SAFETY Report · 868ac61b5a25…

Projectdemo-l2-adas

Analysed2026-10-24T20:24:36+00:00

InventoryDemo inventory A — claim 200 ms (mismatch)

ScopeISO21448 · ISO26262-4 · UNR79

Analyze snapshot · no verdict · not certification

1 ASIL · 4 timing · 70 gaps · 2 grammar · 1 caveats

Deterministic Seal body below. LLM appendix is not in the Seal. Mapping ≠ Verdict. ASIL allocated ≠ timing evidence.

seal in Seal
868ac61b5a252b72cb4d17133f16905cada2b1a9896fdbeee0af2884b41b07f4

domain_hash in Seal
13921106030be0c609edc03b3a60ad3c285cd4235c2b5b45d4f86bf0a772c993

grammar_version in Seal
demo_l2_adas:676b5b04dcd20521

source envelope
live

cadence envelope
project

mapping_id envelope
engine_field_map.yaml

frozen_by envelope
live

ephemeral envelope
true

Freeze is ephemeral — domain not frozen for replay; not replayable across engines.

G116 in_scope 16

SYS.2 17/22 SWE.1 · tested 3/22

SWE.1 14/22 linked to SYS.2

Safety Goals5 1 ASIL · 4 timing

Caveats1

Derived caveats — not hashed into Seal.

Code	Theme	Message
`TEST_VERIFIED_BY_NOT_COUNTED`	verification	TEST_GAP uses tests/verifies only (DEC-SC-01). Polarion verified_by does not count until mapped to those relations.

Integrity · ASIL ≠ Timing1 ASIL · 4 timing

Two checks, one SG. Calm row only if both axes hold. ASIL allocated ≠ timing evidence. OPEN ≠ failed.

SG	ASIL	Timing
`SG-1`	`ok · undecomposed · ASIL B` allocated	`COVERED` · FTTI 200 ms
`SG-2`	`ok · undecomposed · ASIL B` allocated	`evidence_unusable` `missing_result_or_executed_at` · FTTI 300 ms
`SG-3`	`ok · decomposed · ASIL C` allocated	`evidence_unusable` `claim_target_mismatch_sg_ftti` · FTTI 150 ms
`SG-4`	`gap · incomplete_decomp · ASIL C` demands ASIL C; decomposition group 'acc_long_c' incomplete or invalid (components ['DEMO-SWE2-003'], ASILs ['B']) — independent safe path (monitor / ASIL decomposition) missing	`OPEN` `no_ftti_reaction_evidence` · FTTI 200 ms
`SG-5`	`ok · undecomposed · ASIL C` allocated	`OPEN` `no_ftti_reaction_evidence` · FTTI 100 ms

TIMING_GAP by reason · 4

Timing inventory by reason. OPEN / evidence_unusable are engine statuses — not “failed”.

`claim_target_mismatch_sg_ftti` · 1

SG	Name	FTTI	Status	Reason
`SG-3`	SG-3: Limit corrective steering torque	150 ms	`evidence_unusable`	`claim_target_mismatch_sg_ftti`

`missing_result_or_executed_at` · 1

SG	Name	FTTI	Status	Reason
`SG-2`	SG-2: Warn or degrade on assist / ODD limit	300 ms	`evidence_unusable`	`missing_result_or_executed_at`

`no_ftti_reaction_evidence` · 2

SG	Name	FTTI	Status	Reason
`SG-4`	SG-4: Bound ACC longitudinal commands	200 ms	`OPEN`	`no_ftti_reaction_evidence`
`SG-5`	SG-5: Ensure integrity of actuator commands	100 ms	`OPEN`	`no_ftti_reaction_evidence`

