Technical Reference

OSCAR Engine — Technical Specification

Complete technical reference for the OSCAR compliance engine covering inference architecture, parser support, deployment options, security controls, and integration specifications.

Standards coverage

Standards and domains

Extending OSCAR to a new standard means loading a verified ontology. The engine stays the same.

Domain Status Supported Frameworks Deployment
Automotive Live Automotive SPICE 4.0 (and PAM 3.1) · ISO 26262:2018 · ISO/SAE 21434:2021 · ISO 21448:2022 (SOTIF) On-prem · VPC · SaaS
Robotics Live ISO 10218-1:2025 · ISO 10218-2:2025 · ISO 3691-4:2023
Tracking: ISO 25785-1 (in draft)		 On-prem · VPC · SaaS
Industrial Machinery Live ISO 13849-1:2023 · IEC 62061:2021 (incl. amendments) · Machinery Regulation (EU) 2023/1230
Next: ISO 12100		 On-prem · VPC · SaaS
Railway Autonomy Live EN 50716:2023 · EN 50128:2011+A2:2020 (previous edition, still in use) On-prem · VPC · SaaS
Defence On request DEF STAN 00-055 · DEF STAN 00-056 On request
Aerospace Planned DO-178C · DO-254 · ARP4754B · EASA CS-25 SaaS
Industrial Planned IEC 61508 SaaS
Processing pipeline

How OSCAR processes your artifacts

Six stages from your files to an audit-ready report. Each stage is isolated, and every output links back to its source.

STAGE 01 Artifact Ingestion SysML · ReqIF · EA XMI PDF · DOCX · XLS · PNG Isolated tenant · AES-256 STAGE 02 Parse & Normalize Apache Tika · OCR pipeline Format-agnostic normalizer Structured JSON output STAGE 03 · CORE Embed & Chunk Domain-trained encoders Vectorized clause context 32K token window STAGE 04 · CORE RAG Retrieval Single-tenant vector DB Practitioner-tuned retriever Source-linked evidence KNOWLEDGE BASE Standard Ontologies ASPICE PAM 3.1 ISO 26262:2018 ISO 21434 · ISO 21448 Verified by domain experts STAGE 05 Cross-checked Scoring Clause-level gap mapping ASPICE capability levels ISO 26262 ASIL logic STAGE 06 · OUTPUT Report & Evidence Pack PDF audit-ready report JSON export Traceable remediation log
Core Engine

Inference & Retrieval Architecture

OSCAR ENGINE — INFERENCE SPECIFICATION
INFERENCE ENGINE
Fine-tuned transformer stack · trained on automotive safety corpora and OEM audit resolutions
RETRIEVAL METHOD
Dense vector search · cosine similarity · k=12 top-k retrieval · pgvector / Weaviate
KNOWLEDGE BASE
Automotive SPICE 4.0 and PAM 3.1 · ISO 26262:2018 (all 12 parts) · ISO/SAE 21434:2021 · ISO 21448:2022 (SOTIF) · ISO 10218-1/-2:2025 · ISO 3691-4:2023 · ISO 13849-1:2023 · IEC 62061:2021 · EN 50716:2023
CONTEXT WINDOW
32,000 tokens per assessment session · stateless between sessions
ASSESSMENT LATENCY
<10 min for full artifact set · benchmarked at 50+ documents per session
VERDICT CONTROL
Every finding anchored to a retrieved standard clause and a source page · Thorough mode: two models check each requirement, verdicts reconciled
KNOWLEDGE UPDATES
Standard ontologies updated per official release · versioned and auditable
Document Handling

Parser & Format Support

PARSER SUPPORT MATRIX
PARSER SUPPORT
Sphinx-Needs (needs.json) · SysML · ReqIF · EA XMI · PDF (native + OCR) · DOCX · XLS/XLSX · PNG · JPG · GIF
OCR ENGINE
Tesseract OCR with domain-specific preprocessing for engineering diagrams and tables
FILE SIZE LIMIT
200 MB per file · multiple files per session · within session token budget
NORMALISATION
Apache Tika + custom SysML extractor → format-agnostic structured JSON representation
PREPROCESSING
Zero manual reformatting required · no templates · no workflow change for engineering teams
Output

Report & Integration Formats

OUTPUT SPECIFICATION
OUTPUT FORMATS
JSON (machine-readable) · PDF report · Jira issue export · Sphinx-Needs write-back (findings as linked needs)
REPORT CONTENTS
Executive summary · clause-level findings · ASIL/capability ratings · remediation guidance
DELTA TRACKING
Version-aware comparison between consecutive assessment runs with full traceability
EVIDENCE PACK
Auditor-ready bundle: report PDF + JSON + per-requirement rationale + source artifact links
TRACEABILITY
Every finding linked to specific clause, artifact node, and version that triggered the gap
Deployment

Infrastructure & Hosting Options

DEPLOYMENT OPTIONS
DEPLOYMENT OPTIONS
Air-gapped on-prem · Private VPC (AWS / Azure / GCP) · SaaS single-tenant
ON-PREM DELIVERY
Secure offline installer · model weights on encrypted media · zero outbound calls during inference
VPC REGIONS
EU-only · Frankfurt (AWS eu-central-1) · Amsterdam (Azure West Europe)
SAAS ISOLATION
Single-tenant · dedicated vector namespace · no shared compute during assessment
AIR-GAP SUPPORT
Full inference with no external network calls · suitable for classified defence environments
Security

Encryption, Authentication & Compliance

SECURITY & COMPLIANCE SPECIFICATION
ENCRYPTION AT REST
AES-256
ENCRYPTION IN TRANSIT
TLS 1.3 minimum
AUTHENTICATION
SAML 2.0 · OIDC · SSO · RBAC per tenant
DATA RESIDENCY
EU-only · GDPR Article 28 compliant · zero cross-tenant data access
ARTIFACT RETENTION
Deleted post-session (SaaS) · customer-controlled (on-prem / VPC)
MODEL TRAINING POLICY
Zero model training or fine-tuning on customer artifacts — contractually enforced
ACCESS CONTROL
RBAC · per-project scoping · immutable audit log
CERTIFICATIONS
GDPR Art.28 DPA included · ISO 27001 path in progress · TÜV tool qualification in progress
SOC 2 Status
Type II audit path in progress
GDPR
Art.28 DPA · EU-only residency
TÜV Qualification
Safety tool qualification in progress
ISO 27001
Certification path in progress

Questions about the specification or want to validate deployment requirements?

Contact Engineering Team →