Solutions / Aerospace and safety-critical operations
Longer-term pathwayShould this action be allowed to execute at all?
Where a decision drives hardware, a permission boundary matters more than an explanation. The question is not whether the reasoning was good. It is whether the action was permitted, and whether the record of that permission existed before it ran.
Two responses, both unsatisfying
Trust the upstream system
Places the whole safety case on the component least able to explain itself.
Review after the fact
Useful for learning. Useless for prevention.
Autonomy is moving into operational paths faster than the assurance methods for it. A deterministic permission boundary is one of the few controls that does not depend on understanding the model that proposed the action.
DAX does the work here
Deterministic Action Execution
Is this physical action allowed to happen?
DAX places a permission boundary between a decision and an action that affects hardware, machinery, infrastructure or another physical system. It is fail-closed: if the check cannot complete, the action does not proceed.
What each of them needs to see
| Role | What they need before this proceeds |
|---|---|
| Safety and airworthiness | Wants fail-closed behaviour proved, not asserted. |
| Operations | Wants the latency budget and the blast radius when the boundary is unavailable. |
| Assurance and certification | Wants to know exactly what EcoKure claims and, more importantly, what it does not. |
The gates that do the checking
This page exists because these implementations exist. We do not publish an industry page without gates behind it.
ExecutionGate
Open sourceFail-closed permission boundary for downstream use. The reference implementation of the DAX layer.
OrbitGate
Open sourceDeterministic verification for orbital and satellite claims, with benchmark artefacts.
FlightGate
ResearchEarly work applying action permission to flight-envelope and operational constraints.
GridGate
ResearchEarly work applying action permission to energy and grid operational limits.
UnitGate
Interactive labDimensional-analysis checker for physics equations. Catches equations that cannot be right regardless of the numbers.
What this is not
- EcoKure is not a safety-instrumented system, carries no safety integrity level, and does not replace one.
- It does not certify that any action is physically safe. It governs permission, not engineering.
- FlightGate and GridGate are research scope. They must not be placed in any live control path.
- This is a longer-term pathway. Procurement is long and the evidence bar is high, and both are stated plainly.
Start with one workflow
The useful first conversation is thirty minutes on a workflow where a change in rules or evidence has already cost you work. Both sides find out quickly whether this is worth pursuing.
Where it sits in what you already run
Nothing is replaced. The runtime deploys in your own account, so the only thing crossing the seam is a decision request one way and a verdict with its evidence coming back.
What one decision actually does
The same runtime and the same evidence contract as every other pathway. What changes is the control pack and the workflow.