On failing any self-test the module enters an error state, signals it on the status output, performs no cryptographic operation and outputs no data, and does not use the failed function until its test passes again; self-tests, error states and recovery conditions are documented. Pre-operational tests run automatically at power-on or wake, before a function is used, on operator demand and again within a vendor-set critical period: software integrity by digital signature, cryptographic algorithm tests (known-answer, pair-wise consistency or comparison of two implementations) and a bypass test. Conditional tests run when their condition arises: pair-wise consistency for generated key pairs, software load, manual key entry (error detection code of at least 32 bits or duplicate entry), continuous random bit generator test, entropy source min-entropy and conditional bypass integrity. Other critical functions are identified and tested.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.