Topic · ISO 26262

What is ISO 26262, and how do I keep the software design document true in CI?

Gist

ISO 26262 is automotive functional safety. Part 6 is software. The useful artefact is an SDD whose sections still match the graph. Proof prints that document from the current traces with proof doc generate sdd, then fails the merge when the graph is stale.

proof doc generate sdd --output docs/sdd.html

Keep VectorCAST or LDRA if you need a TÜV-qualified C toolchain. Keep medini for the HARA worksheet. Proof is not that certificate, and it is not Part 5 hardware.

Request demo Last ASIL pack vs this push

01 · The dated safety pack

A handbook is not an SDD. An SDD from last ASIL review is not this push.

Part 6 clause 8 asks for a software architectural design. Clause 9 asks for unit design. A person can fill those once. The next commit does not reopen the pack.

The four jobs that are not automotive-specific (checkable shalls, re-derived links, MC/DC, a named reviewer) live on the DO-178C page. IEC 62304 still sits there. This page is the automotive document: render the SDD from the graph you already gate.

ASIL A through D is the cost/risk ladder, not a badge. Formal methods on software safety requirements are recommended at ASIL C and highly recommended at ASIL D. Kind2 realizability and Z3 data lemmas are those methods on the shalls you actually wrote. They are not a Type Approval. Hardware-software compatibility (Part 6, 7.4.3) is out of scope. Item definition and HARA still belong to the safety engineer.

proof validate --preflight
proof doc generate sdd --format html --output docs/sdd.html
proof audit --fail-level warn

The first command rejects a sentence the templates cannot parse. The second renders HTML (or Markdown) from loaded project data. PDF is a separate path and currently fails. The third is the standing gate. Generating docs before traces are refreshed is how the ASIL pack got stale in the first place.

02 · The exhibit

Same Part 6 headings. A date, or this graph.

The pack still has the section titles. The graph moved. Click the tabs.

Word / medini

Opened Part 6 headings from last review
SSR-04 still in the appendix

Sections present

This push

The unit design changed. The pack did not.

No re-render

Word / medini

Still last review. Still a date.

Keep the HARA

Proof

Ask does sdd still match traces
Gate audit --fail-level warn

Merge blocked if the graph is stale

Same Part 6 headings. A date, or this graph. Click the tabs.

Who	What they notice	What they lose
ISO 26262 / TÜV	The standard, ASIL A through D, Part 6 software, the certificate	They write the requirement. Keep them. Proof does not replace the standard and is not a qualified tool.
Jama / medini	A stored shall, a HARA worksheet, an item definition	They author the programme. They do not emit the SDD from the current graph. Keep them.
VectorCAST / LDRA	A qualified C toolchain and a structural-coverage kit	They still win at airborne and automotive C with a DER. The four-jobs H1 lives on DO-178C-style.
Proof	Current traces rendered into `sdd`, then the same audit on every push	No Part 5 hardware. No HARA. Tests are not executed. Not an ASIL certificate.

The generate command loads the project, then one template, then one format:

proof doc list-templates
proof doc generate sdd --format md --output docs/sdd.md
proof doc generate sdd --format html --output docs/sdd.html
proof audit --fail-level warn

Unknown template names fail before render. Unsupported formats fail before render. HTML and Markdown are the supported pair. PDF is classified separately and currently errors. Treat generated output as a view of the graph, not as a second source of shalls. If documentation coverage is low, the SDD is a thin print of a thin graph.

We have not run this template against a frozen ISO 26262 corpus, and we have not scored it against VectorCAST or LDRA on the same pack. The loss is named, not scored.

03 · The honest loss

A green Proof audit is not an ASIL.

ASIL A through D still belong to the programme. Proof will not sign ASIL D. It will not pretend a named reviewer is a TÜV assessment.

Part 6 clause 10 wants structural coverage that scales with ASIL, including MC/DC at D. FLIP measures specification-level MC/DC. Code-level coverage on C still wants the qualified toolchain. That H1 lives on MC/DC for Go, not here. Clause 10 also wants tests executed. Proof generates inputs. It does not run them. Keep go test.

ISO 21448 (SOTIF) is triggering conditions and foreseeable misuse. Proof does not ship a SOTIF monitor. That is a different standard. IEC 62304 is medical software; it stays a mention on the DO-178C URL until it earns its own artefact page.

Jama still authors. The four jobs still live on that URL. The NASA SRS still lives on NPR 7150.2D. The hazard worksheet still lives on hazard analysis to code.

Request demo How the install is bought

04 · Nearby questions

What people type next.

I need DO-178C style verification but I'm not in aerospace. What can I use? The four jobs, not the Type Certificate. DO-178C-style.

What is ISO 21448 / SOTIF? Triggering conditions. Proof does not monitor those. Keep the SOTIF analysis. This page is Part 6 software.

What is IEC 62304? Medical software. Same SDD template, different regulator. That cluster stays on the DO-178C URL, not here.

How do I do hazard analysis for a software component and tie it to the code? Catalog class on the requirement. medini still authors the worksheet. Hazard analysis.

What is a requirements traceability matrix, and how do I keep it true? Part 6 wants the links re-derived, not pasted. RTM.