{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__engineering_design","opaque_id":"computability_boundary_mapping__engineering_design__B","search_lanes":{"direct_problem":{"queries":["controller safety verification undecidable reachability arbitrary programs halting problem","formal verification timeout unknown must not mean safe controller model checking","finite-state controller model checking safety exact decidable fragment abstraction unknown","universal verification executable systems behavioral property undecidable"],"source_ids":["S1","S2","S3"],"no_result_note":null},"closest_prior_art":{"queries":["software verification tool result UNKNOWN timeout official documentation CBMC CPAchecker","SV-COMP verification result unknown timeout specification official","\"decidable fragment\" \"unknown\" model checking verification safety","formal verification router exact bounded abstraction unknown safety assurance"],"source_ids":["S2","S3","S4","S5"],"no_result_note":null},"historical_terminology":{"queries":["Turing 1936 on computable numbers decision problem PDF official archive","Rice 1953 classes recursively enumerable sets decision problems PDF","historical \"decision problem\" program verification undecidable exact algorithm always terminates","Floyd 1967 assigning meanings to programs verification undecidable procedure"],"source_ids":["S2","S4","S5"],"no_result_note":"Historical searching located the older vocabulary of decision procedures, exhaustive verification, semi-decision procedures, and conditional model checking; no retained historical source described the complete proposed organizational package."},"products_practices_standards":{"queries":["site:spinroot.com SPIN model checker finite state verification limitations exhaustive","site:uppaal.org documentation model checker restrictions decidable termination","site:mathworks.com/help/sldv analysis result undecided timeout proof objective Simulink Design Verifier","site:nasa.gov formal methods handbook inconclusive verification result safety model assumptions review"],"source_ids":["S3","S4","S5","S6","S7"],"no_result_note":null},"non_english_regional":{"queries":["Unentscheidbarkeit Verifikation Steuerungssysteme Modellprüfung endliche Zustände unbekannt Zeitüberschreitung","vérification formelle systèmes de contrôle indécidable abstraction état fini résultat inconnu","モデル検査 制御システム 検証 決定不能 有限状態 不明 タイムアウト","verificación formal controladores indecidible estados finitos resultado desconocido"],"source_ids":["S8"],"no_result_note":"Japanese research supplied a regional engineering analogue and an important model-versus-plant limitation; German, French, and Spanish searches did not yield a stronger retained direct source within the eight-source bound."},"composition_subproblems":{"queries":["verification \"UNKNOWN\" timeout finite-state abstraction bounded model checking assurance case","mechanically enforce verification fragment proof certificate timeout unknown controller","IEC 61508 formal methods independent assessment safety authority verification official","formal verification router exact bounded abstraction unknown safety assurance"],"source_ids":["S2","S3","S4","S5","S6","S7"],"no_result_note":null}},"sources":[{"source_id":"S1","title":"The Reachability Problem for Neural-Network Control Systems","url":"https://link.springer.com/chapter/10.1007/978-3-031-73741-1_27","publisher":"Springer Nature, Lecture Notes in Computer Science","date_or_year":"2024","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Safety failure for a controller-plus-plant system can be formulated as reachability of a bad state.","Reachability is undecidable even for a trivial plant and a restricted recurrently applied ReLU controller.","The proof reduces halting of a two-counter machine to controller reachability.","For specified automata-definable plant classes, reachability is semi-decidable rather than fully decidable."]},{"source_id":"S2","title":"Conditional Model Checking","url":"https://arxiv.org/abs/1109.6926","publisher":"University of Passau / arXiv","date_or_year":"2011 preprint; CAV 2012 publication","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Software model checking has satisfied, violated, and failure outcomes because the unrestricted problem is undecidable.","Failure commonly appears as timeout, memory exhaustion, or an analysis component giving up.","A verifier can return a condition summarizing the verified portion instead of discarding work or presenting a binary result.","Unverified portions can be routed to different tools or configurations, including bounded searches, and conditions can support later rechecking."]