{"schema_version":1,"research_id":"eoa_inverse_innovation_exp03_external48_20260801","source_assessment_id":"eoa_inverse_innovation_exp03_opportunity320_20260801","cell_id":"computability_boundary_mapping__performing_arts_theatre","selection_stratum":"MIDDLE_BAND_AUDIT_Q3","search_queries":["interactive theatre stage automation formal verification safety programmable cues","theatre show control formal verification safety programmable cues","stage machinery safety standard EN 17206 official theatre automation","site:tsp.esta.org ANSI E1.6-1 powered hoist systems official","site:dguv.de stage event technology programmable control systems IEC 61508 guideline","site:iec.ch IEC 61508 software requirements official","site:model-checking.github.io cbmc bounded model checking unwinding assertions official","site:uppaal.org features model checking timed automata official","site:qlab.app/docs safety cue show control warning","stage automation accident investigation theatre official safety regulator","stage automation formal verification theatre","theatre automation model checking"],"sources":[{"source_id":"S1","title":"Devising Interactive Spaces: A Rehearsal-Oriented Tool for Creating Responsive Environments for Immersive Theatre","publisher":"arXiv","url":"https://arxiv.org/abs/2607.06761","source_class":"PRIMARY_RESEARCH","publication_date":"2026-07-07","accessed_at":"2026-08-02","claims_supported":["A theatre-specific substrate resembling the candidate exists: gesture, position, and speech sensors were connected to light and sound through a visual programming layer.","The system was refined in six workshops with eight professional performance-makers.","The authors characterize it as a rehearsal-oriented prototype rather than production-ready show control."]},{"source_id":"S2","title":"Major injury to Harrison Ford at Pinewood Studios: HSE investigation report","publisher":"UK Health and Safety Executive","url":"https://press.hse.gov.uk/wp-content/uploads/HSE-Investigation-report.pdf","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"","accessed_at":"2026-08-02","claims_supported":["A manually cued computerized hydraulic stage door struck and seriously injured a performer during rehearsal.","The system had a dead-man pedal and emergency stops, demonstrating that encoded control and safeguards do not eliminate contextual, communication, and human-state hazards.","The incident supports the possible severity of erroneous assumptions around automated scenic machinery but does not document a universal verification checker."]},{"source_id":"S3","title":"Guideline for assessment of safety-related programmable control systems for universal usage in the event business (SPCUE)","publisher":"German Social Accident Insurance, Institute for Occupational Safety and Health","url":"https://www.dguv.de/ifa/forschung/projektverzeichnis/bgia_5095-2.jsp","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2016-05-02","accessed_at":"2026-08-02","claims_supported":["IEC 61508-oriented assurance for programmable safety controls was expressly adapted to theatres, musicals, concerts, and related event settings.","The guidance addresses embedded and application software, parameterization, validation, operation, maintenance, modifications, and systematic failures.","The guidance requires fitness for use to be examined in each application rather than supplying an unrestricted universal guarantee."]},{"source_id":"S4","title":"ANSI E1.42-2023 and ANSI E1.44-2014 (R2024) listings","publisher":"Entertainment Services and Technology Association Technical Standards Program","url":"https://tsp.esta.org/tsp/documents/published_docs.php","source_class":"STANDARD","publication_date":"2024-09-04","accessed_at":"2026-08-02","claims_supported":["ANSI E1.42 adds risk-assessment and risk-reduction procedures for entertainment lifts.","ANSI E1.44 defines common show-file requirements and integrated-software design guidance for processor-based stage-machinery control systems.","Show-file portability must account for differences in physical conditions, machinery inventories, consoles, and data topology."]},{"source_id":"S5","title":"ANSI E1.6-1—2021: Powered Hoist Systems","publisher":"Entertainment Services and Technology Association","url":"https://tsp.esta.org/tsp/documents/docs/ANSI%20E1.6-1%20-%202021.pdf","source_class":"STANDARD","publication_date":"2021-01-26","accessed_at":"2026-08-02","claims_supported":["Stage-hoist safety uses travel limits, independently constrained operation, qualified-person authority, inspection, testing, interlocks, emergency stops, and operational-limit labeling.","The standard permits some SIL3-certified software limits but does not permit an encoder to replace the ultimate-limit sensor.","Systems must be retested after installation, mishap, repair, or modification."]},{"source_id":"S6","title":"IEC 61508-3:2010—Functional safety of electrical/electronic/programmable electronic safety-related systems, Part 3","publisher":"International Electrotechnical Commission","url":"https://webstore.iec.ch/en/publication/5517","source_class":"STANDARD","publication_date":"2010-04-30","accessed_at":"2026-08-02","claims_supported":["Safety functions and systematic capability must be specified.","The standard requires lifecycle activities, validation information, fault-avoidance and fault-control measures, configuration management, operating and maintenance procedures, and controls for software modification.","Safety assurance is scoped to specified safety-related systems and functions rather than arbitrary theatrical behavior."]