{"schema_version":1,"research_id":"eoa_inverse_innovation_exp03_external48_20260801","source_assessment_id":"eoa_inverse_innovation_exp03_opportunity320_20260801","cell_id":"computability_boundary_mapping__performing_arts_theatre","selection_stratum":"MIDDLE_BAND_AUDIT_Q3","search_queries":["site:etcp.esta.org entertainment rigging automation safety standard theatre machinery official","site:etcconnect.com Eos show control programming manual triggers sensors official","theatre automation safety SIL formal verification stage machinery standard official","model checking three valued unknown timeout sound abstraction formal verification official paper","formal verification theatre stage automation cue system model checking","interactive performance formal verification stage cues theatre software safety","theatre automation software previsualization collision detection safety official product","site:ta.co.at stage automation safety simulation cues official","EN 17206 official standard stage machinery safety requirements inspections 2020","site:esta.org ANSI E1.44 stage machinery common show file standard","site:research.microsoft.com may must abstraction three valued unknown model checking PDF Godefroid 2013","stage automation safety standard rehearsal emergency stop theatre official guidance"],"sources":[{"source_id":"S1","title":"Program and operate automation and stage machinery for theatre and live productions (SKSTTL24)","publisher":"UK National Occupational Standards / ScreenSkills","url":"https://www.ukstandards.org.uk/en/nos-finder/SKSTTL24/program-and-operate-automation-and-stage-machinery-for-theatre-and-live-productions","source_class":"STANDARD","publication_date":"2025","accessed_at":"2026-08-02","claims_supported":["Theatre automation work includes programming cues and states and operating stage machinery safely during rehearsals and performances.","Practitioners are expected to understand system functions and limitations, test programming, document outcomes, report unresolved irregularities, isolate equipment when required, and follow organizational safety protocols."]},{"source_id":"S2","title":"Eos Family Show Control: System > Show Control","publisher":"Electronic Theatre Controls, Inc.","url":"https://www.etcconnect.com/WebDocs/Controls/EosFamilyOnlineHelp/en/Content/07_Setup/01_System/System_Show_Control.htm","source_class":"OFFICIAL_PRODUCT_DOCUMENTATION","publication_date":"2026","accessed_at":"2026-08-02","claims_supported":["A deployed theatrical control platform accepts MIDI, timecode, serial, network-string, and analog inputs.","External inputs can trigger event-list actions, while cue or macro activity can trigger external relay outputs."]},{"source_id":"S3","title":"May/Must Abstraction-Based Software Model Checking for Sound Verification and Falsification","publisher":"Microsoft Research","url":"https://www.microsoft.com/en-us/research/publication/maymust-abstraction-based-software-model-checking-for-sound-verification-and-falsification/","source_class":"PRIMARY_RESEARCH","publication_date":"2013-10","accessed_at":"2026-08-02","claims_supported":["Three-valued abstractions explicitly represent properties as true, false, or unknown.","May/must abstraction and generalized model checking provide established technical precedent for preserving inconclusive verification results rather than forcing Boolean answers."]},{"source_id":"S4","title":"Formal Verification for Node-Based Visual Scripts Using Symbolic Model Checking","publisher":"arXiv","url":"https://arxiv.org/abs/2103.11618","source_class":"PRIMARY_RESEARCH","publication_date":"2021-03-22","accessed_at":"2026-08-02","claims_supported":["Node-based visual scripts can be translated automatically into finite-state NuSMV models and checked against temporal properties.","The method generates counterexamples but identifies state-space growth, incomplete external-behavior modeling, and abstraction soundness as limitations.","The reported preliminary evaluation covered eight production visual scripts containing 1,178 nodes."]},{"source_id":"S5","title":"Published Technical Standards Program Documents","publisher":"Entertainment Services and Technology Association","url":"https://tsp.esta.org/tsp/documents/published_docs.php","source_class":"STANDARD","publication_date":"2026-07-16","accessed_at":"2026-08-02","claims_supported":["ANSI E1.44-2014 (R2024) already standardizes common show-file requirements and minimum software-design guidance for automated stage-machinery control systems.","ANSI E1.64-2024 addresses common elements of stage-machinery control-system design, operation, maintenance, and practice.","Existing entertainment standards cover risk reduction, inspection, control systems, performer flying, and stage machinery rather than supporting an unrestricted universal score-verification claim."]