{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__engineering_design","opaque_id":"computability_boundary_mapping__engineering_design__C","search_lanes":{"direct_problem":{"queries":["universal safety verification programmable controllers undecidable reachability hybrid systems","formal verification tool inconclusive unknown timeout safety assurance evidence guidance"],"source_ids":["S1","S2","S3","S5","S7","S8"],"no_result_note":null},"closest_prior_art":{"queries":["three valued model checking unknown result partial models formal verification safety","Conditional Model Checking Beyer Henzinger Keremoglu Wendler condition output verified state space CPAchecker","decidability map verification safety critical systems decidable subclasses"],"source_ids":["S1","S2","S3","S5"],"no_result_note":null},"historical_terminology":{"queries":["What's Decidable about Hybrid Automata PDF Henzinger Kopke Puri Varaiya","Formale Verifikation von Realzeit-Systemen unentscheidbar Erreichbarkeit hybride Automaten"],"source_ids":["S1","S6"],"no_result_note":null},"products_practices_standards":{"queries":["site:faa.gov DO-333 formal methods supplement model coverage assumptions verification","UPPAAL documentation finite state bounded integer model checking official","verification witness standard unknown timeout result categories","ISO IEC formal methods verification inconclusive results safety software"],"source_ids":["S3","S4","S5","S8"],"no_result_note":null},"non_english_regional":{"queries":["Sicherheitsverifikation hybride Systeme unentscheidbar Erreichbarkeit Modellprüfung","site:inria.fr vérification sécurité systèmes hybrides indécidable atteignabilité","制御システム 安全性 検証 決定不能 到達可能性"],"source_ids":["S6"],"no_result_note":null},"composition_subproblems":{"queries":["finite state model checking decidable abstraction unknown timeout safety verification engineering","model checking abstraction sound incomplete unknown result CEGAR","formal methods safety assurance guidance inconclusive analysis unknown certification","Verisig closed-loop controller plant reachability decidable"],"source_ids":["S2","S3","S4","S5","S7","S8"],"no_result_note":null}},"sources":[{"source_id":"S1","title":"What's Decidable About Hybrid Automata","url":"https://www2.eecs.berkeley.edu/Pubs/TechRpts/1998/3418.html","publisher":"University of California, Berkeley, EECS Department","date_or_year":"1998","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Hybrid automata represent embedded control programs with digital and analog behavior.","Reachability has a formally identifiable decidability boundary: initialized rectangular automata admit a terminating procedure, while slight generalizations are undecidable.","An unrestricted impossibility claim must be tied to the exact automaton semantics and cannot be transferred automatically to bounded controller classes."]},{"source_id":"S2","title":"Conditional Model Checking","url":"https://arxiv.org/abs/1109.6926","publisher":"University of Passau / arXiv","date_or_year":"2011","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Undecidable software model checking has safe, unsafe, and failure outcomes, with failure including timeout, memory exhaustion, and analysis components giving up.","A verifier can publish a condition describing the portion of the state space successfully verified instead of discarding partial work or forcing a Boolean result.","Unverified regions can be passed to another verification method, closely matching scoped guarantees, explicit unresolved residue, and fallback analysis."]},{"source_id":"S3","title":"Software Assurance Approaches, Considerations, and Limitations","url":"https://www.faa.gov/sites/faa.gov/files/aircraft/air_cert/design_approvals/air_software/TC-15-57.pdf","publisher":"U.S. Department of Transportation, Federal Aviation Administration","date_or_year":"October 2016","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["DO-178C and DO-333 permit formal verification to support airborne-software assurance and, under controls, replace some testing evidence.","Formal verification depends on explicit environmental and parameter assumptions, coverage, traceability, inspection, and correctly formalized contracts.","Misused abstractions or assumptions can produce misleading or erroneous assurance results, so assumptions and abstractions must be documented, validated, and justified.","Aircraft developers, verification teams, applicants, and certification reviewers are identifiable adopters and authorizers."]},{"source_id":"S4","title":"UPPAAL Documentation","url":"https://docs.uppaal.org/","publisher":"UPPAAL, Aalborg University and Uppsala University","date_or_year":"accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A deployed verification product explicitly limits its applicable model class to nondeterministic processes with finite control and real-valued clocks.","Real-time controllers are a stated application area.","The product demonstrates the practical rival of restricting admission to a well-defined timed-automata class and then applying model checking."]},{"source_id":"S5","title":"Passing and Failing a Verification","url":"https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/passing-and-failing-a-verification","publisher":"Microsoft Learn","date_or_year":"2021-12-15","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Microsoft Static Driver Verifier reports pass, fail, and inconclusive rather than forcing every run into a Boolean result.","Inconclusive includes timeout, memory shortage, uncertain analysis, and internal errors; not-applicable is also distinct.","Microsoft warns that a verification result is qualified and is not a complete final evaluation, showing that explicit status separation is an implemented product practice."]