},{"source_id":"S3","title":"Analyze and Resolve Undecided Objective Statuses","url":"https://www.mathworks.com/help/sldv/ug/address-undecided-objectives-after-simulink-design-verifier-analysis.html","publisher":"MathWorks","date_or_year":"Current documentation, accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A production engineering-design verifier explicitly reports Undecided when analysis times out or is aborted.","Unsupported blocks, nonlinear arithmetic, runtime errors, and approximations receive differentiated undecided statuses.","Approximation-affected test cases or counterexamples are not promoted to conclusive proof outcomes.","For critical properties, an undecided result means unproven safety and possible regulatory issues."]},{"source_id":"S4","title":"SPIN Verifier's Roadmap: Building and Verifying Spin Models","url":"https://spinroot.com/spin/Man/4_SpinVerification.html","publisher":"Spinroot / SPIN project","date_or_year":"2014","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["SPIN accepts a declared Promela model and specified assertions or temporal properties.","Fully exhaustive verification is distinguished from bitstate and other resource-constrained searches.","Bitstate search is presented as a last-resort or prescan when exhaustive verification is infeasible.","A search-depth limit can make verification incomplete, and the documentation explicitly states when guarantees are absent."]},{"source_id":"S5","title":"CBMC: The C Bounded Model Checker","url":"https://arxiv.org/abs/2302.02384","publisher":"Springer chapter preprint / arXiv","date_or_year":"2023","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["CBMC proves safety only under a declared bound unless a complete unwinding bound is established.","Bounded model checking is a semi-decision procedure; completeness is available when all reachable states have a finite bound.","A satisfiable formula supplies a concrete violation trace, while unsatisfiability excludes violations only within the unwinding bounds.","CBMC is a mature, widely used implementation of guarantee-bounded verification."]},{"source_id":"S6","title":"NASA Systems Engineering Handbook, Section 5.0: Product Realization","url":"https://www.nasa.gov/reference/5-0-product-realization/","publisher":"National Aeronautics and Space Administration","date_or_year":"2024 web edition, accessed 2026-08-04","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Engineering verification results, assumptions, decisions, anomalies, corrective actions, tool versions, and requirement versions should be recorded.","Peer-review reports and rationale are verification work products.","Changes and nonconformances can trigger reverification.","Material Review Boards or Configuration Control Boards may be required to approve relevant deviations, providing identifiable authorization structures.","Verification of a formal requirement is distinct from validation that the product meets stakeholder needs in its intended environment."]},{"source_id":"S7","title":"Software Assurance Approaches, Considerations, and Limitations, DOT/FAA/TC-15/57","url":"https://www.faa.gov/sites/faa.gov/files/aircraft/air_cert/design_approvals/air_software/TC-15-57.pdf","publisher":"U.S. Federal Aviation Administration","date_or_year":"2016","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["DO-178C and DO-333 permit formal verification to receive certification credit under controlled conditions.","Formal verification requires explicit assumptions about runtime environments and input ranges plus coverage, inspection, and traceability evidence.","Abstractions and assumptions can produce misleading or erroneous results and therefore must be documented, validated, and justified.","Requirements or model changes lead to rerunning verification.","The report identifies regulated aerospace organizations and certification processes as concrete adopters and authorizers."]},{"source_id":"S8","title":"時間/機能制約による仕様に対する実行可能なUML/SysMLモデルの動的検査手法 (Dynamic Inspection of Executable UML/SysML Models Against Time/Functional Constraints)","url":"https://www.jstage.jst.go.jp/article/jssst/27/2/27_2_2_33/_article/-char/ja/","publisher":"Japan Society for Software Science and Technology via J-STAGE","date_or_year":"2010","source_type":"PRIMARY_RESEARCH","language":"Japanese","claims_supported":["Executable UML/SysML engineering models can be checked against time and functional constraints using execution traces.","For embedded and real-time systems coupling discrete control behavior with continuous mechanical or electrical behavior, static formal verification of the controller model alone is insufficient.","Dynamic inspection remains necessary, supporting the boundary between formal-model correctness and real-system assurance."