NORM_GAP16

Kind	Id	Detail
NORM_GAP	REQ-21448-12.1-01	Review SOTIF work products · norm=ISO21448
NORM_GAP	REQ-21448-12.1-02	Provide SOTIF achievement argument · norm=ISO21448
NORM_GAP	REQ-21448-12.1-03	Evaluate argument and give release recommendation · norm=ISO21448
NORM_GAP	REQ-21448-6.1-01	Systematically identify vehicle-level hazards · norm=ISO21448
NORM_GAP	REQ-21448-6.1-02	Systematically identify and evaluate risk and scenarios · norm=ISO21448
NORM_GAP	REQ-21448-6.1-03	Specify hazardous behaviour circumstances parameters · norm=ISO21448
NORM_GAP	REQ-21448-6.1-04	Specify acceptance criteria for residual risk · norm=ISO21448
NORM_GAP	REQ-26262-4-8.4.2-01	Die Spezifikation der Sicherheitsvalidierung muss definiert werden und umfasst die Konfiguration des Items einschließlich Kalibrierdaten, die Spezifikation der Validierungsverfahren, Testfälle, Fahrmanöver und Akzeptanzkriterien sowie die Ausrüstung und erforderlichen Umgebungsbedingungen. · norm=ISO26262-4
NORM_GAP	REQ-26262-4-8.4.4-01	Die Ergebnisse der Safety Validation müssen so ausgewertet werden, dass sie als Nachweis dienen, dass die implementierten Safety Goals die Funktionale Sicherheit des Items erreichen. · norm=ISO26262-4
NORM_GAP	REQ-79-5.6.2.1.1-01	The activated system must ensure the vehicle does not cross a lane marking when lateral acceleration is below the manufacturer-specified maximum. The system is permitted to exceed the specified value aysmax by up to 0.3 m/s², provided the maximum value in paragraph 5.6.2.1.3 is not exceeded. · norm=UNR79
NORM_GAP	REQ-79-5.6.2.1.2-01	The vehicle must provide the driver with a means to activate the system (standby mode) and to deactivate it (off mode). · norm=UNR79
NORM_GAP	REQ-79-5.6.2.1.2-02	The system must be deactivable by the driver at any time through a single action. · norm=UNR79
NORM_GAP	REQ-79-5.6.2.1.3-01	Das System muss so ausgelegt sein, dass übermäßige Eingriffe in die Lenkregelung unterdrückt werden, um die Lenkbarkeit durch den Fahrer sicherzustellen und unerwartetes Fahrzeugverhalten zu vermeiden. · norm=UNR79
NORM_GAP	REQ-79-5.6.2.1.3-02	Die Lenkkräfte, die zum Übersteuern der vom System bereitgestellten Richtungssteuerung erforderlich sind, dürfen 50 N nicht überschreiten. · norm=UNR79
NORM_GAP	REQ-79-5.6.2.1.3-03	Die festgelegte maximale Querbeschleunigung aysmax muss innerhalb der in der Tabelle definierten Grenzen liegen. · norm=UNR79
NORM_GAP	REQ-79-UNR79_sec5_6_2_1_4-01	The requirements defined in paragraphs 5.6.2.1.1 and 5.6.2.1.3 must be verified using the relevant vehicle tests specified in Annex 8 of the Regulation. · norm=UNR79

SYS_GAP5

Kind	Id	Detail
SYS_GAP	DEMO-SYS-004	SYS SG-4 ACC command bounds
SYS_GAP	DEMO-SYS-008	SYS warning latency (SG-2 support)
SYS_GAP	TSR-004	TSR-004 ACC longitudinal commands shall stay within acceleration bounds.
SYS_GAP	TSR-007	TSR-007 Driver warnings shall be issued within FTTI of a degradation decision.
SYS_GAP	TSR-012	TSR-012 (Intentional gap) Unallocated TSR for demo TRACE gap — no SWE component.

