COOLJAPAN OÜ / OxiAutors
OxiAutors — AUTOSAR Classic + Adaptive

Nine proofs. Six exhaustive. Three with the bounds printed.

A Pure Rust AUTOSAR Classic and Adaptive platform in one workspace — RTE, VFB, OSEK OS, MCAL, BSW, ara::com, ara::crypto, UDS, SOME/IP and Uptane OTA. In our own competitive table, the formal-verification row reads "None" for all three incumbents. Ours reads what it actually is, bounds included.

33 crates 172,267 lines Classic + Adaptive Kani 0.67 · CBMC 6.8 Not ASIL-D certified
Proof runoxiautos-formal · kani 0.67.0 · cbmc 6.8.0
ItemCountStatus
Harnesses failing0None
Harnesses written but not run0None
Unbounded CBMC loop unwinds0All bounded
Proof bounds left in a footnote0All printed
ASIL-D certificates held0None
Harnesses passing0of 9, ~19s
Nine harnesses, about nineteen seconds, on kani-verifier 0.67.0 with CBMC 6.8.0. Six cover their full input domain. Three are bounded, and the bounds are in the proof section below rather than in a footnote. Two of the nine had never actually run before this exercise — finding that out is what the exercise was for. Bounds printed
Clause 01Landscape

Four platforms, one certificate, and nobody doing formal verification.

This is our own competitive table, reproduced with the row that goes against us left in. Three of the four axes favour Rust. One does not, and it is the one a Tier 1 will ask about first.

PlatformLanguageMemory safetyISO 26262 ASIL-DFormal verificationClassic + Adaptive
AUTOSAR ClassicCManualEstablishedNoneClassic only
Adaptive APC++RAII onlyPartialNoneAdaptive only
Vector MICROSARC / C++ManualCertifiedNoneSeparate products
OxiAutorsRustCompile-timeNot certified9 Kani harnesses, 4 kernel-checked lemmasOne workspace, partial spec coverage

MICROSAR is certified and OxiAutors is not. There is no version of that sentence that helps us, so it is at the top of the page instead of the bottom. What the table does show is that the formal-verification column is empty for all three incumbents, and that Classic and Adaptive being separate products is a procurement fact rather than a technical necessity. Whether those two things outweigh a certificate is your decision, and it depends entirely on where you are in the programme.

Clause 02Platform

What is in the thirty-three crates.

Classic and Adaptive against the same core types, in one workspace, with one build.

Classic platform
  • OSEK OS with timing protection and the priority-ceiling protocol
  • RTE and VFB routing
  • 18 MCAL driver modules
  • BSW COM and memory stacks
  • E2E Profiles
  • ARXML code generation
Adaptive platform
  • ara::com with SOME/IP service discovery, fuzzed at 10,000 proptest cases per property
  • ara::exec, ara::diag, ara::phm
  • ara::crypto with ML-KEM and ML-DSA under FIPS-203 and FIPS-204, plus a vehicle PKI over RustCrypto and rustls
  • ara::update with Uptane/TUF OTA, delta patching and A/B boot slots
Safety and vehicle
  • ISO 14229 UDS security access
  • ASIL decomposition algebra
  • Fault-tree cut-set analysis per NUREG-0492 and IEC 61025
  • 6-state EKF and UKF with NIS chi-square gating (χ²₂ at 99% = 9.21)
  • Perception, planning, powertrain and vehicle-dynamics crates
Clause 03Proof

Every harness, and exactly what it covers.

Formal verification is the easiest thing in this industry to imply and the hardest to check. Nine harnesses run under Kani 0.67.0 and CBMC 6.8.0, and all nine pass in about nineteen seconds. Six are exhaustive over their input domain. Three are bounded, and here are the bounds.

WDT-1Watchdog FSM reachabilityExhaustive. Full 4-state × 3-event product; the triggered state is reachable.
WDT-2Watchdog FSM no-panicExhaustive. Same product; no input sequence panics.
WDT-3Watchdog reset disciplineExhaustive. Reset is reachable only from the triggered state.
OSEK-1Priority orderingExhaustive over the whole u8 domain, 0 through 255.
OSEK-2Priority-ceiling protocolExhaustive. No priority inversion.
OSEK-3Scheduler deadlock freedomExhaustive. No deadlock in the modelled scheduler.
MPU-1Partition disjoint isolationBounded. Two partitions, one MPU region each, size ≤ 4096 bytes, symbolic base. Given the disjoint precondition, no address is in both.
E2E-1Profile 1 protect, no overflowBounded. 8-byte buffer, length 2 to 8, offset 0 to 4, offset + length ≤ 8, kani::unwind(9) on the CRC loop.
E2E-2Profile 2 protect, no overflowBounded. Same envelope, plus a symbolic 16-entry data_id_list.

Kernel-checked lemmas — oxilean

OL-1asil_d_decompositionKernel-checked and attested.
OL-2sr_port_round_tripKernel-checked and attested. Cross-checked against the shipping SenderReceiverPort.
OL-3vfb_routing_deterministicKernel-checked and attested. Cross-checked against the shipping VfbRouter.
OL-4cs_request_response_livenessKernel-checked and attested.
OL-5e2e_p4_integrityBlocked. A documented kernel reduction limit on nested Nat operations. Not proved.

