mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-08-08 15:05:45 +00:00
allaun
5f80fd8429
This squashes all local history (768 commits) onto the scrubbed PR #90 baseline. Individual commits were lost during filter-repo corruption; the working tree content is preserved intact. Build: N/A (working tree state only)
63 lines
5.3 KiB
Markdown
63 lines
5.3 KiB
Markdown
# ISO 26262 Safety Case: Q16_16 Fixed-Point Core & Topological Safety Monitor (TSM)
|
|
|
|
This safety case documents the **Hazard Analysis and Risk Assessment (HARA)** and **Failure Mode and Effects Analysis (FMEA)** for the integer-only fixed-point arithmetic subsystem (`Q16_16`) and the **Topological Safety Monitor (TSM)** control loops.
|
|
|
|
All safety requirements in this document target the highest integrity level, **ASIL D**, in compliance with ISO 26262:2018.
|
|
|
|
---
|
|
|
|
## Hazard Analysis and Risk Assessment (HARA)
|
|
|
|
### Hazard Identification
|
|
The compute fabric executes flight-control, thermal-monitor, and robotic-joint actuator models. Safe operation depends on deterministic, bounded arithmetic values.
|
|
|
|
We identify three critical hazards:
|
|
1. **HAZ-01: Arithmetic Saturation Overflow**
|
|
- *Description*: Addition or multiplication results exceed $2^{31}-1$ or fall below $-2^{31}$, triggering a clamp (saturation) which introduces non-linear step discontinuities in control outputs.
|
|
- *Exposure (E)*: **E4** (High probability of operational conditions requiring full control authority).
|
|
- *Severity (S)*: **S3** (Life-threatening or fatal injuries due to uncontrolled actuator displacement).
|
|
- *Controllability (C)*: **C3** (Difficult to control; pilot/operator cannot override high-frequency actuator cycles).
|
|
- *ASIL Classification*: **ASIL D**.
|
|
|
|
2. **HAZ-02: Zero-Denominator Divergence**
|
|
- *Description*: Underverse bleed/impedance calculations or Cramer matrix coordinate extraction performs division by zero or a near-zero denominator, causing the value to clamp to `q16MaxRaw` ($2147483647$).
|
|
- *Exposure (E)*: **E3** (Medium probability during shock wave front collapse).
|
|
- *Severity (S)*: **S3** (Actuator hard-over or lock-up).
|
|
- *Controllability (C)*: **C3** (Uncontrollable).
|
|
- *ASIL Classification*: **ASIL D**.
|
|
|
|
3. **HAZ-03: TSM Domain Desynchronization**
|
|
- *Description*: Warden, Builder, and Judge clock domains fail to align state vectors at boundary gates, leading to out-of-order execution or stale feedback loop updates.
|
|
- *Exposure (E)*: **E4** (Continuous operation).
|
|
- *Severity (S)*: **S3** (Thermal runaway or structural joint failure).
|
|
- *Controllability (C)*: **C2** (Normally controllable by safety backup).
|
|
- *ASIL Classification*: **ASIL C** (Design requirement bumped to **ASIL D** for common-cause fault tolerance).
|
|
|
|
---
|
|
|
|
## Failure Mode and Effects Analysis (FMEA)
|
|
|
|
The following table summarizes the failure modes at the interface between the software/hardware boundaries, along with their diagnostic coverage and formal mitigations.
|
|
|
|
| Component | Failure Mode | Local Effect | System Effect | Diagnostic Coverage | Formal Mitigation (Lean Link) |
|
|
|---|---|---|---|---|---|
|
|
| **`Q16_16` Math** | Truncation overflow during `add` or `sub` | `.val` clamped to boundary | Loss of feedback linearity; actuator jitter | 99% (TSM Warden) | [FixedPoint.lean](file:///home/allaun/Research%20Stack/0-Core-Formalism/lean/Semantics/Semantics/FixedPoint.lean#L30-L100) proves saturation bounds and preservation of order symmetries. |
|
|
| **`Q16_16` Math** | Near-zero division during Cramer weight solve | Division result clamped to `MAX_VAL` | Out-of-bounds weight projection; unstable front tracking | 100% (Division guard) | `add_toInt_of_no_sat` and exact Cramer division-free determinant bounds in `Cramer4D` prevent runtime divergence. |
|
|
| **TSM Judge** | State vector mismatch at epoch | Warden fails to lock gate | Stale configuration persists; delayed emergency drainage | 99.9% (Triple redundancy) | [TSM.lean](file:///home/allaun/Research%20Stack/0-Core-Formalism/lean/Semantics/Semantics/TSM.lean) defines state transitions and proves monotonic Lyapunov energy decay. |
|
|
| **DST Trim** | Trim window error | Active front nodes pruned incorrectly | Loss of tracking precision; localized potential bleed spikes | 95% (Energy conservation check) | `braid_shock_16d.py` implements the physical ledger constraints; verified on EPYC. |
|
|
|
|
---
|
|
|
|
## Safety Requirements & Mitigations
|
|
|
|
### 1. Verification of Arithmetic Symmetries
|
|
- **Requirement**: All basic Q16 arithmetic operations (`add`, `sub`, `mul`, `div`) must behave symmetrically and monotonically without unexpected sign-flips under boundary conditions.
|
|
- **Mitigation**: Proved via Lean theorems. The `add_toInt_of_no_sat` and `sub_toInt_of_no_sat` lemmas guarantee that as long as inputs do not trigger the saturation boundaries, the operations behave identically to mathematical integer arithmetic.
|
|
|
|
### 2. Cramer's Rule Dimension Protection
|
|
- **Requirement**: Cramer solver must not trigger division overflows when the active manifold dimension collapses.
|
|
- **Mitigation**: The BraidShock engine uses **Dimensional Shock Trim (DST)** to reduce the active coordinate space to a 4D subspace before executing the Cramer solver. If the determinant of the 4D reference face falls below the threshold $10^{-6}$ (represented as `65` in Q16), the system falls back to the robust projection mode, preventing divergence.
|
|
|
|
### 3. Verification & Diagnostic Coverage
|
|
- All software arithmetic kernels are compiled and verified through the Lean compiler (`lake build`).
|
|
- Hardware implementations of the fixed-point units (e.g., trinary edge VM) must be verified against the Lean specifications using the co-simulation harness before bitstream compilation.
|