{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__engineering_design","opaque_id":"computability_boundary_mapping__engineering_design__B","search_lanes":{"direct_problem":{"queries":["undecidability verification arbitrary programs safety properties halting problem model checking","model checking finite-state systems decidable infinite state undecidable official","three-valued verification true false unknown timeout safety model checker","bounded model checking unknown result completeness threshold"],"source_ids":["SRC1","SRC2","SRC3","SRC4","SRC7","SRC8"],"no_result_note":"The search established undecidability, resource failures, state explosion, and risks from assumptions or abstractions, but did not find direct public evidence that a particular engineering organization promises the stated universal verifier or routinely converts timeout/unsupported inputs into PASS or FAIL."},"closest_prior_art":{"queries":["Conditional Model Checking condition explored state space unknown","abstract interpretation sound static analysis false alarms controller verification Astrée","software verification witness correctness violation unknown official rules","decidable verification restricted program fragment"],"source_ids":["SRC2","SRC3","SRC4","SRC5","SRC6","SRC7"],"no_result_note":null},"historical_terminology":{"queries":["Entscheidungsproblem halting problem partial solutions program verification","Rice theorem semantic program properties undecidable verification","abstract interpretation sound approximation false alarms","conditional model checking partial verification timeout condition"],"source_ids":["SRC1","SRC2","SRC6"],"no_result_note":null},"products_practices_standards":{"queries":["SV-COMP UNKNOWN timeout verification witness rules","UPPAAL finite control structure statistical model checking undecidable problems","Astrée sound static analyzer synchronous control command","FAA DO-333 formal verification sound assumptions certification"],"source_ids":["SRC4","SRC5","SRC6","SRC7"],"no_result_note":null},"non_english_regional":{"queries":["Unentscheidbarkeit Programmverifikation Modellprüfung endliche Zustände unbekannt Timeout","vérification formelle indécidable programme automate fini résultat inconnu","verificación formal indecidible programas estado finito resultado desconocido","制御 システム 形式検証 決定不能 有限状態 モデル検査"],"source_ids":["SRC8"],"no_result_note":null},"composition_subproblems":{"queries":["decidable fragment unknown witness sound abstraction independent verification review","formal verification assumption register abstraction documentation recheck requirements change","model checker exact bounded statistical fallback routing controller","verification result witness timeout unknown mechanically restricted language"],"source_ids":["SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"no_result_note":"No retained source described the entire proposed governance composition—checked undecidability reduction, mechanically enforced admission grammar, four-mode guarantee router, versioned guarantee record, independent proof review, and recheck triggers—as one deployed package."}},"sources":[{"source_id":"SRC1","title":"halting problem","url":"https://xlinux.nist.gov/dads/HTML/haltingProblem.html","publisher":"National Institute of Standards and Technology, Dictionary of Algorithms and Data Structures","date_or_year":"2023","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["No algorithm can always terminate and correctly decide halting for arbitrary programs.","Many problems can be reduced to halting, while heuristic or partial solutions remain possible."]},{"source_id":"SRC2","title":"Conditional Model Checking","url":"https://arxiv.org/abs/1109.6926","publisher":"Dirk Beyer, Thomas A. Henzinger, M. Erkan Keremoglu, and Philipp Wendler","date_or_year":"2011","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Software model checking has a third outcome when the checker times out, exhausts memory, or gives up.","A verifier can return a condition summarizing verified coverage instead of discarding partial work.","Uncovered regions can be routed to another method or configuration.","The reported experiments found improved coverage and performance from conditional verification."]},{"source_id":"SRC3","title":"Decidable Verification of Uninterpreted Programs","url":"https://arxiv.org/abs/1811.00192","publisher":"Umang Mathur, P. Madhusudan, and Mahesh Viswanathan","date_or_year":"2018; revised 2020","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["The studied unrestricted automatic verification problem is undecidable in general.","A syntactically characterized coherent-program subclass admits decidable verification in PSPACE.","The restrictions are essential enough that nearby relaxations yield additional undecidability results."]},{"source_id":"SRC4","title":"SV-COMP 2019 — 8th International Competition on Software Verification: Definitions and Rules","url":"https://sv-comp.sosy-lab.org/2019/rules.php","publisher":"SV-COMP / TACAS","date_or_year":"2019","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["The authoritative competition interface distinguishes TRUE with a correctness witness, FALSE with a violation witness, and UNKNOWN.","Crash, timeout, and out-of-memory are interpreted as UNKNOWN rather than TRUE or FALSE.","Incorrect definitive verdicts receive substantially larger penalties than correct verdicts receive rewards."]},{"source_id":"SRC5","title":"UPPAAL Features","url":"https://uppaal.org/features/","publisher":"UPPAAL, Aalborg University and Uppsala University","date_or_year":"accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["UPPAAL targets real-time controllers representable with finite control structure, clocks, bounded data types, and timed automata.","Its model checker exhaustively analyzes symbolic state-space behavior for supported properties.","The product family combines symbolic model checking with simulation and statistical techniques, and describes statistical model checking as an approximation for problems that are undecidable or too complex for classical checking."]