Two of the nine Kani harnesses did not work when we first ran them. kani_wdt.rs was an orphaned module that had never been compiled since the day it was written. kani_e2e.rs had an unbounded CBMC unwind and never terminated. Both were real defects in our own verification, and both were invisible for as long as the harnesses were written and never executed. We are telling you this because the industry standard for a page like this is to report the nine and not the two, and because if you are buying verification you should want a supplier who ran it.

oxilean is an in-house, homegrown pure-Rust prover and kernel for the Calculus of Inductive Constructions. It is not the Lean 4 toolchain and has no relationship to mathlib; lean and lake are not installed anywhere in this project. proof_certificate.rs renders certificate text — it is a document generator, not an attestation service.

Clause 04Status

Engineering prototype. Read this before the price.

Nothing in this section contradicts the section above. The proofs are real and the bounds are real. What does not exist is anyone official who has agreed with us.

9 of 9 Kani harnesses, run locally with CBMC 6.8.0Passing
4 of 5 oxilean lemmasKernel-checked and attested
e2e_p4_integrity lemmaBlocked on a documented kernel limit
Kani in CINot wired. cargo kani setup is a local step.
3 further Kani harnesses elsewhere in the workspaceWritten, never run
ISO 26262 ASIL-D certification by any bodyNone
TÜV or equivalent sign-offNone
Qualified AURIX / TC4x hardware, HighTec ASIL-D Rust toolchainNot integrated
Formally-verified RTE, RTE deadlock freedomRoadmap. Not results.
AUTOSAR specification coveragePartial. Assess per crate.

Four crates in the workspace are placeholders and should not be counted as capability by anyone evaluating this: oxiautos-cloud, oxiautos-python, oxiautos-twin and oxiautos-hil are between 36 and 43 lines each. They are in the crate list because removing them would be a different kind of dishonesty. Also note that the kani-verifier crate in Cargo.lock is the crates.io shim, a dev-dependency of oxiautos-formal; the Kani compiler and CBMC themselves come from cargo kani setup, and a fresh CI runner has to repeat that.

Clause 05Licence

Priced in public. The incumbent is not.

Vector quotes MICROSAR on application. That means you cannot find out whether an AUTOSAR platform is affordable without first telling a competitor's sales team what you are building. Annual terms, per vehicle programme, invoiced once.

Evaluation
Free90 days · full source

Complete workspace, the nine Kani harnesses, the oxilean attestations and the status section above in full detail. Non-commercial use only. No sales contact unless you ask for it.

Platform
US$40,000per year · one vehicle programme

Source licence for one vehicle programme, unlimited ECUs and unlimited units. Verification artefacts regenerated per release: the Kani run log with its bounds, the oxilean attestations, and a CycloneDX SBOM. Five business day response.

Programme
US$110,000per year · all programmes

All vehicle programmes, a named engineer, participation in your ISO 26262 work products, and support for the version you ship for the vehicle lifetime. Source escrow on request.

Priced per vehicle programme — not per ECU, not per unit, not per seat. No royalty on vehicles shipped, no runtime fee, no audit clause. The number is on this page because the incumbent's is not, and because you should be able to work out whether this is affordable before you tell anyone what you are building. What the number does not buy is a certificate. Read the status section again before you decide it is a bargain.

Clause 06Provenance

Two of the nine had never run. We found out by running them.

The other products in this ecosystem close this page with a stack tree — nine years of replacing C, one layer at a time, until there was nothing foreign underneath. OxiAutors contains almost none of that stack. It takes one crate from the ecosystem, oxilean, and otherwise stands on RustCrypto and rustls. The RTE, the VFB, the OSEK scheduler with its timing protection and priority ceilings, the MCAL layer, the E2E profiles and the whole ara:: stack were written in this workspace against the AUTOSAR documents.

So the provenance claim here is not about depth. It is about what happens when someone actually runs the verification. Nine Kani harnesses had been written for this workspace. When we installed Kani 0.67.0 and CBMC 6.8.0 and ran them, two did not work: kani_wdt.rs had never been compiled since the day it was authored, and kani_e2e.rs had an unbounded unwind that ran forever. Both were real defects, both were in our own verification rather than in the product, and both were completely invisible for as long as the harnesses existed but were never executed. All nine pass now.

OxiAutors 33 crates · 172,267 lines of Rust ├─ RTE · VFB · SWC written here, from AUTOSAR Classic ├─ OSEK OS · MCAL · BSW written here — timing protection, priority ceiling ├─ ara::com/exec/diag/crypto/phm/update written here, from Adaptive ├─ E2E profiles · UDS · SOME/IP written here, from the specifications └─ reused ├─ OxiLean in-house CIC kernel — oxiautos-formal only │ └─ OxiZ SMT, pulled in by OxiLean, not called directly ├─ RustCrypto AES-GCM, SHA-2, P-256, ML-KEM, ML-DSA └─ rustls TLS for ara::com └─ Rust core. #![no_std] on the L1 and L2 layers.

That is why the bounds are printed on this page instead of a claim of formal verification. Six of the nine cover their entire input domain. Three cover a bounded one — eight-byte buffers, four-kilobyte partitions — and a bounded proof that tells you its bounds is worth more to a safety case than an unbounded claim that does not.

Most of the ecosystem is public on GitHub under Apache-2.0. The AUTOSAR platform is the part we licence.

Clause 07Next

Send us the row that stops you.

Most conversations about this platform end on one line of the status section — usually the certification row, sometimes the MCAL coverage for a specific part. Send that line and the ECU you have in mind. You will get back what is implemented for that target, what is not, and whether the honest answer is that you should buy MICROSAR this programme and talk to us about the next one. One business day, no qualification call.