},{"source_id":"S6","title":"DIN EN 17206:2022-02 — Entertainment technology — Machinery for stages and other production areas — Safety requirements and inspections","publisher":"DIN Media","url":"https://www.dinmedia.de/en/standard/din-en-17206/347804636","source_class":"STANDARD","publication_date":"2022-02","accessed_at":"2026-08-02","claims_supported":["A current theatre-specific machinery standard covers safety requirements and inspections for machinery used on stages and other production areas.","Formal score analysis would enter an existing safety-assurance environment rather than replace applicable machinery controls and inspections."]},{"source_id":"S7","title":"ISO 13850:2015 — Safety of machinery — Emergency stop function — Principles for design","publisher":"International Organization for Standardization","url":"https://www.iso.org/standard/59970.html","source_class":"STANDARD","publication_date":"2015-11","accessed_at":"2026-08-02","claims_supported":["Emergency stopping is an independently specified machinery safety function with defined design principles.","A score checker should not be treated as a substitute for physical emergency-stop and machinery-safety functions."]},{"source_id":"S8","title":"Stage Control","publisher":"State Automation","url":"https://stateautomation.com/products/stage-control/","source_class":"COMMERCIAL_FIRST_PARTY","publication_date":"n.d.","accessed_at":"2026-08-02","claims_supported":["Commercial theatre automation already includes redundant safety supervision that monitors processor activity and prevents motion on indicated unsafe internal or external conditions.","Commercial systems also provide recorded movement replay and sensor-based abnormal-load stopping, demonstrating adjacent runtime monitoring and safety prior art."]}],"problem_evidence":{"support":"WEAK","rationale":"Official and first-party sources verify the enabling substrate: programmable cue states, external sensor and protocol inputs, machinery outputs, safety-critical operation, testing, documentation, and system limitations. The bounded search found no source documenting the candidate's central empirical premise that a theatre company claims or relies on a terminating safe/unsafe checker for arbitrary interactive scores, or that UNKNOWN, timeout, abstraction failure, and out-of-scope cases are currently coerced into Boolean conclusions.","source_ids":["S1","S2","S5","S6","S8"]},"stakeholder_evidence":{"support":"MODERATE","rationale":"The occupational standard assigns automation personnel responsibility for safe operation, testing, documentation, reporting unresolved problems, and following organizational protocols; theatre machinery standards confirm an established safety-assurance context. These sources support credible internal safety and operational stakeholders, but they do not establish that a specific production safety lead or stage manager has authority to approve reliance on the proposed verifier at the target company.","source_ids":["S1","S5","S6"]},"prior_art":{"proximity":"SUBSTANTIAL_COLLISION","closest_analogues":[{"name":"May/must three-valued abstraction and generalized model checking","similarity":"It already combines abstraction-based verification with explicit true, false, and unknown outcomes, closely matching the proposed refusal to force inconclusive abstractions into a Boolean answer.","remaining_difference":"The candidate's remaining testable difference is an enforceable theatre-score fragment plus explicit TIMEOUT and OUT_OF_SCOPE routing, versioned production evidence, and stage-management reliance rules; the search found no theatre deployment evaluation of that complete workflow.","source_ids":["S3"]},{"name":"Symbolic model checking for node-based visual scripts","similarity":"It automatically translates production visual scripts into finite-state models, checks temporal properties, and returns counterexamples while acknowledging external-behavior and state-space limitations.","remaining_difference":"The published application concerns game-development scripts, not sensor-responsive theatrical scores, machinery and performer environment models, enforceable fragment membership, or production-facing unresolved-result labels.","source_ids":["S4"]},{"name":"ANSI E1.44/E1.64 stage-machinery control and show-file standards","similarity":"These standards already cover processor-based stage-machinery control software, common show-file data, and control-system design and operational practices in entertainment venues.","remaining_difference":"The opened summaries do not show exact finite-state score checking, three-valued abstraction, or guarantee-aware UNKNOWN, TIMEOUT, and OUT_OF_SCOPE routing; full-text comparison and implementation audits remain necessary.","source_ids":["S5"]},{"name":"Commercial redundant safety supervision and sensor-based motion stopping","similarity":"A theatre-specific commercial system monitors controller execution and external conditions, blocks motion on unsafe indications, and uses load sensors to stop abnormal movement.","remaining_difference":"This is runtime machinery supervision rather than pre-performance verification of arbitrary interactive score termination or reachability, and the documentation does not claim the proposed scope contract