{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__engineering_design","opaque_id":"computability_boundary_mapping__engineering_design__A","search_lanes":{"direct_problem":{"queries":["hybrid systems reachability undecidable decidable subclasses exact verification primary paper","hybrid automata safety verification undecidable arbitrary programs reachability theorem","formal verification timeout unknown must not mean safe safety engineering guidance","hybrid systems model checker safety unsafe unknown exact overapproximation underapproximation tool"],"source_ids":["SRC1","SRC2","SRC5","SRC8"],"no_result_note":null},"closest_prior_art":{"queries":["conditional model checking timeout condition verified state space","model checker three valued result true false unknown partial verification tool manual","software model checking sound incomplete analyzer unknown result first party documentation","NNV exact over-approximate reachability safe unsafe uncertain unknown"],"source_ids":["SRC2","SRC4","SRC5","SRC8"],"no_result_note":null},"historical_terminology":{"queries":["What's decidable about hybrid automata initialized rectangular automata reachability","model checking partial state spaces 3-valued temporal logic unknown","HyTech PHAVer hybrid verification termination undecidable reachability","conditional model checking space-out time-out verification condition"],"source_ids":["SRC1","SRC2","SRC5"],"no_result_note":null},"products_practices_standards":{"queries":["SMT-LIB standard unknown reason-unknown timeout","CPAchecker verification verdict TRUE FALSE UNKNOWN resource limits configuration","NIST sound static analysis assumptions publicly reported completeness","EASA DO-254 tool output independently assessed tool revision limitations"],"source_ids":["SRC3","SRC4","SRC6","SRC7","SRC8"],"no_result_note":null},"non_english_regional":{"queries":["Unentscheidbarkeit Erreichbarkeit hybride Automaten Verifikation unbekannt Zeitüberschreitung","indécidabilité atteignabilité automates hybrides vérification résultat inconnu","到達可能性 ハイブリッドオートマトン 決定不能 検証 unknown","verificación sistemas híbridos alcanzabilidad indecidible resultado desconocido"],"source_ids":["SRC1","SRC7"],"no_result_note":"Multilingual searches found the same classical decidability boundary and tool concepts; no distinct closer non-English implementation package was retained. The EASA source supplies regional European certification practice."},"composition_subproblems":{"queries":["formal verification scope assumptions versioned model proof certificate unknown timeout escalation safety case","reachability analyzer decidable fragment membership unsupported language feature unknown verdict","bounded model checking timeout unknown counterexample witness certification proof checking","hybrid systems model checker safety unsafe unknown exact overapproximation underapproximation tool"],"source_ids":["SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"What's decidable about hybrid automata?","url":"https://research-explorer.ista.ac.at/record/4492","publisher":"Elsevier, via ISTA Research Explorer","date_or_year":"1998","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Hybrid-system verification tasks can be formulated as reachability problems.","Reachability is decidable with a terminating symbolic procedure for initialized rectangular automata.","Slight generalizations are undecidable, including timed automata with one stopwatch.","A model-relative decidability boundary and decidable-subclass map are established prior art."]},{"source_id":"SRC2","title":"Conditional Model Checking","url":"https://arxiv.org/abs/1109.6926","publisher":"arXiv, Cornell University","date_or_year":"2011","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Undecidable software model checking has satisfaction, violation, and failure outcomes.","Failure includes timeout, memory exhaustion, or a tool component giving up.","The proposed method returns a condition summarizing the verified scope instead of coercing failure into a Boolean result.","Unresolved state space can be passed to another method or tool, closely matching bounded fallback and escalation."]},{"source_id":"SRC3","title":"The SMT-LIB Standard, Version 2.5","url":"https://smt-lib.org/papers/smt-lib-reference-v2.5-r2015-05-28.pdf","publisher":"SMT-LIB Initiative","date_or_year":"2015","source_type":"OFFICIAL_STANDARD","language":"English","claims_supported":["The standardized check-sat response is sat, unsat, or unknown.","The standard provides reason-unknown metadata.","Predefined unknown reasons include memory exhaustion and incompleteness.","Unknown, unsupported, and error are operationally distinct from Boolean answers in an established solver interface."]},{"source_id":"SRC4","title":"Software Verification with CPAchecker 3.0: Tutorial and User Guide","url":"https://link.springer.com/chapter/10.1007/978-3-031-71177-0_30","publisher":"Springer Nature","date_or_year":"2024","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["CPAchecker reports TRUE only when it proves satisfaction and FALSE when it proves violation.","It reports UNKNOWN when resource limits or configuration prevent a decision.","The selected analysis configuration determines supported specifications and precision.","A deployed verification tool therefore already implements explicit abstention rather than forced Boolean classification."]},{"source_id":"SRC5","title":"How to model and prove hybrid systems with KeYmaera: a tutorial on safety","url":"https://link.springer.com/article/10.1007/s10009-015-0367-0","publisher":"Springer Nature","date_or_year":"2015","source_type":"SECONDARY_RESEARCH","language":"English","claims_supported":["Reachability is decidable for restricted real-time systems but undecidable for broader hybrid systems.","Termination is not guaranteed for automatic reachability tools on linear hybrid systems.","Bounded tools require explicit time, jump, or variable-range restrictions.","Over-approximate counterexamples may be spurious and require manual inspection; interactive proof is a fallback when automation fails."]