},{"source_id":"S7","title":"What is loop unwinding?","publisher":"CBMC Project","url":"https://model-checking.github.io/cbmc-training/faq/loop-unwinding.html","source_class":"OFFICIAL_PRODUCT_DOCUMENTATION","publication_date":"","accessed_at":"2026-08-02","claims_supported":["Bounded model checking examines executions only to an explicit bound unless completeness is established.","An insufficient bound can miss a defect occurring after the bound.","CBMC provides unwinding assertions to expose when complete unwinding has not been demonstrated, closely supporting the candidate's requirement not to relabel bounded incompleteness as SAFE."]},{"source_id":"S8","title":"UPPAAL Features","publisher":"UPPAAL","url":"https://uppaal.org/features/","source_class":"OFFICIAL_PRODUCT_DOCUMENTATION","publication_date":"","accessed_at":"2026-08-02","claims_supported":["UPPAAL verifies invariant and reachability properties for nondeterministic real-time models with finite control structure, bounded data, and explicit environment assumptions.","Simulation and model checking are distinct modes, and diagnostic traces can explain results.","The tool provides a technically credible basis for exact checking of a deliberately constrained score-and-environment model."]  
    }  ]  ,"problem_evidence":{"support":"NOT_FOUND","rationale":"The opened sources establish that responsive programmable theatre systems exist and that automation failures can seriously injure performers, but none documents the candidate's defining failure: a theatre company claiming a terminating safe/unsafe checker for arbitrary interactive scores or coercing timeout, abstraction failure, or out-of-scope results into Boolean conclusions. Existing standards instead emphasize specified functions, bounded operating limits, application-specific validation, physical safeguards, inspection, and qualified human authority.","source_ids":["S1","S2","S3","S5","S6"]},"stakeholder_evidence":{"support":"MODERATE","rationale":"Regulatory guidance and entertainment standards establish concrete safety duties and decision roles for employers, venue controllers, qualified machinery personnel, manufacturers, and operators. They demonstrate stakeholder concern about automation safety and change control, but no source shows demand, budget, or a committed adopter for this particular formal scope-routing intervention.","source_ids":["S2","S3","S4","S5","S6"]},"prior_art":{"proximity":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"DGUV SPCUE application of IEC 61508 to event-industry programmable control","similarity":"Already transfers scoped software-safety specification, validation, parameterization, modification testing, operation, and maintenance into theatres and other entertainment settings.","remaining_difference":"It does not publicly describe mechanically routing programmable performance scores between an exact decidable fragment and weaker abstract or bounded analyses, nor the proposed UNKNOWN, TIMEOUT, and OUT_OF_SCOPE verdict vocabulary.","source_ids":["S3","S6"]},{"name":"UPPAAL finite-control real-time model checking","similarity":"Provides exact invariant and reachability analysis for explicit real-time system and environment models with finite control and bounded data, closely matching the proposed exact fragment.","remaining_difference":"It is a general verification environment, not a theatre-score admission checker or stage-management evidence workflow; model fidelity and fragment membership would still have to be engineered and validated.","source_ids":["S8"]},{"name":"CBMC bounded checking with unwinding assertions","similarity":"Implements an explicitly bounded fallback and detects when the chosen bound does not establish completeness, directly paralleling the requirement not to convert incomplete search into SAFE.","remaining_difference":"It does not supply theatre semantics, environmental abstraction, production authority, artist consent, or automatic routing among guarantee levels.","source_ids":["S7"]},{"name":"Entertainment stage-machinery standards and common show files","similarity":"Existing standards already require risk assessment, explicit operational limits, integrated-software design guidance, qualified-person control, interlocks, emergency stops, inspection, testing, and retesting after modification.","remaining_difference":"They do not establish formal termination or forbidden-state proofs for sensor-responsive performance scores or the proposed labeled analysis fallbacks.","source_ids":["S4","S5"]}],"distinctive_claim_remaining":"For a theatre company with an actual programmable score checker, mechanically enforced classification into a documented finite score-and-environment fragment, combined with exact checking inside that fragment and explicitly labeled weaker results elsewhere, will reduce unsupported Boolean conclusions and expose semantic or scope mismatches relative to current rehearsal review. The remaining difference is an integration and workflow claim, not a new model-checking principle or world-novelty claim.","confidence":"MODERATE"},"implementation_evidence":{"support":"MODERATE","rationale":"UPPAAL and CBMC demonstrate that finite-control