Beyond Word-Local ECC: A Bounded-Residual Certified Post-Failure Recovery Architecture for Clustered Upsets in Interleaved SRAM

Physical faults can cross error-correcting code (ECC) word boundaries even when static random-access memory (SRAM) protection remains word-local. This work proposes a bounded-residual certified post-failure recovery architecture for interleaved single-error-correcting, double-error-detecting (SEC-DED) SRAM. Once a complete one- or two-tile recovery window is acquired—either immediately upon a demand-path word-local detected-uncorrectable error (DUE) or during periodic integrity scrubbing—ordinary word syndromes and the known reverse interleaving map generate bounded physical fault hypotheses, while independently protected tile metadata alone authorizes memory write-back. We show that finite randomized testing is insufficient for selecting that certificate: a standard 16-bit cyclic redundancy check (CRC-16) baseline passes extensive adversarial fault-injection campaigns without observed false corrections, yet exact algebraic residual analysis exposes deterministic silent data corruption (SDC) aliases and an explicit silent-correction witness. A parity-split residual-support lemma proves that under the weight-one/two per-word error model, distinct syndrome-equivalent explanations agree on every odd-parity single-error-correcting (SEC) word and can differ only on even-parity double-error-detecting (DED) words. This structural property yields two explicit authorization policies: a strict Commit-Exact mode that bounds active DED words per checked tile so that every authorized write-back lies inside the unrestricted exact one- and two-word residual domain, and a Commit-Env mode that retains the full frozen supported topology envelope, whose complete one-, two-, three-, and four-word candidate-difference space and two-tile boundary extension exhibit zero supported collisions under a fixed 32-bit Castagnoli cyclic redundancy check (CRC-32C) profile. Conditional on complete observation-window acquisition under the reference evaluation, the architecture recovers all template-exhaustive in-support, unseen-connected, and boundary-crossing failures and a high proportion of perturbed-shape failures while committing zero false corrections at modest metadata storage overhead. All formal safety and recovery guarantees remain explicitly conditional on the active commit mode (Commit-Exact or Commit-Env), complete observation-window acquisition, and the stated fault-model assumptions, namely bounded per-word candidate multiplicity, valid and coherent protected metadata, and complete candidate enumeration.