{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"computability_boundary_mapping__engineering_design","opaque_id":"computability_boundary_mapping__engineering_design__C","search_lanes":{"direct_problem":{"queries":["universal controller safety verification undecidable programmable controllers hybrid systems","controller verification unknown timeout safety unsafe formal methods","SMT-LIB standard unknown check-sat timeout"],"source_ids":["SRC1","SRC2","SRC4"],"no_result_note":"The unrestricted verification boundary is directly supported, but no retained source documents an engineering team explicitly demanding one universal checker and coercing every unknown or timeout into a Boolean certification decision."},"closest_prior_art":{"queries":["formal verification undecidability sound incomplete analysis unknown abstract interpretation widening termination safety controllers","Cousot abstract interpretation undecidable program properties sound approximation termination widening","bounded model checking controller software CBMC loop unwinding safety official documentation"],"source_ids":["SRC1","SRC3","SRC5"],"no_result_note":null},"historical_terminology":{"queries":["algorithmic unsolvability automatic program verification safety property Rice theorem controller","A Survey of Computational Complexity Results in Systems and Control undecidable stability","Formale Verifikation Realzeit-Systeme Unentscheidbarkeit hybride Systeme"],"source_ids":["SRC2","SRC3","SRC8"],"no_result_note":null},"products_practices_standards":{"queries":["SMT-LIB standard unknown check-sat timeout","bounded model checking controller software CBMC loop unwinding safety official documentation","FAA formal methods DO-333 certification assumptions verification","HSE programmable electronic systems safety assurance formal methods verification guidance"],"source_ids":["SRC4","SRC5","SRC6","SRC7"],"no_result_note":null},"non_english_regional":{"queries":["Unentscheidbarkeit Verifikation hybrider Systeme Steuerungen Reichweite Sicherheit","indécidabilité vérification systèmes hybrides sûreté contrôleur automate","unentscheidbar hybride Systeme Verifikation","indécidable systèmes hybrides vérification sécurité"],"source_ids":["SRC8"],"no_result_note":"French and German searches corroborated the established regional terminology; the retained German dissertation was the strongest direct non-English source because it states explicit decidability conditions and reductions."},"composition_subproblems":{"queries":["hybrid automata decidability boundary restricted subclasses reachability algorithm","sound incomplete safety analysis bounded model checking unknown result","controller verification assumption register scope certification authority fallback","finite state controller model checking exhaustive verification state explosion"],"source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"What's Decidable About Hybrid Automata","url":"https://www2.eecs.berkeley.edu/Pubs/TechRpts/1998/3418.html","publisher":"University of California, Berkeley EECS","date_or_year":"1998","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Hybrid automata model embedded control programs with digital and analog components.","Reachability is decidable with a terminating PSPACE procedure for an explicitly restricted initialized-rectangular class.","Small changes in admitted semantics, including a stopwatch extension, cross into undecidability.","A model-relative partition between decidable and undecidable controller-relevant classes is established prior art."]},{"source_id":"SRC2","title":"The Stability of Saturated Linear Dynamical Systems Is Undecidable","url":"https://web.mit.edu/~jnt/www/Papers/J085-01-vb-satur.pdf","publisher":"Journal of Computer and System Sciences; author copy hosted by MIT","date_or_year":"2001","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Global convergence and global asymptotic stability are undecidable for specified saturated-linear and continuous piecewise-affine dynamical-system classes.","The impossibility result is established by a constructive simulation and reduction from an undecidable machine problem.","The authors explicitly conclude that decision algorithms can handle only special classes and identify both decidable and unsettled subclasses.","Undecidability applies to some simple control-relevant dynamical models, not merely arbitrary source programs."]},{"source_id":"SRC3","title":"Abstract Interpretation in a Nutshell","url":"https://www.di.ens.fr/~cousot/AI/IntroAbsInt.html","publisher":"Patrick Cousot, École normale supérieure","date_or_year":"Undated; accessed 2026","source_type":"SECONDARY_RESEARCH","language":"English","claims_supported":["Automatic verification of nontrivial safety properties is incomplete for unrestricted program semantics.","Testing and bounded model checking cover only subsets or prefixes and therefore do not prove unrestricted safety.","Sound over-approximation can prove safety but may generate false alarms, requiring refinement or human assistance.","Soundness, coverage, precision, termination, and model-to-system fidelity must be stated separately."]},{"source_id":"SRC4","title":"The SMT-LIB Standard: Version 2.0","url":"https://smt-lib.org/papers/smt-lib-reference-v2.0-r10.12.21.pdf","publisher":"SMT-LIB Initiative","date_or_year":"2010","source_type":"OFFICIAL_STANDARD","language":"English","claims_supported":["A widely used solver interface treats unknown as a result distinct from sat and unsat.","The standard provides a reason-unknown mechanism, including memory exhaustion and solver incompleteness.","Proof and model-related outputs carry status-dependent preconditions, demonstrating that results cannot be interpreted independently of guarantee state."]},{"source_id":"SRC5","title":"ANSI-C Bounded Model Checker: CBMC Technical Report","url":"https://www.cprover.org/cbmc/doc/cbmc-techreport.pdf","publisher":"CPROVER project","date_or_year":"2006","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["CBMC targets embedded software and requires finite loop bounds to guarantee that all bugs are found.","For unbounded loops it is a bug-finding procedure rather than a correctness proof.","Unwinding assertions expose an insufficient bound; disabling them can produce a no-bug-found result that is not a proof.","A first-party tool already implements enforceable boundedness checks and differentiated failure behavior adjacent to the proposal."]