},{"source_id":"SRC6","title":"The Astrée Static Analyzer","url":"https://www.astree.ens.fr/","publisher":"École Normale Supérieure, CNRS, and INRIA Astrée project","date_or_year":"project begun 2001; accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Astrée deliberately limits its analyzed C subset, excluding dynamic allocation and recursion while covering synchronous control software.","It uses sound over-approximation so that it signals all possible target errors but can produce false alarms.","It was used to prove absence of runtime errors in Airbus A340 primary flight-control software.","Its implementation demonstrates a practical sound fallback for a bounded property and program class rather than universal exact behavioral verification."]},{"source_id":"SRC7","title":"Software Assurance Approaches, Considerations, and Limitations: Final Report (DOT/FAA/TC-15/57)","url":"https://www.faa.gov/sites/faa.gov/files/aircraft/air_cert/design_approvals/air_software/TC-15-57.pdf","publisher":"U.S. Department of Transportation, Federal Aviation Administration","date_or_year":"2016","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["DO-333 formal-analysis methods used for assurance must be sound and are evaluated relative to a model, property, and assumptions.","Some model checkers are limited to finite-state models and may not scale to significant models.","Abstractions and assumptions must be documented, validated, and justified because misuse can yield misleading or erroneous results.","Rockwell Collins, Airbus, and Dassault-Aviation provide identifiable organizational adopters in avionics assurance and certification contexts.","Inspections and traceability remain necessary to establish that formalized requirements and models represent the intended system."]},{"source_id":"SRC8","title":"形式手法とは？ (What Are Formal Methods?)","url":"https://formal.mri.co.jp/outline/index.html","publisher":"Mitsubishi Research Institute, Dependable Systems Formal Methods Practice Portal","date_or_year":"accessed 2026-08-04; page undated","source_type":"TRADE_PROFESSIONAL","language":"Japanese","claims_supported":["Japanese practice terminology describes formal methods as rigorous specification and logical verification techniques used in safety- and mission-critical systems.","The portal says model checking may fail to terminate because of state explosion and produces counterexample traces when a property violation is established.","It recommends choosing an application level and combining formal verification with testing according to scope, cost, and benefit."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The core technical problem is well supported: unrestricted behavioral verification can be undecidable, actual verification runs can time out or exhaust resources, and unsound assumptions or abstractions can create misleading safety evidence. Products and professional guidance already restrict languages, properties, or resources. However, the proposal's stronger organizational premise—that a specific organization promises universal exact termination and collapses timeout or unsupported input into PASS/FAIL—was not directly evidenced.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC7","SRC8"],"uncertainty":"The unrestricted controller-language premise must be checked against the organization's actual executable-model and property grammars. If all production inputs are effectively finite-state and covered by an existing total procedure, the issue is complexity and assurance discipline rather than computability."},"adopter_evidence":{"status":"SUPPORTED","finding":"A concrete adopter class is identifiable: avionics and other safety-critical engineering organizations using formal verification, with named examples including Rockwell Collins, Airbus, and Dassault-Aviation. The corresponding authorizers are accountable organizational safety/assurance personnel and, where certification credit is sought, the applicant's certification chain and aviation authorities applying DO-178C/DO-333 expectations.","source_ids":["SRC5","SRC6","SRC7","SRC8"],"uncertainty":"The sources identify real adopters and certification contexts, but not an organization presently exhibiting the proposal's alleged binary-timeout policy. Internal ownership of language admission and guarantee records would need confirmation."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Nearly every technical mechanism has public precedent: undecidability boundaries, decidable syntactic subclasses, conditional or partial verification, explicit UNKNOWN, witnesses, sound abstraction with false alarms, restricted controller languages, complementary simulation/statistical checking, assumption documentation, inspection, and re-verification after change. What remains unvalidated is their integration into the proposed mechanically enforced, organization-level guarantee router and whether that composition improves decisions in the stated archived-model pilot.","source_ids":["SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"uncertainty":"A domain-specific halting reduction for the organization's exact controller semantics was not found, nor was evidence that the four routing labels are mutually exclusive, enforceable, usable by assessors, or operationally superior to existing verification workflows."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Conditional model checking with coverage conditions and follow-on routing","source_ids":["SRC2"],"same_problem":true,"same_causal_lever":true,"overlap":"Directly treats undecidable software model checking, resource failure, partial verified coverage, and routing unresolved regions to other tools or configurations.","remaining_difference":"It does not establish the proposed controller-specific halting reduction, mechanically enforce a decidable admission grammar, or evaluate an organizational certification policy with versioned guarantee records."},{"name":"SV-COMP TRUE/FALSE/UNKNOWN and witness contract","source_ids":["SRC4"],"same_problem":true,"same_causal_lever":true,"overlap":"Operationally separates definitive correctness and violation verdicts from timeout, crash, out-of-memory, and undecided cases; definitive results carry independently checkable witnesses.","remaining_difference":"It is a benchmark protocol, not a controller-design assurance router tied to fragment admission, accountable authorization, assumption records, and recheck triggers."