},{"source_id":"SRC6","title":"SATE V Ockham Sound Analysis Criteria","url":"https://www.nist.gov/itl/ai/ai-standards-and-guidelines-group/sate-v-ockham-sound-analysis-criteria","publisher":"National Institute of Standards and Technology","date_or_year":"2021; updated 2026","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Soundness means every definitive finding is correct, while completeness is not required.","Uncertain claims of likely weakness or near-safety are not accepted as definitive findings.","Differences arising from models and assumptions must be publicly reported.","Manual review is used to adjudicate unexpected differences, supporting explicit assumptions and governed escalation."]},{"source_id":"SRC7","title":"Easy Access Rules for Acceptable Means of Compliance for Airworthiness of Products, Parts and Appliances (AMC-20), tool assessment clarifications","url":"https://www.easa.europa.eu/en/document-library/easy-access-rules/online-publications/easy-access-rules-acceptable-means-1?page=25","publisher":"European Union Aviation Safety Agency","date_or_year":"2023","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Safety-related tool identification includes the operating environment and tool revision.","Applicants must identify the process and purpose supported by a tool and assess its limitations.","Independent assessment must cover errors the tool could introduce or fail to detect.","Certification applicants and independent assessors are identifiable authorizer and reviewer roles."]},{"source_id":"SRC8","title":"NNV: The Neural Network Verification Tool for Deep Neural Networks and Learning-Enabled Cyber-Physical Systems","url":"https://link.springer.com/chapter/10.1007/978-3-030-53288-8_1","publisher":"Springer Nature","date_or_year":"2020","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["NNV applies exact and over-approximate reachability analysis to learning-enabled cyber-physical systems.","Exact analysis returns safe or unsafe with counterexamples, while sound over-approximation can return uncertain or unknown.","The tool attempts falsification after an uncertain result and retains unknown if no witness is found.","The adaptive-cruise-control case demonstrates bounded analysis, unsafe witnesses, model dependence, and explicit abstention in an engineering context."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The core incompatibility exists: unrestricted hybrid or program reachability crosses proven undecidability boundaries, and practical analyzers can time out, fail to terminate, lose precision, or require approximation. Established tools and standards consequently distinguish unknown from proved safe or unsafe. However, the search did not identify a specific engineering organization publicly promising a total exact Boolean decider for the stated unrestricted language or demonstrably converting every timeout into safe or unsafe.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC8"],"uncertainty":"The theoretical problem is strongly supported, but the proposal's organizational baseline is hypothetical or undisclosed. Whether deployed inputs are actually unrestricted rather than enforceably finite and bounded remains an audit question."},"adopter_evidence":{"status":"SUPPORTED","finding":"Identifiable adopter and authorizer roles exist: verification-tool developers and engineering applicants configure and use the analysis, while an accountable certification or safety authority can approve its scope. EASA guidance explicitly assigns applicants responsibility for identifying tool purpose, environment, revision, limitations, and independent assessment.","source_ids":["SRC6","SRC7"],"uncertainty":"The roles are identifiable, but no named organization, product owner, or certification program has committed to this proposal."},"implementation_evidence":{"status":"SUPPORTED","finding":"All load-bearing technical elements have demonstrated implementations or established interfaces: decidable subclass restriction, conditional scope summaries, explicit unknown and reason-unknown states, configuration-dependent verdicts, bounded and over-approximate reachability, unsafe witnesses, public assumptions, tool revision records, and independent review. The exact integrated 20-model governance pilot is not reported in the retained literature, but it is technically bounded and feasible.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"uncertainty":"Implementation feasibility is well supported; effectiveness of the proposed integrated workflow in the target organization is unmeasured, and faithful physical modeling remains a separate validation risk."},"prior_art":{"disposition":"ESTABLISHED_PRACTICE","closest_analogues":[{"name":"Hybrid-automata decidability boundary mapping","source_ids":["SRC1","SRC5"],"same_problem":true,"same_causal_lever":true,"overlap":"The literature explicitly separates decidable restricted classes from undecidable general hybrid reachability and links restrictions to terminating procedures.","remaining_difference":"The proposal packages those results into a versioned organizational guarantee record, membership gate, and certification workflow."},{"name":"Conditional model checking","source_ids":["SRC2"],"same_problem":true,"same_causal_lever":true,"overlap":"It addresses timeout or tool failure on an undecidable verification problem by returning a condition describing the verified region and transferring the remainder to another method.","remaining_difference":"It does not prescribe the proposal's engineering-specific authority roles, model-version tombstones, or archived-design pilot."