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The computability core is well supported: a controller-reachability class can encode an undecidable machine problem, unrestricted software model checking can fail or diverge, and real tools distinguish timeout, unsupported constructs, approximation, and bounded coverage from proof. FAA guidance also confirms that abstractions and assumptions can make formal results misleading. However, no retained source documents the hypothesized organizational behavior of promising a verifier for every executable controller and every behavioral requirement or actually collapsing timeout/unsupported cases into PASS or FAIL. Current MathWorks documentation is counterevidence to universality and binary collapse because it uses explicit undecided statuses.","source_ids":["S1","S2","S3","S7"],"uncertainty":"The unrestricted input language, property semantics, and verdict handling of any target organization were not observed. The impossibility result applies to the executable formal model, not directly to all physical-plant safety questions."},"adopter_evidence":{"status":"PARTLY_SUPPORTED","finding":"Identifiable adopter classes and authorizers exist: verification engineers and safety assessors in regulated controller-development settings, NASA Material Review or Configuration Control Boards for relevant deviations, and aviation certification processes operating under DO-178C/DO-333. The sources also report industrial formal-verification use at aerospace firms. No specific organization was identified as currently needing or agreeing to adopt the proposed router and computability-boundary record.","source_ids":["S6","S7"],"uncertainty":"Authority titles and approval routes vary by sector and organization; the proposed generic 'accountable engineering safety authority' must be mapped to an actual owner before a pilot."},"implementation_evidence":{"status":"SUPPORTED","finding":"All load-bearing technical behaviors are demonstrably implementable in adjacent systems: exhaustive finite-state checking, bounded proof and counterexample generation, sound or conditional partial results, explicit undecided labels for timeout and unsupported inputs, routing remaining state space to other methods, and versioned assurance records with recheck triggers. What is not directly demonstrated is the exact integrated organizational workflow combining a checked impossibility reduction, mechanically enforced admission grammar, guarantee router, independent proof review, and safety-authority decision record.","source_ids":["S2","S3","S4","S5","S6","S7"],"uncertainty":"Integration costs, false-SAFE behavior of a new router, admission-check robustness, and operational usefulness at the expected UNKNOWN rate remain empirical."},"prior_art":{"disposition":"ESTABLISHED_PRACTICE","closest_analogues":[{"name":"Conditional model checking","source_ids":["S2"],"same_problem":true,"same_causal_lever":false,"overlap":"Treats unrestricted software model checking as undecidable, recognizes timeout/resource failure as a third outcome, returns a condition describing verified coverage, and routes unverified portions to other tools or later runs.","remaining_difference":"It does not require a syntactically enforced decidable controller fragment, a domain-specific impossibility certificate, or safety-authority approval of guarantee labels."},{"name":"Simulink Design Verifier undecided-status workflow","source_ids":["S3"],"same_problem":true,"same_causal_lever":true,"overlap":"A routinely available engineering product distinguishes proved, falsified, and multiple undecided outcomes caused by timeout, unsupported constructs, nonlinearities, runtime errors, and approximations; it explicitly treats critical undecided objectives as unproven safety.","remaining_difference":"The documentation does not expose an organization-wide exact/sound/bounded/escalated router or require a checked halting reduction and versioned computability decision record."},{"name":"SPIN exhaustive/bitstate modes and CBMC bounded model checking","source_ids":["S4","S5"],"same_problem":true,"same_causal_lever":true,"overlap":"These mature tools separate exhaustive or complete checks from incomplete, resource-bounded, probabilistic-coverage, or bounded-trace analyses and attach counterexamples and scope-dependent guarantees.","remaining_difference":"The user must configure and interpret modes; the sources do not show a mandatory cross-tool admission boundary preventing an incomplete success label from authorizing certification."},{"name":"NASA/FAA assurance governance for formal methods","source_ids":["S6","S7"],"same_problem":false,"same_causal_lever":false,"overlap":"Official guidance already requires assumptions, versions, traceability, anomalies, review evidence, approval structures, and reverification after change, and warns that formal verification can validate the wrong abstraction or assumption.","remaining_difference":"The guidance is broader than computability and does not prescribe the proposed decidability lattice, impossibility proof, or router implementation."