Industrial & OT

Valid credentials.
Catastrophic command.
Denied on physics.

The dangerous failure in operational technology isn't always an intruder — it's a valid, authenticated write with a physically impossible value: a 100-fold lye setpoint, a 400% output, a reversed valve. Kirra decodes the actual control write on the wire and denies on magnitude, regardless of whose credentials carried it — and records the refusal in a ledger a regulator can verify.

Oldsmar, Florida — February 2021. An operator watched the sodium-hydroxide setpoint at a municipal water plant climb from 100 ppm to 11,100 ppm on a remotely-accessed HMI — a 111× jump toward dosing a town's drinking water, caught by human luck minutes from harm. Whether the cause was an intrusion or an operator error is still debated, and that debate is the lesson: the control system accepted a physically catastrophic setpoint on valid credentials either way. A magnitude envelope on the wire refuses it in both cases.

Kirra's founder holds licensed operating experience on public water-treatment control systems — the exact class of infrastructure this addresses. About the company

Setpoint bounding on the wire A control write travels from an operator or engineering workstation toward a PLC or RTU. Kirra decodes the setpoint by its configured type, checks the magnitude against a physical envelope, and either forwards an in-range value or denies an out-of-range one and records it in the hash-chained ledger — regardless of whether the credentials were valid. HMI / workstation valid credentials Operate / Set KIRRA — on the wire decode by configured type check magnitude vs envelope undecodable ⇒ refuse, never guess in range PLC / RTU command applied out of range DENY + hash-chained record identity does not excuse physics

docs/protocol_adapters.mdsrc/protocol_adapter.rscrates/kirra-industrial

Native protocol awareness

It reads the wire, not a wrapper

Kirra decodes each control write by its configured type — because the frame on the wire carries width at best, never type — then bounds the decoded value. A write that can't be faithfully decoded is refused, never fabricated. Envelopes are configuration; a high-assurance strict mode denies any write to a target with no configured bound.

ProtocolWhat Kirra boundsConfigurationStatus
DNP3 Analog Output (g41) control writes — Operate / Direct_Operate setpoints KIRRA_DNP3_ANALOG_OUTPUT_ENVELOPE LIVE
CANopen SDO expedited-download setpoints, decoded by the OD entry's type (i8…f32) KIRRA_CANOPEN_SDO_BOUNDS · _STRICT_BOUNDS LIVE
EtherNet/IP (CIP) Set_Attribute_Single writes, decoded by the attribute's data type KIRRA_CIP_ATTR_BOUNDS · _STRICT_BOUNDS LIVE
Modbus / OPC-UA Event mapping into the fleet posture engine protocol_adapter.rs LIVE

CLAUDE.mdcrates/kirra-industrial

Env-var names are the repository's own; each maps a target (node/index/attribute) to a typed min:max range. Unconfigured targets are posture-only; strict mode makes them deny-by-default.

Why OT teams trust it

Fail-closed, auditable, adversary-tested

Deny on physics, not identity

The envelope check is on the decoded magnitude. A compromised-but-authenticated workstation, an insider, or a fat-fingered setpoint are all refused by the same rule — the one thing they have in common is a physically out-of-range value.

crates/kirra-industrial

A record regulators can verify

Every denied setpoint lands in a SHA-256 hash-chained ledger with the decoded value that was refused — tamper-evident, shippable off-box to WORM storage, and independently re-verifiable. The DNP3 deny path is mandatory-audited by test.

src/audit_shipper.rssrc/bin/kirra_verifier_service/dnp3_mandatory_audit_tests.rs

Hostile inputs are fuzzed

The decoders face malformed frames continuously — the DNP3 analog-setpoint decoder is one of four standing fuzz targets, run on every push and deep-fuzzed weekly. An undecodable payload is refused, never interpreted.

fuzz/fuzz_targets/dnp3_analog_setpoint.rs.github/workflows/fuzz-deep-weekly.yml

Posture across the plant

Assets form a dependency fabric: a faulted upstream asset degrades what depends on it, and industrial events feed the same fleet-posture engine that gates every command class across the site.

docs/multi_asset_fabric.md

Sits in front of what you run

Kirra is a governor, not a replacement PLC or SCADA. It bounds the control write between the issuing layer and the actuator — your existing automation stays; it simply gains a physics-aware veto it can't talk its way past.

docs/adr/0020-doer-invariant-safety-case.md

Standards-aligned, honestly

The safety case maps to IEC 61508 SIL 3 and the run-time-assurance patterns OT regulators recognize — drafted in the open, versioned with the code. Independent assessment has not yet been performed, and we say so.

docs/safety/IEC_61508_SIL3_MAPPING.mdcertification.html

READ THE SOURCE

Bound the setpoint. Keep the plant.

Bring us your protocol, your targets, and your physical limits — we'll show you where Kirra's envelope sits in your control path today, and where it's roadmap.

View the repository Browse the documentation