When the Fix Stops at the Program Boundary: An Inheritance-Graph Framework for Bounding Sibling Exposure After a Confirmed Safety Anomaly in ISO 26262 Field Monitoring

I. Introduction

A confirmed safety anomaly is a statement about one vehicle program, but the engineering that produced it was almost never confined to that program. Specifications are inherited, control logic is carried forward and re-calibrated, suppliers serve several platforms, and test methods that missed a defect in one vehicle are the same methods that approved its siblings. ISO 26262 recognizes that field experience must feed back into development: its safety-management part requires field monitoring and the handling of safety anomalies after release for production, and its supporting parts require impact analysis for changes and a dependent-failure analysis for elements that are supposed to be independent [1]. What the standard does not state is how far a confirmed anomaly must be pursued across programs, in what order, and how quickly. That quantity, the extent of condition, is left to the manufacturer's judgment and, in practice, to the speed of its investigation process.

The public record shows what that judgment costs. On March 17, 2026, Hyundai reported NHTSA campaign 26V160, covering 61,093 model-year 2026 Palisade vehicles whose rear power seat could entrap an occupant, with an interim software remedy and a permanent remedy still in development [4]. On September 10, 2026, 177 days later, Hyundai reported campaign 26V588 for 5,360 model-year 2026 Ioniq 9 vehicles, with a consequence statement identical to the Palisade's [5]. Production of the affected Ioniq 9 units continued until May 4, 2026, 48 days after the Palisade report [6]. In a second, unrelated case, FCA US recalled 265,512 Ram ProMaster vans for corroded steering harnesses on September 29, 2026 [7], after NHTSA had opened a preliminary evaluation of 136,666 vehicles on March 2, 2026 [8]. The recall population was 94 percent larger than the population first investigated. In both cases the defect was found once and then found again, in a larger or different population, after a delay measured in months.

This paper addresses one research question. Given a confirmed safety anomaly in one vehicle program, how should the set of sibling programs to be evaluated, the order of their evaluation, and the maximum time to each evaluation decision be derived, so that the exposure accumulated while a sibling's status is unknown is bounded and auditable? The contributions are:

• An inheritance graph whose nodes are programs, variants and service parts and whose typed edges record shared specification, software logic, hardware or supplier, validation method, manufacturing line and service part, each edge carrying a transfer probability with an explicit prior.
• Six numbered relations: sibling transfer probability, a screening update, accumulated sibling exposure with a production-continues term, an expected-event and break-even-rate pair, a maximum evaluation latency for a stated event budget, and an evaluation-ordering rule.
• A mapping to ISO 26262 field-monitoring, change-management, proven-in-use and dependent-failure clauses, and six derived requirements for an extent-of-condition register.
• A worked application to the Hyundai Palisade and Ioniq 9 seat recalls, giving about 8.9 × 10⁵ vehicle-days of sibling exposure over 169 days, and a second application to the Ram ProMaster scope extension, giving about 2.6 × 10⁷ vehicle-days outside the investigated population.

Section II reviews background and the gap. Section III develops the framework. Section IV applies it. Section V discusses limitations and where the standards lens stops. Section VI concludes.

II. Background and Related Work

A. Standards and Regulation

ISO 26262:2018 assigns post-release monitoring to its safety-management part, whose clause 7 covers production, operation, service and decommissioning, including field monitoring and the handling of safety anomalies [1]. Part 8 clause 8 requires an impact analysis for every change, part 8 clause 14 bases a proven-in-use argument on field data and service-period evidence, and part 9 clause 7 requires a dependent-failure analysis to demonstrate that elements claimed to be independent do not share a cause [1]. Each clause assumes a defined scope: one item, one change, one architecture. None says how a finding on one item defines the scope of the next item's review.

The United States regulator applies a clock to a different event. A manufacturer must submit a defect report within five working days after it determines that a defect is safety-related [2]. The clock starts at the manufacturer's own determination, which is the end of the process this paper models, not its beginning. For the function at issue in the first case there is, to our knowledge, no federal standard: FMVSS 118 prescribes requirements for power-operated windows, partitions and roof panels but, to our knowledge, does not address power seats [3]. Where no external requirement exists, the only safety argument is the manufacturer's own, and its reach is whatever the safety plan makes it.