or unresolved-result taxonomy.","source_ids":["S8"]}],"distinctive_claim_remaining":"For one theatre stack, mechanically enforce a documented finite score-and-environment fragment; apply exact checking only within it; route other cases to explicitly weaker bounded or abstract analysis; preserve UNKNOWN, TIMEOUT, and OUT_OF_SCOPE in production review; and test whether that workflow reduces unsupported Boolean conclusions or reveals scope mismatches relative to ordinary review. This is a bounded, testable theatre-integration claim, not a claim that the underlying verification concepts are new.","confidence":"HIGH"},"implementation_evidence":{"support":"MODERATE","rationale":"Primary research demonstrates finite-state translation and symbolic checking for production visual scripts and established three-valued abstraction semantics. Theatre documentation confirms that actual control stacks expose cue, timecode, network, analog, and relay interfaces that could be modeled. Implementability remains conditional because no source validates a faithful performer, machinery, and environment semantics for the candidate system, and the visual-script study explicitly identifies abstraction soundness and state-space growth as limitations.","source_ids":["S2","S3","S4"]},"scores":{"meaningful_impact":{"score":4,"rationale":"If operational reliance on a false SAFE result exists, consequences could involve performers, crew, audiences, and moving machinery. Existing theatre safety standards and commercial redundant supervision confirm that these hazards are treated seriously, but the frequency of the alleged checker failure is unverified.","source_ids":["S1","S6","S7","S8"]},"stakeholder_pull":{"score":2,"rationale":"External standards create incentives for safe operation, testing, documentation, and escalation, but the search found no theatre request, adopter commitment, budget, incident report, or expressed demand for formal computability-boundary routing.","source_ids":["S1","S5","S6"]},"incremental_advantage":{"score":3,"rationale":"Explicit unresolved outcomes can add information that rehearsal coverage or a watchdog cannot provide, and three-valued model checking supplies a credible mechanism. Advantage over existing standards, testing, runtime supervision, and manual authority is still hypothetical and depends on finding actual false Boolean conclusions.","source_ids":["S1","S3","S5","S8"]},"distinctiveness_plausibility":{"score":2,"rationale":"Three-valued abstraction, finite-state visual-script checking, stage-control standards, and commercial safety supervision create substantial prior-art overlap. The remaining theatre-specific routing and governance bundle is testable but not externally demonstrated as distinctive.","source_ids":["S3","S4","S5","S8"]},"technical_implementability":{"score":3,"rationale":"The constituent methods exist, but a trustworthy implementation requires explicit score semantics, enforceable fragment membership, faithful environment abstraction, state-space control, integration, and validation against physical traces.","source_ids":["S2","S3","S4"]},"adoption_authority_feasibility":{"score":3,"rationale":"The occupational standard supports organizational protocols, responsible escalation, and equipment isolation, making an internal approval path plausible. Exact authority for verifier reliance and artistic changes remains company-specific and externally unverified.","source_ids":["S1","S6"]},"evidence_readiness":{"score":2,"rationale":"Methods and safety baselines are documented, but there is no target-company checker documentation, output corpus, language specification, incident history, or pilot result. Those omissions prevent immediate evaluation of the core premise.","source_ids":["S1","S3","S4","S5"]},"safety_net_benefit":{"score":4,"rationale":"Preserving inconclusive results is technically grounded, while retaining manual authority, machinery controls, and emergency stopping is consistent with external safety practice. Benefit remains unmeasured and could be undermined by overrides or model omissions.","source_ids":["S1","S3","S7","S8"]},"scalability":{"score":2,"rationale":"The routing pattern is reusable in principle, but venue-specific show files, control topology, physical conditions, score semantics, sensors, and machinery models imply substantial per-stack and per-production work.","source_ids":["S2","S4","S5"]}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Audit one planned production's claims, checker outputs, timeouts, changed scores, authority decisions, and available traces; if the premise survives, specify and dry-run ten representative scores plus seeded unsafe variants against baseline expert review, exact checking, finite abstraction, and bounded search.","confidence":"LOW","assumptions":["Includes formal-methods, automation-engineering, stage-management, safety, artist, data-curation, coordination, and evaluation labor.","Existing score artifacts, logs, rehearsal hardware, interlocks, and product interfaces are available without major procurement.","No