Solutions

One checker.
Every machine that moves.

Kirra sits between whatever decides — a planner, a PLC master, a language model — and whatever moves. Here is what that means for each class of machine, told as the failure it prevents. Every mechanism links to its source.

Already happened

None of this is hypothetical.

Every failure class below has already made the news. We won't claim any system prevents every incident — what we can show, file by file, is the shipped mechanism aimed at each one.

Atlanta · 2025

Robotaxis drove into flooded streets

During heavy storms, robotaxis were filmed driving into standing water. The physics is unforgiving: water is specular to lidar — it returns almost no signal, so geometric perception sees an absence, not a hazard. Kirra's perception layer names this exact problem in its source and answers it by policy: Water is a first-class non-drivable semantic class, all standing water is treated as non-drivable (depth-from-one-sensor is explicitly declared unsolved rather than guessed), and semantic fusion is only allowed to shrink the drivable corridor — a fusion result that loosens it is a hard zero in CI.

crates/kirra-taj/src/lib.rs:189crates/kirra-kpi-gate

San Francisco · 2023

An AV dragged the pedestrian it stopped for

After a collision, an AV executed its programmed pullover at ~3 m/s — under its speed ceiling, so nothing intervened — dragging the pedestrian beneath it 20 feet. Kirra's Degraded posture is designed against this incident by name: after a fault, only commands that converge to a stop are admissible, the vehicle holds at zero, and the governor never authors re-acceleration. The no-re-initiation rule is machine-checked by proof, not just tested.

crates/kirra-core/src/kinematics_contract.rsverification/kani/src/proofs_kinematics.rs:166

The full AV story

Multiple US cities · 2024–2025

Robotaxis drove into fireworks and street chaos

Vehicles have been filmed proceeding into active fireworks, crowds, and scenes their models plainly didn't understand. The failure isn't one bad detection — it's a stack with no concept of "I can't classify this, so I shouldn't proceed." In Kirra, that concept is structural: sensor confidence below its floor faults the node and degrades posture; two perception channels that disagree cap speed to zero; an unevaluable prediction resolves to minimum-risk. Unknown never maps to proceed — that rule holds in every posture, including Nominal.

src/recovery_hysteresis.rscrates/kirra-trajectory/src/perception_redundancy.rs:224

Oldsmar, Florida · 2021

A water plant's lye setpoint was raised 100-fold

An operator watched the sodium hydroxide setpoint climb from 100 ppm to 11,100 ppm on a remotely accessed HMI — caught by human luck, minutes from dosing a town's water. Later accounts debate intrusion versus operator error, and that debate is the lesson: the control system accepted a 111× toxic setpoint on valid credentials either way. Kirra's industrial adapters decode the actual write on the wire and deny on magnitude — an out-of-envelope setpoint is refused regardless of whose credentials carried it, and the refusal is a permanent, hash-chained record.

docs/protocol_adapters.mdsrc/bin/kirra_verifier_service/dnp3_mandatory_audit_tests.rs

The full OT story


Autonomous vehicles

LIVE
October 2023, San Francisco: after a collision, an AV executed its pullover at ~3 m/s — under its speed ceiling, so nothing stopped it — dragging a pedestrian 20 feet. The stack was following its rules. The rules were wrong. Kirra's Degraded posture was designed against exactly this failure: after a fault, the governor admits only commands that converge to a stop, holds at zero, and never authors re-acceleration. A crawl that satisfies a speed cap is still denied, because the rule is about the direction of travel toward stillness — not a number.

Degraded decel-to-stop is enforced at four points in the stack and machine-checked by proof; the safe-state spec (KIRRA-SSS-001) assigns a safe state to every fault class.

A physics envelope the planner can't argue with

Every command is clamped to a per-class kinematic contract — speed, acceleration, steering rate, lateral load — hard boundary first, rate limits second. The robotaxi profile is the frozen reference, and NaN anywhere is an instant deny, proved over all 2⁶⁴ bit patterns.

docs/CONTRACT_PROFILES.mdverification/kani/src/proofs_kinematics.rs

Formal distance keeping, not tuned heuristics

RSS safe-distance mathematics — longitudinal and lateral as a conjunction, occlusion caps at blind junctions, multi-modal prediction of cut-ins — refuse trajectories that current-position checks would miss.

parko/crates/parko-core/src/rss.rsdocs/adr/0017-multi-modal-predictive-rss.md

Governs the stack you already run

The decision of record keeps Autoware as the driving stack, isolated in its own container; Kirra bounds its output at a frozen contract. You don't replace your planner — you make it accountable.

docs/adr/0036-autoware-distro-migration-occy-gap.md


Robots that work around people

LIVE
A sidewalk delivery robot shares space with children, dogs, and people who aren't watching it. The dangerous failure isn't the obstacle it sees — it's the pedestrian sensor that quietly died ten seconds ago while the robot keeps driving on stale confidence. Kirra treats silence as a fault: an armed pedestrian channel that goes quiet caps speed to zero. The robot stops because it can no longer prove the sidewalk is clear — which is the only honest thing a blind robot can do.