B. Recalls as an Object of Study

Rupp and Taylor studied the initiation of automobile recalls [10], and Bates et al. described trends, patterns and emerging issues in motor vehicle recalls [11]. Chi, Sigmund and Astardi built a root-cause and FMEA classification scheme for passenger-vehicle recalls [12]. None of these treats the sibling question directly. Kang, Hong, Huh and Kang analyze failure risk from the perspective of platform sharing in IEEE Transactions on Engineering Management [13], which is the closest economic precedent: sharing a platform couples the failure risk of the products built on it. Our framework makes that coupling operational at the level of a safety register.

C. Defect Propagation in Software and Product Lines

Software engineering has measured how defects spread. Fenton and Ohlsson analyzed the distribution of faults and failures across the modules of a complex software system [14]. Zimmermann and Nagappan showed that network measures on dependency graphs help predict defective modules [15]. Juergens et al. asked whether code clones matter and examined faults in inconsistently changed clones [16], which is the code-level form of a defect repaired in one copy and not in another. Abal, Brabrand and Wasowski catalogued variability bugs that appear only under particular configurations [17], and Thüm et al. surveyed analysis strategies for software product lines, which seek to analyze a family without examining every product separately [18]. A vehicle program family is a product line in which the shared assets include requirements, logic and suppliers. The extent-of-condition question is the product-line question applied after a field failure.

D. Common Cause and Dependent Failures

Common-cause failure analysis was developed for redundant systems in the nuclear industry, where procedures were documented in NUREG/CR-4780 [23]. Troffaes, Walter and Kelly treat the epistemic uncertainty of common-cause parameters with a robust Bayesian model [22], and Picoco and Rychkov model common-cause failure in dynamic probabilistic risk assessment [25]. These methods quantify dependence among redundant channels at one moment in one system. The dependence studied here runs between systems and across calendar time: the "channels" are separate vehicle programs and the "mission time" is the interval during which a sibling's status is unknown.

E. Propagation on Networks

The independent-cascade model of Kempe, Kleinberg and Tardos activates each edge of a graph independently with a stated probability and asks which nodes are reached [20]. Pastor-Satorras et al. review epidemic processes on complex networks, in which the same edge-transmission structure determines how a contagion spreads [21]. We borrow the edge-transmission model and discard the rest: the number of sibling programs is small, the graph is known to the manufacturer, and the interesting quantity is not the final reach but the time-integrated exposure before the reach is known.

F. Assurance Reuse and Compliance Evidence

Kokaly et al. manage the reuse of assurance cases when a system evolves, tracing which claims survive a change [19]. Deka and Sarkar catalogue thirteen public automotive compliance-documentation failures and conclude that none was caught by the supply chain's routine verification layer [26]. Ihshaish et al. show that the choice among matched records describing the same operational case, including NHTSA recalls, can change the result of text-classification studies more than the choice of model [27]. The last two matter here as a caution: the public recall record is a manufacturer-chosen narrative, and any quantity derived from it inherits that selection.

G. The Gap

The literature gives us the economics of recalls, the propagation of defects through software and product lines, the quantification of common cause within one system, and the reuse of assurance arguments under change. It does not give a field-monitoring artifact that, on the day an anomaly is confirmed, lists the siblings, prices the exposure of leaving each one unevaluated, and sets a deadline. That artifact is what we propose.

III. Approach: The Extent-of-Condition Framework

A. Anchor, Descriptor and Inheritance Graph

The framework starts from an anchor: a program a with a confirmed safety anomaly at date t_a, taken as the date of the manufacturer's defect report. The anomaly is reduced to a defect-class descriptor, a triple of the function affected, the failure mechanism, and the hazard. For the first case below the triple is power-seat occupant detection, failure to respond to contact during automatic motion, and occupant entrapment.

