Certifiable by construction: a memory leak is now a compile error

Fifteen years of safety-critical delivery across global rail and metro leaves you with one conviction: runtime is too late. An audit does not want to hear that you caught the memory leak in testing; it wants evidence the unsafe program could never have been built. So we built exactly that into the compiler.

The leak that will not compile

✅Shipped & measured

As of 2026-07-02, qc2 --safety nasa-p10.safety rejects violations against a NASA/JPL "Power of Ten"-style profile and issues a certificate on clean code. 🟢 Six static checkers run at compile time:

• no heap allocation after initialisation
• bounded loops only
• no recursion
• a function-length ceiling
• a minimum assertion density
• all return values checked

A program that breaks one of these does not compile. The real arena bug this kills in practice: memory use from 1.5 GB down to 3.4 MB — a 441× reduction — because the class of mistake that caused it is now rejected at the door. 🟢

The profile is general: a .safety parser reads a profile file, and the profiles form a lattice — nasa-p10 sits under SIL4, which sits under DO-178C. No patent covers the mechanism: we demonstrate, we don't claim patents. Our own invention process drafted six provisional patents and has filed zero with any patent office — the accounting is on the record in PatentFactory.

What is designed, not yet proven

🔭Upcoming

We hold the line between "built" and "designed":

• The full profile lattice — SIL4, DO-178C, EN50128, ISO 26262, IEC 62304 — is designed, not yet proven. 🔭 nasa-p10 is the one that compiles and certifies today.
• A WCET (worst-case execution time) certificate is designed and is the next build. 🔭 Bounding time, not just memory, is what a hard-real-time assessor ultimately needs.
• The STABILITY gate for plastic/learning updates — a Lyapunov-bounded update, potentially a bigger moat than the static gate — is designed and unproven. 🔭

The heritage underneath

This is not a bolt-on. It sits on roughly 15 years of real safety-critical delivery across global rail and metro — environments where "wrong" is a safety risk and every claim is assessed. (We name no clients; the discipline is the point, not the logos.) When AI enters aviation, rail, medicine and infrastructure — and it will — "proven correct, proven bounded, proven honest, certifiable" stops being one option among many. It becomes the only one that passes.

Why it ladders back

AI safe enough for the things that keep people alive is trust at scale — and trust at scale is the precondition for letting capable systems actually help in the places that matter most.