},{"name":"UPPAAL restricted controller modeling with symbolic, simulation, and statistical modes","source_ids":["SRC5"],"same_problem":true,"same_causal_lever":true,"overlap":"Uses an enforceable controller-oriented modeling formalism and complementary exhaustive, simulation, and statistical analyses, with richer features handled outside classical symbolic checking.","remaining_difference":"The retained product description does not present a single exact/sound/bounded/UNKNOWN authorization interface or a checked impossibility certificate for all rejected inputs."},{"name":"Astrée sound abstract interpretation for restricted embedded control software","source_ids":["SRC6"],"same_problem":true,"same_causal_lever":true,"overlap":"Restricts the admitted program class and uses sound over-approximation, accepting false alarms to avoid missed target errors; it has flight-control deployment evidence.","remaining_difference":"It targets absence of specified runtime errors in a restricted C class rather than arbitrary behavioral requirements, and does not supply the proposed multi-mode router or governance record."},{"name":"DO-333-oriented formal-assurance practice","source_ids":["SRC7"],"same_problem":true,"same_causal_lever":false,"overlap":"Requires soundness relative to models, properties, and assumptions; calls for documented and validated abstractions, inspection, traceability, and re-verification in certification-relevant workflows.","remaining_difference":"It supplies assurance constraints and authority context but not the proposed computability-boundary decision procedure or routing implementation."},{"name":"Decidable coherent-program verification","source_ids":["SRC3"],"same_problem":true,"same_causal_lever":true,"overlap":"Proves general undecidability and recovers a terminating decision procedure through a recognizable restricted subclass.","remaining_difference":"The subclass and property language differ from executable controllers, and the work does not address organization-level verdict labels, authorization, or fallback routing."}],"contrastive_claim_remaining":"For a safety-critical engineering organization whose current model/property interface is demonstrably more expressive than its exact verifier can decide, a mechanically enforced admission checker plus an authorized four-mode router—EXACT, sound over-approximation, bounded witness search, and explicit UNKNOWN—linked to versioned assumptions and independently reviewed evidence will reduce ambiguous or overstated verdicts on archived controller cases without producing any false SAFE result, compared with that organization's existing timeout-based workflow.","contrastive_claim_falsifier":"The claim is falsified if the inventory shows that all admitted production inputs already lie in a covered decidable class; if an existing deployed workflow already provides the same enforced admission, guarantee-labeled routing, independent evidence checks, and change-triggered records; or if the pilot produces a false SAFE, permits admission bypass, overstates a guarantee, or fails to reduce ambiguous verdicts.","confidence":"HIGH","search_limitations":"The bounded search used eight opened sources across theory, primary research, competition practice, products, official aviation guidance, and Japanese terminology. It did not inspect proprietary organizational procedures, paywalled standards text, patents, source code, or every verification product. Similar component names and direct-phrase misses cannot establish novelty."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Undecidability, timeout/resource failure, state explosion, abstraction risk, and the need to delimit assumptions are externally supported. The unevidenced binary-collapse allegation is a testable local premise rather than a reason the core problem fails.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC7","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"Safety-critical engineering organizations and certification-facing assurance teams are identifiable adopters; the FAA report names Rockwell Collins, Airbus, and Dassault-Aviation and describes formal verification used for certification credit.","source_ids":["SRC6","SRC7","SRC8"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although the mechanisms have close precedents, a narrower organizational claim remains testable: whether an enforced admission boundary and guarantee-labeled router with reviewed, versioned evidence reduces ambiguous or overstated archived-case verdicts without false SAFE outcomes.","source_ids":["SRC2","SRC4","SRC5","SRC6","SRC7"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"The proposed non-production comparison of 20 finite-state and 20 unrestricted archived cases is bounded. Exhaustive bounded reference results, membership-bypass tests, label audits, and independent review provide measurable acceptance criteria.","source_ids":["SRC2","SRC3","SRC4","SRC7"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The first step is confined to archived non-production models and explicitly excludes automatic certification and treating UNKNOWN as SAFE. Soundness, assumptions, traceability, inspection, and withdrawal on an overstated result align with the external assurance concerns.","source_ids":["SRC4","SRC7"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially, including historical terminology, products and standards, Japanese regional terminology, and component combinations. Exactly eight retained sources were opened; they span seven publisher groupings and include multiple primary, official, and first-party sources.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Before building the router, inventory the organization's actual controller and property grammars and formally test whether unrestricted computation is genuinely admitted. If it is, specify the exact fragment-membership predicate and verdict semantics, independently check a controller-specific reduction and the admitted-fragment checker, then run the authorized 40-case archived pilot against the current workflow. Record false SAFE count, admission bypasses, ambiguous verdict count, UNKNOWN rate, review effort, and every assumption or label mismatch; stop and withdraw the affected guarantee on the first false SAFE or overstated label.","world_novelty_boundary":"This search supports only a bounded finding of adjacent prior art and a remaining organization-level empirical claim. It does not establish world novelty, patentability, freedom to operate, market size, routine adoption outside the sampled sources, or realized safety impact."}