OVER_FILL8

Kind	Id	Detail
OVER_FILL	req_swe1:SSC-001	SSC-001 Actuator command E2E protection in software; inhibit LKA torque on E2E fault.
OVER_FILL	req_swe1:SSC-002	SSC-002 Enforce calibrated steering torque envelope before actuator output. [decomp B(C)]
OVER_FILL	req_swe1:SSC-003	SSC-003 Sequence warn → limit → inhibit without chatter on ODD / assist exit.
OVER_FILL	req_swe1:SSC-004	SSC-004 Detect camera blockage / low quality and degrade LKA.
OVER_FILL	req_swe1:SSC-005	SSC-005 Detect invalid following-distance and force Coast / ACC off.
OVER_FILL	req_swe1:SSC-ACC-MON	SSC-ACC-MON Independent ACC command plausibility monitor for ASIL decomposition C → B(C) `acc_ctrl` + A(C) monitor. **Intentional demo gap: not realized in SWE.
OVER_FILL	req_swe1:SSC-ID	SSC-ID Requirement [decomp Decomposition]
OVER_FILL	req_swe1:SSC-MON-001	SSC-MON-001 Independent steering-torque plausibility monitor for ASIL decomposition C → B(C) `torque_limiter` + A(C) `torque_plaus_mon` (own partition / FFI). [

TEST_GAP_SYS219

Kind	Id	Detail
TEST_GAP_SYS2	DEMO-SYS-001	SYS SG-1 lane keep / warn
TEST_GAP_SYS2	DEMO-SYS-002	SYS SG-2 assist / ODD warn
TEST_GAP_SYS2	DEMO-SYS-003	SYS SG-3 steering torque limit
TEST_GAP_SYS2	DEMO-SYS-004	SYS SG-4 ACC command bounds
TEST_GAP_SYS2	DEMO-SYS-005	SYS SG-5 actuator command integrity
TEST_GAP_SYS2	DEMO-SYS-006	SYS degradation manager
TEST_GAP_SYS2	DEMO-SYS-007	SYS gap integrity (SG-4 support)
TEST_GAP_SYS2	DEMO-SYS-008	SYS warning latency (SG-2 support)
TEST_GAP_SYS2	DEMO-SYS-009	SYS hands-on cue (SG-2 support)
TEST_GAP_SYS2	DEMO-SYS-010	SYS camera blockage (SG-1 support)
TEST_GAP_SYS2	TSR-004	TSR-004 ACC longitudinal commands shall stay within acceleration bounds.
TEST_GAP_SYS2	TSR-005	TSR-005 Invalid following-distance estimates shall force Coast / ACC off.
TEST_GAP_SYS2	TSR-006	TSR-006 Actuator commands shall be E2E-protected; faults inhibit LKA torque.
TEST_GAP_SYS2	TSR-007	TSR-007 Driver warnings shall be issued within FTTI of a degradation decision.
TEST_GAP_SYS2	TSR-008	TSR-008 Missing hands-on / engagement cues shall trigger warn and LKA limit.
TEST_GAP_SYS2	TSR-009	TSR-009 Camera blockage shall be detected and shall degrade LKA.
TEST_GAP_SYS2	TSR-010	TSR-010 Degradation manager shall sequence warn → limit → inhibit without chatter.
TEST_GAP_SYS2	TSR-011	TSR-011 Lane estimate inconsistency shall be detected before lateral command update.
TEST_GAP_SYS2	TSR-012	TSR-012 (Intentional gap) Unallocated TSR for demo TRACE gap — no SWE component.

