Research-Stack/6-Documentation/conformance/iso_26262_hara_fmea.md

ISO 26262 Safety Case: Q16_16 Fixed-Point Core & Topological Safety Monitor (TSM)

This safety case documents the Hazard Analysis and Risk Assessment (HARA) and Failure Mode and Effects Analysis (FMEA) for the integer-only fixed-point arithmetic subsystem (Q16_16) and the Topological Safety Monitor (TSM) control loops.

All safety requirements in this document target the highest integrity level, ASIL D, in compliance with ISO 26262:2018.

---

Hazard Analysis and Risk Assessment (HARA)

Hazard Identification

The compute fabric executes flight-control, thermal-monitor, and robotic-joint actuator models. Safe operation depends on deterministic, bounded arithmetic values.

We identify three critical hazards:

1. HAZ-01: Arithmetic Saturation Overflow

   • Description: Addition or multiplication results exceed 2^{31}-1 or fall below -2^{31}, triggering a clamp (saturation) which introduces non-linear step discontinuities in control outputs.
   • Exposure (E): E4 (High probability of operational conditions requiring full control authority).
   • Severity (S): S3 (Life-threatening or fatal injuries due to uncontrolled actuator displacement).
   • Controllability (C): C3 (Difficult to control; pilot/operator cannot override high-frequency actuator cycles).
   • ASIL Classification: ASIL D.

2. HAZ-02: Zero-Denominator Divergence

   • Description: Underverse bleed/impedance calculations or Cramer matrix coordinate extraction performs division by zero or a near-zero denominator, causing the value to clamp to q16MaxRaw (2147483647).
   • Exposure (E): E3 (Medium probability during shock wave front collapse).
   • Severity (S): S3 (Actuator hard-over or lock-up).
   • Controllability (C): C3 (Uncontrollable).
   • ASIL Classification: ASIL D.

3. HAZ-03: TSM Domain Desynchronization

   • Description: Warden, Builder, and Judge clock domains fail to align state vectors at boundary gates, leading to out-of-order execution or stale feedback loop updates.
   • Exposure (E): E4 (Continuous operation).
   • Severity (S): S3 (Thermal runaway or structural joint failure).
   • Controllability (C): C2 (Normally controllable by safety backup).
   • ASIL Classification: ASIL C (Design requirement bumped to ASIL D for common-cause fault tolerance).

---

Failure Mode and Effects Analysis (FMEA)

The following table summarizes the failure modes at the interface between the software/hardware boundaries, along with their diagnostic coverage and formal mitigations.

Component	Failure Mode	Local Effect	System Effect	Diagnostic Coverage	Formal Mitigation (Lean Link)
Q16_16 Math	Truncation overflow during add or sub	.val clamped to boundary	Loss of feedback linearity; actuator jitter	99% (TSM Warden)	FixedPoint.lean proves saturation bounds and preservation of order symmetries.
Q16_16 Math	Near-zero division during Cramer weight solve	Division result clamped to MAX_VAL	Out-of-bounds weight projection; unstable front tracking	100% (Division guard)	add_toInt_of_no_sat and exact Cramer division-free determinant bounds in Cramer4D prevent runtime divergence.
TSM Judge	State vector mismatch at epoch	Warden fails to lock gate	Stale configuration persists; delayed emergency drainage	99.9% (Triple redundancy)	TSM.lean defines state transitions and proves monotonic Lyapunov energy decay.
DST Trim	Trim window error	Active front nodes pruned incorrectly	Loss of tracking precision; localized potential bleed spikes	95% (Energy conservation check)	braid_shock_16d.py implements the physical ledger constraints; verified on EPYC.

---

Safety Requirements & Mitigations

1. Verification of Arithmetic Symmetries

• Requirement: All basic Q16 arithmetic operations (add, sub, mul, div) must behave symmetrically and monotonically without unexpected sign-flips under boundary conditions.
• Mitigation: Proved via Lean theorems. The add_toInt_of_no_sat and sub_toInt_of_no_sat lemmas guarantee that as long as inputs do not trigger the saturation boundaries, the operations behave identically to mathematical integer arithmetic.

2. Cramer's Rule Dimension Protection

• Requirement: Cramer solver must not trigger division overflows when the active manifold dimension collapses.
• Mitigation: The BraidShock engine uses Dimensional Shock Trim (DST) to reduce the active coordinate space to a 4D subspace before executing the Cramer solver. If the determinant of the 4D reference face falls below the threshold 10^{-6} (represented as 65 in Q16), the system falls back to the robust projection mode, preventing divergence.

3. Verification & Diagnostic Coverage

• All software arithmetic kernels are compiled and verified through the Lean compiler (lake build).
• Hardware implementations of the fixed-point units (e.g., trinary edge VM) must be verified against the Lean specifications using the co-simulation harness before bitstream compilation.