The inheritance graph is a directed graph G = (V, E) with V the set of programs, variants and service parts, and an edge e from a to j for each artifact class shared between them. Table I lists six classes. Each edge has a transfer probability q_e, the probability that the defect class exists in the sibling given that the artifact is shared, expressed as a Beta(α, β) prior so that evidence can update it. Sharing that cannot be determined is treated as shared until disproved (q = 1). Fig. 1 shows the graph for the first case.

B. Relations

Transfer probability. Let Π_aj be the set of paths from the anchor to sibling j, and let each edge activate independently with probability q_e. The probability that the defect class reaches j is bounded above by

The expression is exact when the paths are edge-disjoint, as when two sibling edges are parallel, and an upper bound otherwise, because events of the form "this path is live" are positively correlated when paths share edges, a consequence of the Harris–FKG inequality for independent edge activations. An upper bound is the conservative direction for a register.

Screening update. A screening applies n test conditions on the sibling, chosen to be diagnostic of the edge class, of which x reproduce the anomaly. The edge's Beta prior updates to

A single reproduction (x ≥ 1) converts the sibling from inferred to confirmed and ends the use of (1) for that node. A clean screening (x = 0) lowers q_e by an amount that depends on n, so a screening of one condition buys little and a screening of ten buys a lot. For the S edge of Table I, a clean screening of n = 5 conditions lowers the mean from 0.50 to 0.22 and n = 10 lowers it to 0.14.

Accumulated exposure. Let sibling j have N_j⁰ units in service at t_a, a build rate λ_j in units per day, and production that continues until day τ_s after the anchor, whether by the end of the model run or a build hold. Let τ be the latency from the anchor to the sibling decision. The vehicle-days of exposure accumulated before the decision are

The first term is the standing fleet, the remaining terms are the fleet added by production while the decision is pending. A manufacturer can reduce the first by deciding faster and the second by deciding faster or by holding the build.

Expected events and break-even rate. Let ρ be the rate of hazardous events attributable to the defect class per exposed vehicle-day, estimated from the anchor's field record or from the HARA exposure and controllability assumptions. The expected number of events in the sibling during the latency, and the rate at which that number reaches one, are

The break-even rate ρ^* is useful because ρ is rarely known with confidence. It turns the question "what is the event rate?" into the question "is the event rate plausibly below ρ^*?", which a safety assessor can answer from the HARA.

Maximum latency. For an event budget ε (default 1), the largest latency that keeps E_j ≤ ε solves P_j ρ X_j(τ^*) = ε. Writing c = ε / (P_j ρ), the closed forms are

Evaluation order. When several siblings await evaluation and evaluation capacity is limited, the cost of leaving sibling j pending accrues at the rate w_j = P_j ρ_j N_j(t), the derivative of (4) with respect to time. If evaluation j takes d_j days and w_j is approximately constant, minimizing the total accrued cost is a weighted-completion-time scheduling problem whose optimal sequence, due to Smith, is

with w_j / d_j the exposure-weighted urgency per day of evaluation effort [24]. The rule favors large, probable, quickly evaluated siblings first and defers small, improbable, slow ones.

C. Mapping to ISO 26262 and Derived Requirements

Table II places each framework step under the clause that already gives the manufacturer the authority to perform it. Table III lists the six requirements the framework implies. The requirements are drafts: numeric defaults are illustrative and need justification against the item's HARA.

IV. Worked Examples

A. Hyundai Palisade to Ioniq 9

Public record. The anchor is campaign 26V160, reported March 17, 2026 for 61,093 Palisade and Palisade Hybrid vehicles, with the consequence statement that a person, especially a child, may become trapped by a rear powered seat [4]. The sibling is campaign 26V588, reported September 10, 2026 for 5,360 Ioniq 9 vehicles built from March 17, 2025 through May 4, 2026, with a defect cause stated as seat logic that may not detect contact with an occupant or object [5], [6]. Hyundai's chronology records that its investigation began on March 10, 2026 with benchmarking, that fixture testing on August 4 to 6 measured forces exceeding limits for second-row systems, and that the recall decision came on September 2 [6]. By the decision date Hyundai had five consumer complaints, two reporting minor injuries [6].

