Assured Process (tm)
Safe deterministic software generation, governance, and assurance.
AssuredCode is a deterministic software generation platform that transforms formal specifications into production-ready software artifacts with full traceability, auditability, and governance. AssuredCode extends deterministic code generation beyond conventional build-time static generation by treating qualified implementation families as an executable generation space. AssuredCode-C applies this approach to constrained low-level C environments and can support both build-time generation and governed programmatic generation in operational systems.
Safety
Three different timescales of assurance:
Design time:
Template qualification, combinatorial testing, simulation, formal proofs.
Generation time:
Normalization, binding, generation, compilation, structural/semantic verification, focused tests.
Deployment time:
Shadow execution, policy/HITL approval, blue-green activation, monitoring and rollback.
Figure 1 - Template Certification
Figure 1 shows the offline process for creating specification templates. Subject matter experts (SMEs) analyze the need for dynamic support witn in the specifications for the device/vehicle itself. Analysis of QA also determines which outcomes of specs formed from this template can be deduced from the outcome of others. If mathematical eliminations are found, this reduces the overall effort.
After forming a spec template candidate the process enters a simulation phase which will run many simulations on the spec template using a calculated set of values to certify. When QA certifies the spec template it can be stored in the template repository. What we are seeking and frequently can find is the capability of claiming observations during realtime have already been tested offline.
Simulation seems like a very large exhaustive run of cases. However many can be mathematically or scientifically eliminated. Case in point, an airplane with autopilot where we wish capability to change altitude, direction and velocity
Unlike probabilistic code assistants that may generate different outputs from identical inputs, AssuredCode is designed to produce the same result every time from the same approved specification. Every generation is reproducible, auditable, and suitable for environments where consistency and accountability matter.
AssuredCode moves much of software assurance ahead of operational generation by constraining and qualifying the space from which software can be produced, then adds generation-time and deployment-time verification before the artifact becomes operational. Figure 2 shows the AssuredCode deployment pipeline and Figure 3 shows the overall Assured Process:
Figure 2 - Deployment Pipeline
Figure 3 - The Overall Assured Process
Spec Template Repair
Figure 4 below shows the spec template cycle. A specification is prepared, simulation values are also specified and the simulations are run. Should a template fail it is placed on a queue for human or AI review depending on the customer preference. If it is decided to attempt repair this is done then the template is again submitted. On success it is stored in the template repository. If an error cannot be fixed the template is sent to a rejection queue.
Figure 4 - Specification Template Repair
Benchmarking
Benchmarks were performed on IBM Cloud bare metal so energy usage could be determined using RAPL. The test suite included code generation for multiple languages such as Python, C and Java - Across five runs, the AssuredCode Validation Harness completed 879 passing tests with one expected skip in a mean measured time of 34.079 seconds. Mean package energy was 6.552 kJ, with estimated incremental package energy of 1.927 kJ above idle, equivalent to approximately 2.19 J per passing test. Total-energy variation across runs was 0.71%. Code was not only generated but compiled and tested. Energy savings versus LLM code generation are significant. AssuredCode can operate well in the offloading LLM scenario where the LLM plays the role of an analyst conversing with the engineer then submitting specs to AssuredCode. See Figures 1 and 2 below.
A highly optimized version called AssuredCode-C that only generates bare metal C is benchmarking at less that 0.5 ms per generation. Work is underway to optimize the entire process for optimal autonomous support.
Key Capabilities
-
Deterministic Generation
Generate software from approved specifications with reproducible outputs. The same specification produces the same result, enabling repeatable builds, validation, and compliance workflows.
-
Specification-Driven Development
Software is generated from formal grammars and specifications rather than free-form prompts. New languages and formats can be added through grammar definitions without retraining foundation models.
-
Governance and Auditability
Every generation is accompanied by traceable artifacts including specifications, generation history, validation results, deployment receipts, and audit records.
-
Customer-Controlled Deployment
AssuredCode can operate entirely within customer-controlled environments. No generated source code must leave the customer boundary unless explicitly configured to do so.
-
Enterprise Validation
Integrated validation workflows support syntax checking, specification verification, dependency governance, and deployment approval processes. Fault injection causes proof obligations to remain undischarged. The deployment gate therefore refuses promotion, leaving the active partition unchanged.
Architecture
AssuredCode combines formal specifications, grammar-driven generation, deterministic transformation engines, and governed deployment workflows to provide a controlled alternative to traditional AI code generation.
Organizations can integrate vendor-managed knowledge sources, customer-managed repositories, or internal RAG systems to provide contextual awareness while maintaining control over data access and governance policies.
Ideal Use Cases
-
Regulated software development
-
Autonomous Military Systems
-
Financial services
-
Healthcare systems
-
Government and defense
-
Enterprise integration projects
-
Legacy modernization
-
Specification-driven development
-
Controlled code generation environments
Benefits
-
Reproducible results
-
LLM integration optional
-
Maximal Simulation Coverage
-
Reduced validation effort
-
Improved software quality
-
Full Auditability
-
Full Transparency
-
Provenance support
-
Reduced governance risk
-
Customer-controlled deployment
-
No dependence on externally generated source code
-
Mathematical Verification
-
Fallback/Failover support inherent
Usage
Figures 5 and 6 show two different usage flows. Figure 5 shows LLM integration. Here the LLM serves as an analyst/orchestrator rather than generating code itself. It can assist in evaluating the code generated by AssuredCode and as the analyst can partition larger project coding tasks into modules for AssuredCode to generate and finally render or submit to a pipeline the completed code. This has been successfully tested with AWS Kiro and the AssuredMCP server is available for this purpose.
Figure 5 - The engineer interacts with an LLM to create a spec which is submitted to AssuredCode. The code is either returned to the user or can be reviewed, tested and deployed
Figure 6 below shows a simplified variation of what AssuredCode-C offers. This can be the source of many dynamic automations where current information can be exploited to generate logic that supports behavior previously unattainable. The event handler, shown as an AWS Lambda function retrieves a spec template from the Template Repository. It populates the template then invokes AssuredCode to generate the code in the specified language. AI or human code review can follow then AssuredTest can certify the change. Finally a micro blue-green deploy can be used to deploy the artifact into whichever environment the customer desires.
Raw specification submission is possible as well but the template repository creates institutional structure that raw specification submission does not. A template can embody the organization’s approved constraints, interfaces, ranges, dependencies, security requirements, review requirements, and deployment policies. Individual generations then supply the variable bindings. In the world of automation, the company will want a direct, clear way to know what exactly is going on. Best practices will mandate the template repository or a similar solution.
Figure 6 - An event occurs and a pre-tested spec template is populated and submitted to AssuredCode. The code is generated, tested and deployed into the specified environment.