An envelope sized for sidewalks, not shrunk from cars

The courier class is its own ODD: 3.0 m/s max, 0.6 m lateral band, omnidirectional pedestrian RSS (people step out of doorways behind you), and a bounded yaw channel for differential drive.

docs/adr/0028-sidewalk-courier-odd.mddocs/safety/PEDESTRIAN_RSS.md

Watchdogs on every input

Telemetry silence beyond 2 seconds marks the source untrusted and recomputes posture within 100 ms. Perception freshness budgets degrade prediction gracefully — but never let old data pass as current.

src/telemetry_watchdog.rscrates/kirra-trajectory/src/vru_channel.rs

Proven on a physical robot

This isn't a simulator story: first governed motion on an Ackermann robot with a live lidar ran in July 2026, on the same code paths CI tests — with the bring-up runbooks and known limitations published.

robot/install/README.mddocs/adr/0014-rosmaster-r2-orin-nx-kirra-integration.md


Industrial control & OT

LIVE
A compromised engineering workstation — or just a fat-fingered setpoint — writes a 400% output command to a PLC. The protocol is valid, the credentials check out, and the actuator will happily comply. Kirra's industrial adapters decode the actual control write on the wire — a DNP3 analog setpoint, a CANopen SDO download, an EtherNet/IP attribute write — check the decoded value against a configured physical envelope, and deny what's out of range. A payload that can't be faithfully decoded is refused too: the governor never guesses what a malformed frame meant.

Decoders for hostile inputs are fuzzed continuously — the DNP3 setpoint decoder is one of the four standing fuzz targets. The full OT & utilities page →

Native protocol awareness

Modbus and OPC-UA event mapping, DNP3 Analog Output (g41) magnitude envelopes, per-target typed CANopen SDO bounds, CIP Set_Attribute_Single bounds — each with a strict mode that denies writes to any target without a configured bound.

docs/protocol_adapters.mdcrates/kirra-industrialsrc/protocol_adapter.rs

Posture across the plant

Assets form a dependency fabric: a faulted upstream asset degrades what depends on it, and industrial events feed the same fleet-posture engine that gates every command class.

docs/multi_asset_fabric.md

An audit trail regulators can verify

Every denied setpoint lands in the hash-chained ledger with the decoded value that was refused — shippable off-box to WORM storage and independently re-verifiable. The DNP3 deny path is mandatory-audited by test.

src/audit_shipper.rssrc/bin/kirra_verifier_service/dnp3_mandatory_audit_tests.rs


LLM-driven machines

LIVE
You want a robot you can talk to. The model, sooner or later, will tell it to do something insane — a hallucinated 999 m/s velocity, an action type that doesn't exist, a confidently wrong tool call. Kirra's answer is structural: language can only become one thing — a typed intent through a single fail-closed parse — and that intent still faces the full checker like any other proposal. On our own talking robot, a CI gate proves the conversational code has no compile path to actuation. The model can say anything. It can't do anything.

The attempt is recorded either way: hallucinated commands become permanent, hash-chained audit entries.

One door from words to motion

Free text → typed MickIntent (seven verbs, one parse, malformed ⇒ HOLD) → planner grounds it against the map → checker validates the trajectory. A model outage stops the conversation, never the safety case.

crates/kirra-planner/src/mick_llm.rsdocs/llm_integration_guide.md

Action claims, filtered

Structured LLM/agent outputs pass an action filter that validates every claim against current posture before anything downstream sees it — and the JSON intent parser is a standing fuzz target.

src/action_filter.rsfuzz/fuzz_targets/llm_json_intent.rs

The fence is compile-time

The LLM-facing crates cannot link the release token, the serial consumer, or the ROS/DDS actuation path — checked by a CI gate on the dependency graph, not by convention.

ci/check_mick_actuation_fence.py


Fleet operations

LIVE
It's 2 AM and one vehicle in your fleet fails attestation — its software isn't what you signed. In most fleets, you find out in a postmortem. In Kirra's model, trust is recomputed continuously from cryptographic proof: the node goes Untrusted, everything depending on it degrades, and the next command routed anywhere in that dependency graph feels the change. Recovery isn't a timer — it's five clean reports in ten seconds, or an operator's signature.

Identity by proof, not assertion

Every node answers challenges with an Ed25519 signature over a fresh nonce — optionally rooted in a TPM measured-boot quote. No proof, no trust, no route.

crates/kirra-safety-authority/src/attestation.rssrc/tpm_quote.rs

Updates that halt before they hurt

Governor artifacts roll out in staged campaigns that are fail-closed on fleet posture — a degraded fleet halts the rollout automatically — with Uptane-verified metadata and health-gated A/B rollback on every node.

crates/kirra-ota-campaigncrates/kirra-ota-installer

A control plane that survives its own failures

HA failover with durable epoch fencing means exactly one writer even when the old primary comes back; the drill runs in CI, and the lease algebra is machine-proved.

tests/ha_failover.rsverification/kani/src/proofs_lease.rs


READ THE SOURCE

Your machines, held to an envelope.

Whatever proposes — a planner, a PLC master, a language model — Kirra decides what reaches the actuators. Start with the class that matches your fleet.