}],"contrastive_claim_remaining":"A credible but narrow incremental claim remains: in one organization whose current tools leave timeout and scope interpretation to projects, a mechanically enforced admission grammar plus a single guarantee-labelled router and approved boundary record will reduce ambiguous or overstated verdicts without producing false SAFE results, compared with existing per-tool handling.","contrastive_claim_falsifier":"The claim is falsified if an inventory shows existing tools and release controls already enforce equivalent proof-scope labels and routing, or if the archived pilot produces any false SAFE, permits admission-boundary bypass, fails independent certificate checking, does not reduce ambiguous verdicts, or yields an operationally unusable UNKNOWN rate.","confidence":"MODERATE","search_limitations":"The eight-source bound required treating a composition of product documentation, research, and official guidance as prior art. Full paid IEC/ISO standards and the full DO-333 text were not retained; patents and proprietary verifier procedures were not searched. Regional searching covered Japanese, German, French, and Spanish terminology but retained only one Japanese source. No search can establish world novelty, patentability, freedom to operate, market size, routine compliance across all industries, or realized impact."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Primary research establishes undecidable controller reachability and model-checking failure modes, while product and official sources establish bounded, unsupported, approximation, and misleading-result risks. The particular alleged binary collapse remains a hypothesis, but the underlying problem mechanism is externally supported and testable through an input/verdict inventory.","source_ids":["S1","S2","S3","S7"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"The adopter class is verification and safety-assurance teams in controller-development organizations; NASA review/configuration boards and aviation certification structures show identifiable authorization roles. A pilot must name the actual accountable individual or board before execution.","source_ids":["S6","S7"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although honest UNKNOWN, bounded guarantees, conditional coverage, and assurance records are established practices, the incremental organization-level claim about mandatory admission enforcement and cross-tool guarantee routing can be compared against current project-specific interpretation using measurable false-SAFE, ambiguity, bypass, and UNKNOWN-rate outcomes.","source_ids":["S2","S3","S4","S5","S6"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A read-only pilot on 20 finite-state and 20 unrestricted archived models is bounded. It can use exhaustive or bounded benchmarks, seeded unsupported cases, label-confusion tests, independent review, and predeclared acceptance thresholds without affecting production certification.","source_ids":["S3","S4","S5","S6"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The proposed first step excludes automatic certification and forbids treating UNKNOWN as SAFE. Official guidance supports review, traceability, approval, discrepancy handling, and reverification. The pilot should halt on any false SAFE, scope bypass, or overstated label, while retaining manual review as rollback.","source_ids":["S3","S6","S7","S8"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six adversarial lanes were searched. Exactly eight direct sources were retained and opened, spanning seven publisher or institutional contexts, with primary research, two first-party tool sources, and two official guidance sources. The search found strong prior art rather than relying on phrase misses.","source_ids":["S1","S2","S3","S4","S5","S6","S7","S8"]}},"strict_success":false,"screen_survival":false,"remaining_research_value":"MODERATE","recommended_next_step":"First inventory the organization's deployed model/property grammars, verifier exit states, wrapper logic, timeout handling, and certification gates. If equivalent enforced labels are absent, pre-register and run the 40-model archived pilot: mechanically classify fragment membership; compare exhaustive finite-state ground truth with exact, bounded, abstraction, and UNKNOWN routes; inject timeout, unsupported-language, and boundary-bypass cases; have an independent reviewer check the reduction and totality certificates; measure false SAFE, ambiguous-verdict rate, routing agreement, runtime, and UNKNOWN volume. Obtain the named safety authority's approval of labels and halt criteria before running it.","world_novelty_boundary":"This bounded public-web review supports the computability problem and finds the major intervention elements already established across research, engineering products, and assurance guidance. It does not establish that the exact integrated governance package is used in every organization, nor does it establish world novelty, patentability, freedom to operate, market size, or realized safety impact."}