TEST_GAP_SWE122

Kind	Id	Detail
TEST_GAP_SWE1	req_swe1:DEMO-SWE-001	SWE lka_ctrl Control loop shall keep the vehicle in lane under LKA within FTTI 200 ms or request driver take-over.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-002	SWE hmi_mgr Software shall warn or degrade when assist / ODD limits are reached within FTTI 300 ms.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-003	SWE torque_limiter Corrective steering torque shall be limited to the calibrated envelope
TEST_GAP_SWE1	req_swe1:DEMO-SWE-004	SWE acc_ctrl Invalid following-distance estimates shall force Coast / ACC off.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-005	SWE degradation_mgr Degradation manager shall sequence warn → limit → inhibit without chatter.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-006	SWE com_e2e Actuator commands shall be E2E-protected; faults inhibit LKA torque.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-007	SWE degradation_mgr Missing hands-on / engagement cues shall trigger warn and LKA limit.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-008	SWE lane_estimator Camera blockage shall be detected and shall degrade LKA.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-009	SWE lane_estimator lane_estimator shall publish ODD / marking-insufficient as a degrade event to degradation_mgr.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-010	SWE hmi_mgr hmi_mgr shall issue a driver take-over request within FTTI 300 ms of a warn decision.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-011	SWE lka_ctrl On Limit, degradation_mgr shall command lka_ctrl into limited-assist mode and tighten the torque envelope.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-012	SWE lka_ctrl Driver override / take-over shall force LKA inhibit and reset the lateral controller.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-013	SWE degradation_mgr If the driver does not take over within the calibrated timeout after Warn, degradation_mgr shall inhibit LKA.
TEST_GAP_SWE1	req_swe1:DEMO-SWE-014	SWE torque_plaus_mon Independent torque plausibility monitor shall detect envelope violations and inhibit LKA torque within FTTI
TEST_GAP_SWE1	req_swe1:SSC-001	SSC-001 Actuator command E2E protection in software; inhibit LKA torque on E2E fault.
TEST_GAP_SWE1	req_swe1:SSC-002	SSC-002 Enforce calibrated steering torque envelope before actuator output. [decomp B(C)]
TEST_GAP_SWE1	req_swe1:SSC-003	SSC-003 Sequence warn → limit → inhibit without chatter on ODD / assist exit.
TEST_GAP_SWE1	req_swe1:SSC-004	SSC-004 Detect camera blockage / low quality and degrade LKA.
TEST_GAP_SWE1	req_swe1:SSC-005	SSC-005 Detect invalid following-distance and force Coast / ACC off.
TEST_GAP_SWE1	req_swe1:SSC-ACC-MON	SSC-ACC-MON Independent ACC command plausibility monitor for ASIL decomposition C → B(C) `acc_ctrl` + A(C) monitor. **Intentional demo gap: not realized in SWE.
TEST_GAP_SWE1	req_swe1:SSC-ID	SSC-ID Requirement [decomp Decomposition]
TEST_GAP_SWE1	req_swe1:SSC-MON-001	SSC-MON-001 Independent steering-torque plausibility monitor for ASIL decomposition C → B(C) `torque_limiter` + A(C) `torque_plaus_mon` (own partition / FFI). [

Grammar2 · 10 rules

pack=demo_l2_adas · rules_loaded=10 · 0 findings ≠ pass

base: ACY-001, ACY-002, CARD-001 · overlay: ACYC-001, ASIL-DOM-001, CARD-HARA-001, CARD-SF-001, PROP-001, PROP-SG-002, SCOPE-EXCL-001

INF-013 (inference, not in rule_ids): ASIL along sys2_specifies_function with max_asil before freeze.

Omitted vs Neura: CARD-003 (1:1 SYS.2↔SG), IMPL-001/002 (SSM/PFL).

Level	Rule	Node	Detail
error	`ASIL-DOM-001`	DEMO-SYS-007	Node 'DEMO-SYS-007' asil='B' < 'SG-4' asil='C' via sys2_specifies_function
error	`ASIL-DOM-001`	TSR-005	Node 'TSR-005' asil='B' < 'SG-4' asil='C' via sys2_specifies_function

Appendix A — LLMnot in Seal

No LLM assessment.

Seal ≠ Certification · A4 · freeze ephemeral

SEAL · 868ac61b5a252b72cb4d17133f16905cada2b1a9896fdbeee0af2884b41b07f4

TIMING_GAP by reason · 4

claim_target_mismatch_sg_ftti · 1

missing_result_or_executed_at · 1

no_ftti_reaction_evidence · 2

`claim_target_mismatch_sg_ftti` · 1

`missing_result_or_executed_at` · 1

`no_ftti_reaction_evidence` · 2