exact checking, explicit environment modeling, bounded checking, counterexample generation, and incomplete-unwinding detection are available. Theatre standards demonstrate machine-readable show files, software-controlled machinery, limits, interlocks, and change-triggered testing. Implementation remains contingent on a precise score semantics, enforceable membership, faithful performer and sensor abstractions, and interfaces that cannot bypass established safeguards.","source_ids":["S3","S4","S5","S7","S8"]},"scores":{"meaningful_impact":{"score":4,"rationale":"Automated stage machinery can cause severe performer injury, and standards impose extensive safeguards. Impact would be meaningful if unsupported SAFE outputs influence decisions, but the alleged checker behavior has not been observed.","source_ids":["S2","S5"]},"stakeholder_pull":{"score":2,"rationale":"Safety assurance and risk control have clear institutional pull, but no request, procurement signal, incident tied to verifier overclaim, or willing pilot partner for this intervention was found.","source_ids":["S3","S4","S5"]},"incremental_advantage":{"score":3,"rationale":"Preserving boundedness and unresolved outcomes adds assurance beyond scenario rehearsal alone, but scoped lifecycle validation, operational limits, interlocks, and incomplete-bound detection are already established practices. Advantage must be demonstrated in actual production decisions.","source_ids":["S3","S5","S6","S7"]},"distinctiveness_plausibility":{"score":2,"rationale":"The technical ingredients and much of the assurance governance are established. Only the theatre-score-specific admission router, verdict vocabulary, and coupled artistic and stage-management workflow remained unmatched in this bounded search.","source_ids":["S3","S4","S5","S6","S7","S8"]},"technical_implementability":{"score":3,"rationale":"Existing verification engines and standardized stage-control artifacts make an offline prototype credible, but domain-faithful semantics and abstractions are substantial multidisciplinary tasks and could invalidate conclusions.","source_ids":["S1","S4","S7","S8"]},"adoption_authority_feasibility":{"score":4,"rationale":"Regulatory and standards sources identify credible employer, venue, manufacturer, operator, and qualified-person authority, and the candidate preserves physical safeguards. Artistic alteration still requires separately negotiated artist authority.","source_ids":["S3","S4","S5","S6"]},"evidence_readiness":{"score":3,"rationale":"A responsive-theatre substrate, mature model-checking tools, and explicit standard controls support a bounded offline study. No target checker, historical output set, score-language specification, or committed production corpus is yet evidenced.","source_ids":["S1","S4","S7","S8"]},"safety_net_benefit":{"score":5,"rationale":"Prohibiting SAFE for incomplete or out-of-scope analysis and retaining emergency stops, ultimate limits, inspections, retesting, and qualified human authority provides a strong defense against the tool acquiring unsupported operational authority.","source_ids":["S3","S5","S6","S7"]},"scalability":{"score":2,"rationale":"Verification engines and show-file concepts are reusable, but physical configurations, score semantics, sensors, performer assumptions, safety functions, and change-validation obligations vary by production and venue.","source_ids":["S1","S4","S5","S6","S8"]}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Read-only audit of one production's claims, documentation, historical outputs, and decisions, followed only if warranted by an offline ten-score comparison with seeded unsafe and semantic-mismatch cases. Includes formal-methods, automation, stage-management, safety, artist and performer consultation; artifact and log preparation; software configuration; confidentiality controls; blinded evaluation; and reporting.","confidence":"LOW","assumptions":["Existing scores, logs, checker outputs, and rehearsal traces are accessible.","Open-source or existing verification licenses suffice.","No machinery is actuated and no public performance is involved.","The range is a resource-equivalent estimate; no direct theatre-verification price source was found."],"source_ids":["S1","S3","S7","S8"]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"One-company production-grade score semantics, parser, mechanical fragment-membership enforcement, exact and bounded-analysis routing, evidence versioning, operator interface, stage-control integration, security and functional-safety review, validation, training, and documentation.","confidence":"LOW","assumptions":["One principal score language and automation stack are covered.","Existing machinery, ultimate limits, emergency stops, and interlocks remain separate and unchanged.","The verifier remains advisory rather than independently safety-certified.","Specialist engineering, coordination, and validation labor dominate cost."],"source_ids":["S3","S4","S5","S6","S8"]},"operational_launch":{"band_2026_usd":"50K_TO_250K","scope":"Non-live advisory launch across an initial production cohort, including per-score and environment modeling, acceptance testing, rehearsal-trace comparison, staff training, artist consultation, override and incident procedures, evaluation, and independent safety review.","confidence":"LOW","assumptions":["Core software exists from startup