Designed in one building, trusted in another

The team that designed the part is rarely the team that has to trust it in production. A test report transfers a conclusion without the reasoning that produced it.

Why a report does not travel

The receiving team either re-runs the campaign for itself or accepts a risk it cannot size. Neither option gets cheaper as the fleet grows. Both scale with the number of teams that need convincing rather than with the number of parts.

A certificate carries the reasoning with the conclusion. Whoever receives it re-checks it with a small kernel of their own, rather than trusting the tool that produced it.

A certificate traveling from the team that designed a part to the fleet that runs itOn the left, a chip die labeled design team. In the middle, a sealed certificate document. On the right, a rack of servers labeled production fleet, with a small kernel box beneath it marked as the place the certificate is re-checked. Arrows run from the die to the certificate and from the certificate to the rack.Design TeamThe PartCertificateProduction FleetRe-checkedBy a kernel the receiving team runs
A part designed by one team and run by another. The certificate travels with the part and is re-checked where it arrives, so the receiving team relies on its own check rather than on the tool that produced the proof.

Certificate

Re-checked on receipt

Every proof the toolchain proposes is re-checked by the LOGOS Proof Kernel, and the certificate it returns is what crosses the boundary between teams. How that check works is set out under How we prove it.

How a certificate is checked, first? How we prove it

Running parts your own team designed?

Contact our team