Graph and probability. The defect text is identical in the two filings, supporting an S edge, and the Ioniq 9 filing names the seat logic, supporting an L edge [5], [6]. The supplier is not named in the filings, so the H edge is excluded rather than assumed. With the Table I means, relation (1) gives P_j = 1 − (1 − 0.50)(1 − 0.60) = 0.80 on the day the anchor was reported. The positive fixture test of August is a screening with x ≥ 1, which converts the sibling to confirmed by relation (2).

Exposure. The sibling decision came 169 days after the anchor, and the Part 573 report 177 days after it. The build window of 413 days (March 17, 2025 to May 4, 2026) contains 5,360 units, which at a uniform build rate gives λ = 13.0 units per day. The 48 days from the anchor to the end of the build window then produced about 623 units, and about 4,737 units were in service at t_a. The uniform build rate is our assumption and the filings give no daily figures. Relation (3) with τ = 169 and τ_s = 48 gives X_j = 8.91 × 10⁵ vehicle-days, of which about 8.01 × 10⁵ is the standing fleet and the remainder is the fleet added by production. Table IV collects the quantities.

Break-even rate. Relation (4) gives ρ^* = 1.40 × 10⁻⁶ per vehicle-day, or 5.1 × 10⁻⁴ per vehicle-year. If the true rate of entrapment events per exposed vehicle-year is above that figure, one event was expected in the Ioniq 9 population during the 169 days, with probability 0.80 that the defect class was present at all. We do not claim that the true rate exceeds that figure; we claim that the question "is it below 5.1 × 10⁻⁴?" is the one the register forces, for a hazard whose consequence is stated as injury to a trapped child [4]. Fig. 2 shows how X_j grows with latency. Deciding at 45 days instead of 169 would have reduced the accumulated exposure by 75 percent, to 2.26 × 10⁵ vehicle-days, a figure that does not assume a faster test, only a deadline.

Maximum latency. Table V solves relation (5) for an event budget of one over a range of assumed event rates, with P_j = 0.80 and the Table IV fleet. At 5 × 10⁻⁴ per vehicle-year the permitted latency is 173 days, close to what happened, which is another way of stating the break-even result. At 10⁻³ it is 88 days and at 5 × 10⁻³ it is 19 days. A manufacturer that believes its sibling event rate is as high as one in a thousand vehicle-years has, by its own estimate, 88 days. The 45-day default of EOC-R4 corresponds to a rate of about 2 × 10⁻³ per vehicle-year and is a reasonable ceiling where a child-entrapment hazard cannot be excluded.

Screening. The edge classes in Table I are not equally testable. The S and L edges of this case can be screened by the same bench fixture that Hyundai built for the Palisade, so relation (2) applies directly: a clean screening of five conditions would have lowered the S mean from 0.50 to 0.22 and the L mean from 0.60 to 0.30, giving P_j = 0.46 and permitting a lower priority in the order of (6). Hyundai's fixture result of August was not clean, and it converted the sibling to confirmed.

B. Ram ProMaster Scope Extension

The Ram ProMaster case tests the framework on a different edge: not a sibling program but a sibling population defined by model year and variant. NHTSA opened preliminary evaluation PE26-002 on March 2, 2026 on 19 owner questionnaires, covering 136,666 model-year 2022 and 2023 vehicles and water intrusion into a power steering module connector [8]. FCA determined a safety defect on September 22, 2026 and recalled 265,512 vehicles, model years 2022 to 2026, including 1,874 model-year 2024 to 2026 3500 electric vans, estimating that 7.7 percent of the population has the defect [7]. FCA's own records at the time of filing held 2,799 warranty claims, 437 customer assistance records and 191 field reports from April 2022 through June 2026 [7].