work.","No output can actuate machinery or bypass stage-management approval.","Several productions require individual model and change review.","Major machinery replacement and formal product certification are excluded."],"source_ids":["S3","S4","S5","S6"]},"annual_recurring":{"band_2026_usd":"50K_TO_250K","scope":"Per-production onboarding, semantic and abstraction review, software and data maintenance, access control, evidence retention, staff training, incident and override review, audits, and revalidation after score, sensor, machinery, or guarantee changes.","confidence":"LOW","assumptions":["A small or midsize company uses one principal technical stack.","Physical inspections, rehearsals, maintenance, and interlock testing continue as separate obligations.","Expansion to incompatible venues or safety certification could raise the band.","The range is not based on direct vendor pricing."],"source_ids":["S3","S4","S5","S6"]}},"verified_pipeline_gates":{"externally_supported_problem":{"status":"NO","reason":"No opened source documents a universal terminating theatre-score checker, reliance on such a claim, or Boolean coercion of timeout and out-of-scope cases. Adjacent sources establish only the substrate and potential severity.","source_ids":["S1","S2","S3","S5"]},"externally_credible_adopter_or_authorizer":{"status":"YES","reason":"Employers and people controlling theatre premises have safety duties, while standards assign installation, inspection, testing, modification, and operation to qualified or authorized people. These support production safety and stage-management authority as credible authorizers.","source_ids":["S3","S4","S5","S6"]},"distinct_testable_incremental_claim":{"status":"YES","reason":"The remaining claim can be compared against baseline review: enforced scope routing and non-Boolean unresolved results should reduce unsupported Boolean classifications and reveal scope or semantic mismatches without missing witnessed behavior.","source_ids":["S3","S7","S8"]},"bounded_next_evidence_step":{"status":"YES","reason":"A read-only workflow audit followed conditionally by an offline, blinded ten-score comparison is finite, non-live, reversible, and includes both a problem falsifier and intervention falsifiers.","source_ids":["S1","S3","S7","S8"]},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"The proposed evidence step does not control machinery; emergency stops, ultimate limits, interlocks, inspections, and qualified human authority remain controlling safeguards.","source_ids":["S2","S5","S6"]},"credible_cost_scope_and_range":{"status":"YES","reason":"The broad bands include relevant specialist labor, data handling, software, equipment interfaces, safety and compliance review, artistic coordination, training, and evaluation. Confidence is low because no direct theatre-specific formal-verification cost data were located.","source_ids":["S3","S4","S5","S6","S8"]}},"next_evidence_step":"At one identified company, conduct a read-only audit of the checker specification and 20–30 historical outputs and readiness decisions, stratified across completed analyses, timeouts, abstraction or model failures, score changes, and out-of-scope inputs. Falsify the problem if current practice already carries explicit scope, bound, assumption, and unresolved-status records into manual decisions. Only if Boolean coercion is observed, perform an offline blinded comparison on ten representative scores plus seeded unsafe and semantic-mismatch variants: baseline expert review versus mechanically enforced fragment checking with labeled bounded or unresolved fallbacks. Halt on any false SAFE, missed witnessed behavior, unenforceable fragment membership, or unauthorized score rewriting; continue only if unsupported Boolean classifications fall without worsening false-SAFE performance.","blocking_evidence":["Direct evidence that a theatre company makes or operationally relies on the alleged universal total-checker claim.","A complete specification of the accepted score language, execution semantics, environment, quantifiers, and checked property, including whether operational inputs are already finite.","Historical evidence showing how timeouts, model failures, score changes, and out-of-scope cases are labeled and used.","A representative score corpus and witnessed traces sufficient to test abstraction fidelity.","Prespecified thresholds for false SAFE, false UNSAFE, unsupported Boolean classification, unresolved rate, override frequency, and production-decision changes.","Evidence that routine artistic practices fit the fragment and that membership cannot be bypassed or achieved through unauthorized rewriting.","Direct labor or procurement evidence to tighten the low-confidence cost bands."],"research_disposition":"PROBLEM_PREVALENCE_STUDY","world_novelty_boundary":"This bounded search found theatre-specific programmable-control assurance, stage-machinery software and safety standards, finite-control model checking, bounded checking with explicit completeness tests, and responsive-theatre research. It did not locate a single public implementation of the exact theatre-score admission router and UNKNOWN/TIMEOUT/OUT_OF_SCOPE workflow. That absence is not a world-novelty finding; proprietary automation systems, patents, non-indexed production documentation, and the full academic literature were not exhaustively searched."}