing placeholder. A genuinely missing mechanism stays documented as missing.
docs/safety/RTM_GAP_REPORT.mdtests/cert_003_rtm_gap_stubs.rs
Safety goals, enforced
Nine Occy safety goals — speed envelope, lateral containment, RSS distances, MRC publication, staleness fail-closed, NaN/Inf rejection — with per-goal status honestly split between ENFORCED and Specified, and safety constants provenance-gated in CI.
docs/safety/OCCY_SAFETY_GOALS.mdci/check_safety_constants.py
Verification program
What's measured today — and what isn't yet
The distinction between an evidence plan and achieved evidence is the entire credibility of a safety case. Here is ours, plainly.
Measured and gated now
3,305 tests · 12 Kani proofs on the shipped source · Loom + Miri concurrency checking · 4 fuzz targets (60 s per push, 90 min weekly) · mutation testing on checker diffs · decision-coverage floors of 77–79% on the checker crates (measured ≈80%) · a Codecov anti-regression ratchet · a 248-scenario KPI gate with nightly 40,000-sample Monte-Carlo bounds · fault-injection suites mapped to safety goals.
Deferred, and labeled as such
True MC/DC coverage is toolchain-blocked upstream (branch coverage gates in the meantime; the evidence package tracks the Ferrocene path). Certified WCET awaits QNX-target-under-FIFO measurement. Quantified hardware metrics already shaped the design: single-supply PMHF fails the ASIL-D target (17.7 FIT), so the deployment requirement is a redundant supply (8.7 FIT — pass).
docs/safety/OCCY_MCDC_EVIDENCE.mddocs/safety/WCET_MEASUREMENT_METHODOLOGY.mddocs/safety/OCCY_QUANTITATIVE_METRICS.md
READ THE SOURCE
Assessors welcome.
The safety case index, the RTM, and every draft artifact are public. If you assess safety-critical systems for a living, we'd like to hear what we got wrong.