},{"source_id":"SRC6","title":"AC 20-115D: Airborne Software Development Assurance Using EUROCAE ED-12( ) and RTCA DO-178( )","url":"https://www.faa.gov/airports/resources/advisory_circulars/index.cfm/go/document.information/documentNumber/20-115D","publisher":"U.S. Federal Aviation Administration","date_or_year":"2017","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["The FAA identifies a concrete certification and authorization context for safety-critical programmable systems.","The guidance recognizes DO-330 tool qualification, DO-331 model-based verification, and DO-333 formal methods within an assurance process.","Applicants and FAA certification or authorization functions are identifiable authorizers for assurance claims."]},{"source_id":"SRC7","title":"Control Systems: Technical Measures Document","url":"https://www.hse.gov.uk/comah/sragtech/techmeascontsyst.htm","publisher":"UK Health and Safety Executive","date_or_year":"Current guidance; accessed 2026","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Safety integrity claims are conditioned on stated operating and environmental conditions, plant interfaces, lifecycle controls, and required risk reduction.","Programmable safety systems require verification, competent personnel, documented modification controls, and demonstrations that claimed integrity has been achieved.","The guidance identifies operators, designers, competent persons, major-hazard dutyholders, and safety regulators as recognizable adopters or authorizers.","A verification classifier cannot replace lifecycle evidence, physical hazard analysis, independence, validation, or accountable engineering judgment."]},{"source_id":"SRC8","title":"Formale Verifikation von Realzeit-Systemen","url":"https://webdoc.sub.gwdg.de/ebook/dissts/Cottbus/Beyer2002.pdf","publisher":"Brandenburg University of Technology Cottbus; archived by Göttingen State and University Library","date_or_year":"2002","source_type":"PRIMARY_RESEARCH","language":"German","claims_supported":["German-language formal-verification literature explicitly distinguishes Entscheidbarkeit from Unentscheidbarkeit for real-time and hybrid systems.","The dissertation maps reachability decidability to precise restrictions on variables, rates, and stopwatch behavior.","It reports reductions from two-counter-machine halting and notes that adding one stopwatch can make reachability undecidable.","Computability-boundary mapping for hybrid models was established under older regional terminology well before the proposal."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The core technical problem is real: exact terminating verification is impossible for several unrestricted controller-relevant hybrid and dynamical classes, while restricted classes and bounded programs admit terminating procedures. Tool and interface sources also show explicit unknown, incomplete, insufficient-unwinding, and non-proof outcomes. The searched evidence does not establish the stronger operational premise that teams commonly demand one universal checker or systematically coerce those outcomes into safe or unsafe certification decisions.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5"],"uncertainty":"Actual deployed controller classes may be finite, bounded, or otherwise decidable; no computability conclusion transfers to a project without a semantics-preserving reduction or a constructive verifier for its exact representation."},"adopter_evidence":{"status":"SUPPORTED","finding":"Identifiable adopter and authorizer classes exist. Airborne-software applicants operate under FAA certification or TSO authorization, while major-hazard operators, system designers, competent verification personnel, and HSE-related regulatory functions make and review programmable-control integrity claims. These parties can authorize an offline scope-classification pilot without changing certification decisions.","source_ids":["SRC6","SRC7"],"uncertainty":"The sources identify institutional roles and regulated sectors, not a named organization that has committed to adopt this exact integrated workflow."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Every central technical ingredient has an implementable analogue: explicit model-class restrictions and reductions, sound incomplete approximation, bounded checking with unwinding assertions, a standardized unknown status, formal-method and tool-assurance processes, and lifecycle-controlled review. The evidence does not show the complete proposed version-linked lattice, admission gate, fallback record, recheck trigger, and independent computability review operating together in routine controller certification.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"uncertainty":"A pilot must still demonstrate faithful encodings, enforceable class membership, reproducible classification, acceptable review delay, and compatibility with sector-specific assurance obligations."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Decidability boundary for hybrid-automaton reachability","source_ids":["SRC1","SRC8"],"same_problem":true,"same_causal_lever":true,"overlap":"Formalizes controller-relevant hybrid models, proves terminating verification for restricted subclasses, proves undecidability beyond specified semantic boundaries, and identifies exactly which modeling features move the problem across the boundary.","remaining_difference":"It is a mathematical classification and algorithmic result, not a version-linked organizational workflow governing admission, unknown states, certification fallbacks, recheck triggers, and decision records across archived engineering designs."},{"name":"Undecidability and subclass analysis for control-relevant dynamical systems","source_ids":["SRC2"],"same_problem":true,"same_causal_lever":true,"overlap":"Uses explicit reductions to show that universal global stability decisions are impossible for specified dynamical classes and directs algorithms toward special subclasses.","remaining_difference":"It does not provide the proposal's operational status lattice, fallback governance, authority allocation, or empirical claim about preventing misreported assurance."