},{"name":"Standard and product-level explicit unknown verdicts","source_ids":["SRC3","SRC4"],"same_problem":true,"same_causal_lever":true,"overlap":"SMT-LIB and CPAchecker operationalize non-Boolean unknown results, distinguish unsupported or error states, and expose resource or incompleteness reasons.","remaining_difference":"They provide interfaces and verdict semantics rather than a complete cyber-physical certification decision record."},{"name":"Scoped cyber-physical reachability with uncertainty and witnesses","source_ids":["SRC5","SRC8"],"same_problem":true,"same_causal_lever":true,"overlap":"Hybrid-system tools use bounded or restricted models, exact versus sound-over-approximate solvers, unsafe counterexamples, unknown results, and manual or alternate-method follow-up.","remaining_difference":"The proposal adds an explicit organization-wide scope gate and prospective comparison against a forced-Boolean baseline."},{"name":"Assumption disclosure and independent safety-tool assessment","source_ids":["SRC6","SRC7"],"same_problem":false,"same_causal_lever":true,"overlap":"Official guidance requires public model assumptions or limitations, tool and revision identification, and independent review before relying on safety-relevant outputs.","remaining_difference":"The guidance is broader than computability classification and does not itself prove a reachability boundary."}],"contrastive_claim_remaining":"The credible remaining claim is implementation-specific, not a new formal-method mechanism: for a named engineering organization, adding an enforceable fragment-membership gate, version-linked guarantee record, distinct safe/unsafe/unknown/timeout/error states, and governed escalation will reduce unsupported Boolean classifications on archived designs without suppressing unsafe witnesses found by the baseline.","contrastive_claim_falsifier":"Falsify that incremental claim if a preregistered archived-model comparison shows no reduction in unsupported Boolean verdicts, if the new workflow loses any baseline unsafe witness without explicit abstention, if fragment membership cannot be enforced, or if audit shows every accepted model is already finite, bounded, and handled by a known total algorithm. A reviewed sound, complete, terminating algorithm for the exact unrestricted representation would separately falsify the asserted computability boundary.","confidence":"HIGH","search_limitations":"The review retained exactly eight direct sources under a bounded search. It did not inspect proprietary tool contracts, internal certification records, or paywalled standards in full. Multilingual searches largely converged on the same classical results. The evidence establishes strong prior art and routine component practice, but not universal adoption of every governance element as one package."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Primary research establishes the model-relative undecidability boundary, and tool evidence establishes practical timeout, nontermination, approximation, and unknown outcomes. The particular forced-Boolean organization remains unverified but is not needed to establish the general problem.","source_ids":["SRC1","SRC2","SRC4","SRC5","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"Engineering applicants, verification-tool developers, independent assessors, and the accountable certification or safety authority are identifiable roles with documented responsibilities.","source_ids":["SRC6","SRC7"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although the mechanism is established practice, the organization-specific claim that an integrated scope gate and explicit abstention workflow reduces unsupported Boolean classifications without losing unsafe witnesses is distinct, measurable, and falsifiable.","source_ids":["SRC2","SRC3","SRC4","SRC6","SRC7","SRC8"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A read-only comparison on 20 archived models is bounded; verdict labels, termination, fragment acceptance, traces, lost witnesses, and expert adjudications can be preregistered and counted without changing certification decisions.","source_ids":["SRC4","SRC6","SRC7","SRC8"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The proposed first step is observational, prohibits autonomous approval and unknown-to-safe conversion, preserves independent review, and includes explicit halt conditions. These controls align with official sound-analysis and independent-assessment guidance.","source_ids":["SRC6","SRC7"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially, including historical, product/standard, multilingual/regional, and component-combination terminology. Eight direct sources from multiple independent publishers include primary research, an official standard, first-party tool guidance, and government or regulatory guidance.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":false,"screen_survival":false,"remaining_research_value":"MODERATE","recommended_next_step":"Reframe the work as an implementation and assurance evaluation rather than a novel computability method. Preregister the 20-model read-only pilot, first audit whether the accepted language is actually unrestricted, then compare baseline and revised verdict semantics, fragment-gate accuracy, retained unsafe witnesses, abstention rates, and reviewer decisions. Stop immediately on any false-safe result or unenforceable scope boundary.","world_novelty_boundary":"This bounded public search supports an established-practice disposition for the proposed problem-intervention package. It cannot establish world novelty, patentability, freedom to operate, market size, realized impact, or absence of undiscovered proprietary or non-indexed prior art."}