},{"source_id":"S6","title":"Formale Verifikation von Realzeit-Systemen mittels Cottbus Timed Automata","url":"https://www.sosy-lab.org/research/pub/2002-Dissertation.Formale_Verifikation_von_Realzeit-Systemen_mittels_Cottbus_Timed_Automata.BTU.pdf","publisher":"Brandenburgische Technische Universität Cottbus","date_or_year":"2002","source_type":"PRIMARY_RESEARCH","language":"German","claims_supported":["German-language prior work states that reachability for general hybrid automata is undecidable.","It organizes restricted automaton classes to describe the boundary from decidable to undecidable analysis.","It documents older terminology and practice involving timed automata, finite abstractions, over-approximation, and the capacity limits of verification tools."]},{"source_id":"S7","title":"Verisig: Verifying Safety Properties of Hybrid Systems with Neural Network Controllers","url":"https://arxiv.org/abs/1811.01828","publisher":"University of Pennsylvania research team / arXiv","date_or_year":"2018","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Closed-loop controller assurance must compose the controller with the plant model; controller-only input-output verification is insufficient.","The paper explicitly asks whether the represented reachability problem is decidable and proves results for stated neural-network subclasses and assumptions.","It demonstrates a constructive restricted-class procedure and case studies rather than a universal verifier for arbitrary programmable controllers and environments."]},{"source_id":"S8","title":"Formal Verification of PLCs as a Service: A CERN-GSI Safety-Critical Case Study","url":"https://arxiv.org/abs/2502.19150","publisher":"CERN, TU Wien, and GSI research team / arXiv","date_or_year":"2025","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["A real safety-critical PLC installation at GSI used formal verification supplied by CERN, establishing identifiable engineering adopters.","The workflow identifies requirements engineers, PLC developers, independent formal-verification engineers, and regulatory authorities.","Hidden proprietary and time-dependent components complicate faithful modeling, and exact behavior is needed before claiming complete PLC verification.","The case combines simulation and formal verification and acknowledges that verifier defects prevent formal verification from guaranteeing absence of all errors."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The technical core exists: exact terminating safety verification is unavailable for sufficiently expressive hybrid or software classes, while restricted classes admit total procedures; practical tools also produce timeout, uncertain, and out-of-scope outcomes. Real controller-assurance work depends on plant composition, assumptions, abstractions, and faithful component models. However, the retained sources do not establish how often engineering interfaces actually coerce these outcomes into safe/unsafe decisions or how often teams explicitly demand one universal checker.","source_ids":["S1","S2","S3","S5","S6","S7","S8"],"uncertainty":"The general computability and qualified-result problem is well supported, but prevalence and organizational consequences of Boolean coercion remain unmeasured."},"adopter_evidence":{"status":"SUPPORTED","finding":"Identifiable adopters include aircraft software developers and certification reviewers operating under DO-178C/DO-333, real-time-controller teams using UPPAAL-class models, Microsoft driver-verification users, and the requirements, PLC-development, independent-verification, and authority roles demonstrated at CERN and GSI.","source_ids":["S3","S4","S5","S8"],"uncertainty":"The sources identify relevant organizations and roles, but do not show that any one organization has authorized the proposal's exact computability-boundary governance package."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Most mechanisms already have operational precedents: formal decidability partitions, finite or otherwise restricted model classes, scoped conditional verification, explicit inconclusive/timeout/not-applicable statuses, assumption documentation, independent verification roles, and fallback to another analysis method. Evidence was not found that these are routinely integrated into one version-linked controller-assurance record with machine-enforced admission, recheck triggers, and an accountable escalation policy.","source_ids":["S1","S2","S3","S4","S5","S6","S7","S8"],"uncertainty":"Component feasibility is strong; feasibility and benefit of the full organizational composition remain untested."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Hybrid-automata decidability boundary mapping","source_ids":["S1","S6"],"same_problem":true,"same_causal_lever":true,"overlap":"Directly partitions controller-relevant hybrid models into classes with terminating reachability procedures and classes with undecidable reachability.","remaining_difference":"It is a formal-theory result, not an assurance workflow governing admission, result statuses, fallback decisions, versioning, and certification claims."},{"name":"Conditional model checking","source_ids":["S2"],"same_problem":true,"same_causal_lever":true,"overlap":"Preserves a scoped condition describing verified behavior after timeout or failure and sends uncovered regions to other tools, closely matching honest partial results and fallback analysis.","remaining_difference":"It targets software-verifier cooperation and verification coverage, not an end-to-end controller/plant/environment computability classification with safety-authority decision records."