},{"name":"Sound incomplete verification through abstract interpretation","source_ids":["SRC3"],"same_problem":false,"same_causal_lever":true,"overlap":"Separates undecidable concrete semantics from sound approximations, bounded evidence, nontermination, false alarms, and human-assisted verification.","remaining_difference":"It addresses general program verification and analysis methodology rather than an enforceable controller-and-environment class map embedded in a safety-authorized decision process."},{"name":"Bounded embedded-software verification with CBMC","source_ids":["SRC5"],"same_problem":true,"same_causal_lever":true,"overlap":"Imposes finite unwinding bounds for completeness, distinguishes bug finding from proof, and exposes insufficient unwinding rather than treating no found bug as unrestricted safety.","remaining_difference":"It is one bounded checker for software behavior, not a cross-method classifier covering plant semantics, environment quantifiers, undecidability certificates, unknown policy, and certification fallback."},{"name":"Formal-method, tool-assurance, and functional-safety governance","source_ids":["SRC6","SRC7"],"same_problem":true,"same_causal_lever":false,"overlap":"Provides identifiable authorities, controlled assurance claims, tool and formal-method recognition, lifecycle verification, competent review, and model- or condition-relative integrity obligations.","remaining_difference":"These sources do not require an explicit computability-status lattice or a reviewed impossibility proof before teams select and interpret verification automation."}],"contrastive_claim_remaining":"For archived controller-assurance decisions, adding one version-linked, independently reviewed artifact that jointly records model semantics, quantifiers, computability status, enforceable admission constraints, analyzer guarantees, unknown or timeout handling, and authorized fallback will produce reproducible classifications and correct at least one material scope, status, or fallback misstatement without materially delaying review beyond ordinary assurance practice.","contrastive_claim_falsifier":"The claim is falsified if independent reviewers cannot reproduce the classifications, any known unsafe design is classified as safe, the encoded model omits safety-relevant behavior, the artifact produces no material correction to scope, status, evidence interpretation, or fallback across the 20 archived cases, or the added process causes material review delay without compensating assurance benefit.","confidence":"HIGH","search_limitations":"The bounded search retained and opened exactly eight direct sources across six lanes. It covered controller and hybrid-system undecidability, older German terminology, sound incomplete analysis, a first-party bounded checker, an official solver-interface standard, and US and UK safety-assurance guidance. It did not exhaust patents, paywalled standards text, proprietary certification records, internal engineering reports, every controller formalism, or every non-English literature corpus."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Primary research directly proves undecidability for controller-relevant hybrid and dynamical classes and gives decidable restricted cases; standard and product sources confirm that incomplete, unknown, and bounded outcomes occur in real verification interfaces. The unverified prevalence claim is not necessary to establish the underlying researchable problem.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"FAA certification or authorization functions, airborne-software applicants, major-hazard dutyholders, accountable system designers, and competent safety-verification personnel are identifiable institutional adopters or authorizers.","source_ids":["SRC6","SRC7"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although computability boundaries, bounded checking, unknown results, and safety governance are established separately, a falsifiable incremental claim remains about whether their integration into one independently reviewed, version-linked engineering record improves classification and evidence interpretation in archived decisions.","source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6","SRC7"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A four-week offline replay of 20 archived designs is bounded, reversible, measurable, and can compare reviewer agreement, corrections, delays, and status handling without changing any certification or deployment decision.","source_ids":["SRC5","SRC6","SRC7"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The proposed first step is offline, preserves existing controls, assigns approval to accountable engineering and independent safety authorities, prohibits automatic certification and unknown-to-safe conversion, and includes explicit halt conditions. Existing guidance supports competent review and controlled verification rather than delegation of authority to the classifier.","source_ids":["SRC6","SRC7"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially. Exactly eight opened direct sources were retained, spanning seven publisher or institutional contexts and including multiple primary studies, an official standard, two official guidance sources, and a first-party product source.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"Run the authorized offline pilot on 20 archived designs. Pre-register the classification rubric and material-delay threshold; have two independent reviewers encode each controller, plant, environment, quantifier scope, and analyzer guarantee; record safe, unsafe, unknown, timeout, and out-of-scope separately; adjudicate disagreements without altering existing certifications; and test whether the integrated record produces reproducible classifications or corrects material scope and fallback errors.","world_novelty_boundary":"This bounded public-web search supports only an adjacent-prior-art disposition and a remaining empirical workflow claim. It cannot establish world novelty, patentability, freedom to operate, market size, routine prevalence across all engineering sectors, or realized safety impact."}