The recall population exceeds the investigated population by 128,846 vehicles, a factor of 1.94. These vehicles were in service during the 204 days between the opening of the preliminary evaluation and the defect determination [7], [8]. With production assumed to have ceased contributing (λ = 0, which understates exposure), relation (3) reduces to X = N⁰ τ, or 128,846 × 204 = 2.63 × 10⁷ vehicle-days outside the investigated population. If the manufacturer's 7.7 percent prevalence applied uniformly, which is an upper-end assumption because newer vehicles have had less time to corrode, about 9,900 defective vehicles were in that population. The manufacturer-side record of 3,427 warranty, assistance and field records (through June 2026) is about 180 times the 19 owner questionnaires on which the regulator opened its evaluation (March 2026) [7], [8]; the dates differ, so the ratio is indicative. That ratio is a screening opportunity of the kind relation (2) prices: the manufacturer held evidence about the extension population before the regulator's scope included it.

C. Service Parts as a Third Edge Class

A third filing shows why Table I includes class R. Ford's campaigns 26V582 and 26E063 cover 86 vehicles that received a replacement battery energy control module and 83 service modules, respectively [9]. Press accounts of the filings say that some modules were sold over the counter or fitted under warranty without traceability to individual vehicles, which is why the part itself was recalled [28]. When part-to-vehicle traceability is incomplete, the graph's node set is itself incomplete, and the register must carry a node for the part population in addition to the vehicle population. Requirement EOC-R1 therefore includes service parts.

V. Discussion

Limitations. The edge priors of Table I are elicited, not estimated. A calibrated version would fit q by class from a corpus of anchor-and-sibling recall pairs, and no such fit is attempted here. The uniform build rate in Table IV is our assumption, and daily production data would change the production term of (3), though not the standing-fleet term, which is 90 percent of the total in this case. The event rate ρ is unknown for both cases and the framework deliberately returns break-even rates and latency tables instead of a point estimate. Relation (1) assumes independent edge activation. Real edges are correlated, because two programs that share specification probably share logic, and an upper bound on reach can overstate the register for a tightly coupled family.

Threats to validity. The public record is a manufacturer-selected chronology, and a Part 573 report states what the manufacturer chose to state [26], [27]. A study based on such records can measure the latency between filed dates but not the quality of the internal analysis in between. The exposure measure counts calendar vehicle-days, not vehicle-days of use of the affected function, and the two differ by a factor that depends on the function. We have chosen two cases in which the sibling was eventually found, and a selection of that kind says nothing about the false-positive rate of an extent-of-condition process, which is the cost of evaluating and recalling siblings that turn out to be clean. Relation (2) is the framework's answer to that cost, since a clean screening is cheap, but the claim is untested.

Where the standards lens stops. ISO 26262 can require that the register exist, that edges be justified and that determinations be recorded. It cannot determine the legal moment at which a manufacturer's information amounts to a defect determination, which is the moment at which the five-working-day clock of [2] starts. It also cannot supply a supplier's design history, which the development interface agreement must provide under part 8, clause 5 [1]. When a supplier serves several manufacturers, the inheritance graph crosses company boundaries and a single manufacturer's register cannot be complete. Finally, the framework assumes that the anomaly can be reduced to a descriptor. The hardest anomalies, those whose mechanism is not understood, resist the typing that Table I requires, and for them EOC-R2 defaults to q = 1, which is correct but expensive.

VI. Conclusion and Future Work

We have proposed an inheritance-graph framework that turns the extent-of-condition question after a confirmed safety anomaly into six relations and six requirements: a transfer probability, a screening update, an exposure integral with a production term, a break-even event rate, a maximum evaluation latency, and an ordering rule. Applied to the public NHTSA record, the framework prices the 169-day gap between the Palisade and Ioniq 9 seat decisions at about 8.9 × 10⁵ sibling vehicle-days and shows that a 45-day deadline would have removed three quarters of it, and it prices the Ram ProMaster scope extension at about 2.6 × 10⁷ vehicle-days outside the investigated population.

Future work has three directions. The first is calibration: fitting the Table I priors to a corpus of recall pairs with shared components, where the time between anchor and sibling reports is the observable that the framework predicts. The second is relaxing the independence assumption with correlated edge activation, using the cascade and product-line literature as the starting point. The third is integration with the safety case: a register entry that is open should suspend the proven-in-use and independence claims that depend on the sibling, and an assurance-reuse tool of the kind surveyed in Section II-F could enforce that automatically.