},{"name":"Qualified formal-method assurance under DO-178C/DO-333","source_ids":["S3"],"same_problem":true,"same_causal_lever":false,"overlap":"Requires formalized properties, environmental assumptions, traceability, coverage, documented abstractions, validation, and certification oversight to prevent misleading assurance.","remaining_difference":"It governs evidence quality but does not require an explicit decidability proof, computability-status lattice, or model-relative impossibility certificate."},{"name":"Implemented multistatus verification products","source_ids":["S4","S5"],"same_problem":false,"same_causal_lever":true,"overlap":"UPPAAL declares a restricted analyzable model class, while Microsoft SDV distinguishes pass, fail, inconclusive, timeout, spaceout, uncertain, error, and not-applicable.","remaining_difference":"Neither source establishes a unified controller-safety boundary map, reviewed reduction, cross-tool fallback governance, or recheck-on-model-change record."},{"name":"CERN-GSI independent PLC verification workflow","source_ids":["S8"],"same_problem":true,"same_causal_lever":false,"overlap":"Provides real adopters, independent roles, formalized requirements, model-faithfulness work, mixed simulation/formal analysis, iterative correction, and authority-facing assurance.","remaining_difference":"It verifies a particular PLC setting and does not claim to classify computability or govern universal-checker impossibility and nontermination."}],"contrastive_claim_remaining":"For archived controller-assurance cases, adding a version-linked, model-relative computability boundary map—with enforceable admission rules and separate safe, unsafe, unknown, timeout, and out-of-scope statuses—to existing formal-method workflows will reproducibly correct at least one materially overbroad scope, status, or fallback claim without changing certifications or causing material decision delay. The novelty is the tested governance composition, not decidability theory, conditional verification, or multistatus tool output individually.","contrastive_claim_falsifier":"The incremental claim is falsified if independent reviewers cannot reproduce classifications, if the pilot produces no material correction to scope, status, assumptions, or fallback, or if existing assurance records already provide the same enforceable boundary, status separation, versioning, and escalation behavior. It is also falsified for a target domain whose faithful deployed class is already enforceably finite or otherwise decidable and served by a sound, complete, terminating verifier.","confidence":"HIGH","search_limitations":"This bounded eight-source search sampled hybrid-systems theory, software model checking, aviation assurance, first-party verification products, PLC practice, and German terminology. It did not exhaust patents, paywalled standards, proprietary certification files, internal tool configurations, or every controller formalism and jurisdiction."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Primary research proves model-relative decidability boundaries and verifier failure outcomes; official and first-party sources document abstraction and assumption hazards plus inconclusive, timeout, and out-of-scope results. The unmeasured prevalence of Boolean coercion narrows but does not eliminate the externally supported problem.","source_ids":["S1","S2","S3","S5","S6","S7"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"Aircraft assurance organizations, certification reviewers, and the named CERN-GSI requirements, PLC-development, independent-verification, and authority-facing roles are identifiable adopters or authorizers.","source_ids":["S3","S8"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Prior art covers nearly every technical component, but not the complete controller-assurance governance composition. A falsifiable incremental claim remains about whether the integrated boundary/status/version/fallback record corrects overbroad assurance claims in archived cases.","source_ids":["S1","S2","S3","S5","S8"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"The proposed four-week, 20-design offline replay is bounded, uses existing artifacts and analysis roles, changes no certification, and can measure classification reproducibility, corrected claims, disagreements, and delay.","source_ids":["S3","S8"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The offline pilot preserves existing certification and deployment controls, forbids treating unknown as safe, and includes halt conditions for unfaithful models or unsafe classifications. Existing evidence reinforces the need for documented assumptions, independent review, and authority-facing qualification; no external safety or authority prerequisite blocks the pilot.","source_ids":["S3","S5","S8"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six lanes were searched adversarially using older, product, standards, regional-language, and component-combination terminology. Exactly eight direct sources were retained and opened; they span seven publisher groupings and include multiple primary, official, and first-party sources.","source_ids":["S1","S2","S3","S4","S5","S6","S7","S8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Run the proposed offline pilot with a preregistered rubric: require two independent reviewers per archived design, record the prior and revised assurance claim, distinguish unknown from timeout and out-of-scope, measure inter-reviewer agreement and decision delay, and stop if any model omits safety-relevant behavior. Before execution, compare the proposed record directly against existing DO-333 assurance plans and conditional-verification artifacts to avoid duplicating fields already in use.","world_novelty_boundary":"This bounded search supports only an adjacent-prior-art and researchability judgment. It cannot establish world novelty, patentability, freedom to operate, market size, routine global adoption, or realized safety impact."}