Solutions
One checker.
Every machine that moves.
Kirra sits between whatever decides — a planner, a PLC master, a language model — and whatever moves. Here is what that means for each class of machine, told as the failure it prevents. Every mechanism links to its source.
Already happened
None of this is hypothetical.
Every failure class below has already made the news. We won't claim any system prevents every incident — what we can show, file by file, is the shipped mechanism aimed at each one.
Atlanta · 2025
Robotaxis drove into flooded streets
During heavy storms, robotaxis were filmed driving into standing water. The physics is unforgiving:
water is specular to lidar — it returns almost no signal, so geometric perception sees an absence, not
a hazard. Kirra's perception layer names this exact problem in its source and answers it by policy:
Water is a first-class non-drivable semantic class, all standing water is treated
as non-drivable (depth-from-one-sensor is explicitly declared unsolved rather than guessed), and
semantic fusion is only allowed to shrink the drivable corridor — a fusion result that loosens
it is a hard zero in CI.
San Francisco · 2023
An AV dragged the pedestrian it stopped for
After a collision, an AV executed its programmed pullover at ~3 m/s — under its speed ceiling, so nothing intervened — dragging the pedestrian beneath it 20 feet. Kirra's Degraded posture is designed against this incident by name: after a fault, only commands that converge to a stop are admissible, the vehicle holds at zero, and the governor never authors re-acceleration. The no-re-initiation rule is machine-checked by proof, not just tested.
crates/kirra-core/src/kinematics_contract.rsverification/kani/src/proofs_kinematics.rs:166
Multiple US cities · 2024–2025
Robotaxis drove into fireworks and street chaos
Vehicles have been filmed proceeding into active fireworks, crowds, and scenes their models plainly didn't understand. The failure isn't one bad detection — it's a stack with no concept of "I can't classify this, so I shouldn't proceed." In Kirra, that concept is structural: sensor confidence below its floor faults the node and degrades posture; two perception channels that disagree cap speed to zero; an unevaluable prediction resolves to minimum-risk. Unknown never maps to proceed — that rule holds in every posture, including Nominal.
src/recovery_hysteresis.rscrates/kirra-trajectory/src/perception_redundancy.rs:224
Oldsmar, Florida · 2021
A water plant's lye setpoint was raised 100-fold
An operator watched the sodium hydroxide setpoint climb from 100 ppm to 11,100 ppm on a remotely accessed HMI — caught by human luck, minutes from dosing a town's water. Later accounts debate intrusion versus operator error, and that debate is the lesson: the control system accepted a 111× toxic setpoint on valid credentials either way. Kirra's industrial adapters decode the actual write on the wire and deny on magnitude — an out-of-envelope setpoint is refused regardless of whose credentials carried it, and the refusal is a permanent, hash-chained record.
docs/protocol_adapters.mdsrc/bin/kirra_verifier_service/dnp3_mandatory_audit_tests.rs
Autonomous vehicles
LIVEDegraded decel-to-stop is enforced at four points in the stack and machine-checked by proof; the safe-state spec (KIRRA-SSS-001) assigns a safe state to every fault class.
A physics envelope the planner can't argue with
Every command is clamped to a per-class kinematic contract — speed, acceleration, steering rate, lateral load — hard boundary first, rate limits second. The robotaxi profile is the frozen reference, and NaN anywhere is an instant deny, proved over all 2⁶⁴ bit patterns.
docs/CONTRACT_PROFILES.mdverification/kani/src/proofs_kinematics.rs
Formal distance keeping, not tuned heuristics
RSS safe-distance mathematics — longitudinal and lateral as a conjunction, occlusion caps at blind junctions, multi-modal prediction of cut-ins — refuse trajectories that current-position checks would miss.
parko/crates/parko-core/src/rss.rsdocs/adr/0017-multi-modal-predictive-rss.md
Governs the stack you already run
The decision of record keeps Autoware as the driving stack, isolated in its own container; Kirra bounds its output at a frozen contract. You don't replace your planner — you make it accountable.
Robots that work around people
LIVEAn envelope sized for sidewalks, not shrunk from cars
The courier class is its own ODD: 3.0 m/s max, 0.6 m lateral band, omnidirectional pedestrian RSS (people step out of doorways behind you), and a bounded yaw channel for differential drive.
docs/adr/0028-sidewalk-courier-odd.mddocs/safety/PEDESTRIAN_RSS.md
Watchdogs on every input
Telemetry silence beyond 2 seconds marks the source untrusted and recomputes posture within 100 ms. Perception freshness budgets degrade prediction gracefully — but never let old data pass as current.
src/telemetry_watchdog.rscrates/kirra-trajectory/src/vru_channel.rs
Proven on a physical robot
This isn't a simulator story: first governed motion on an Ackermann robot with a live lidar ran in July 2026, on the same code paths CI tests — with the bring-up runbooks and known limitations published.
robot/install/README.mddocs/adr/0014-rosmaster-r2-orin-nx-kirra-integration.md
Industrial control & OT
LIVEDecoders for hostile inputs are fuzzed continuously — the DNP3 setpoint decoder is one of the four standing fuzz targets. The full OT & utilities page →
Native protocol awareness
Modbus and OPC-UA event mapping, DNP3 Analog Output (g41) magnitude envelopes, per-target typed CANopen SDO bounds, CIP Set_Attribute_Single bounds — each with a strict mode that denies writes to any target without a configured bound.
docs/protocol_adapters.mdcrates/kirra-industrialsrc/protocol_adapter.rs
Posture across the plant
Assets form a dependency fabric: a faulted upstream asset degrades what depends on it, and industrial events feed the same fleet-posture engine that gates every command class.
An audit trail regulators can verify
Every denied setpoint lands in the hash-chained ledger with the decoded value that was refused — shippable off-box to WORM storage and independently re-verifiable. The DNP3 deny path is mandatory-audited by test.
src/audit_shipper.rssrc/bin/kirra_verifier_service/dnp3_mandatory_audit_tests.rs
LLM-driven machines
LIVEThe attempt is recorded either way: hallucinated commands become permanent, hash-chained audit entries.
One door from words to motion
Free text → typed MickIntent (seven verbs, one parse, malformed ⇒ HOLD) → planner grounds it against the map → checker validates the trajectory. A model outage stops the conversation, never the safety case.
crates/kirra-planner/src/mick_llm.rsdocs/llm_integration_guide.md
Action claims, filtered
Structured LLM/agent outputs pass an action filter that validates every claim against current posture before anything downstream sees it — and the JSON intent parser is a standing fuzz target.
The fence is compile-time
The LLM-facing crates cannot link the release token, the serial consumer, or the ROS/DDS actuation path — checked by a CI gate on the dependency graph, not by convention.
Fleet operations
LIVEIdentity by proof, not assertion
Every node answers challenges with an Ed25519 signature over a fresh nonce — optionally rooted in a TPM measured-boot quote. No proof, no trust, no route.
crates/kirra-safety-authority/src/attestation.rssrc/tpm_quote.rs
Updates that halt before they hurt
Governor artifacts roll out in staged campaigns that are fail-closed on fleet posture — a degraded fleet halts the rollout automatically — with Uptane-verified metadata and health-gated A/B rollback on every node.
A control plane that survives its own failures
HA failover with durable epoch fencing means exactly one writer even when the old primary comes back; the drill runs in CI, and the lease algebra is machine-proved.
READ THE SOURCE
Your machines, held to an envelope.
Whatever proposes — a planner, a PLC master, a language model — Kirra decides what reaches the actuators. Start with the class that matches your fleet.