pilot output controls live machinery or replaces physical safety functions.","The range is a resource-equivalent estimate; the sources establish required work domains but do not publish project prices."],"source_ids":["S1","S2","S3","S4","S7"]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"Develop production-grade score semantics, fragment-membership enforcement, exact and fallback analyzers, versioned evidence records, operator interfaces, integration, validation, training, and independent safety review for one principal venue stack.","confidence":"LOW","assumptions":["Covers one score language and one principal control topology rather than heterogeneous touring systems.","Includes software engineering, formal modeling, test-data development, multidisciplinary validation, cybersecurity and access controls, documentation, training, and coordination.","Existing certified machinery controls, inspections, emergency stops, and manual authority remain separately funded and operational.","No regulatory certification cost beyond an independent safety and compliance review is assumed."],"source_ids":["S1","S2","S4","S5","S6","S7"]},"operational_launch":{"band_2026_usd":"50K_TO_250K","scope":"Advisory launch across a small initial production cohort, including score onboarding, environment-model review, witnessed rehearsal comparison, operator training, incident procedures, artist consultation, and monitored decision-use evaluation.","confidence":"LOW","assumptions":["Core tooling exists from startup work.","Several productions require individual modeling and trace review.","No autonomous machinery authorization is included.","Any score alteration requires artist approval and re-verification."],"source_ids":["S1","S2","S5","S6"]},"annual_recurring":{"band_2026_usd":"50K_TO_250K","scope":"Ongoing specialist review, software and semantics maintenance, per-production onboarding, evidence retention, training, access-control maintenance, incident review, and periodic safety reassessment for one theatre company.","confidence":"LOW","assumptions":["A limited number of productions use one principal technical stack each year.","Score, sensor, machinery, interface, or guarantee changes trigger renewed scope and model review.","Major machinery replacement, certification programs, and expansion to incompatible venues are excluded.","Rehearsal, inspections, emergency stops, manual authority, and other established safeguards continue."],"source_ids":["S1","S2","S5","S6","S7"]}},"verified_pipeline_gates":{"externally_supported_problem":{"status":"UNCERTAIN","reason":"External evidence verifies programmable, safety-relevant theatre automation and known verification limitations, but no opened source establishes an actual universal checker claim, operational reliance on such a claim, or Boolean coercion of unresolved results at the target company.","source_ids":["S1","S2","S3","S4","S8"]},"externally_credible_adopter_or_authorizer":{"status":"UNCERTAIN","reason":"Organizational safety protocols, responsible-person escalation, and automation-operator duties are externally credible, but the target company's precise approval authority for formal-verifier reliance and artistic modification has not been documented.","source_ids":["S1","S6"]},"distinct_testable_incremental_claim":{"status":"YES","reason":"The incremental claim is measurable: compared with baseline review, enforceable routing and unresolved labels should reduce unsupported Boolean classifications or reveal additional scope and assumption mismatches. Three-valued abstraction and finite-state script checking make the comparison technically credible.","source_ids":["S3","S4"]},"bounded_next_evidence_step":{"status":"YES","reason":"A one-production audit followed only conditionally by a ten-score offline rehearsal comparison is bounded, non-public, reversible, and falsifiable without granting control authority to the verifier.","source_ids":["S1","S4","S7"]},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"The proposed step is offline and advisory; existing organizational procedures, machinery controls, isolation, and emergency-stop functions remain authoritative. Any false SAFE or semantic mismatch halts the study before operational reliance.","source_ids":["S1","S6","S7","S8"]},"credible_cost_scope_and_range":{"status":"YES","reason":"The ranges include the labor, software, data, equipment access, coordination, safety review, training, and evaluation implied by the documented control interfaces and formal-method limitations. They remain low-confidence because no source reports directly comparable theatre-project costs.","source_ids":["S1","S2","S4","S5","S6","S7"]}},"next_evidence_step":"For one planned production, run a two-stage non-public study with no live-control authority. First, audit up to 20 current or archived checker cases and classify completed results, timeouts, abstraction failures, changed scores, and out-of-scope inputs against documentation and actual readiness decisions. Falsify the problem if every inconclusive case already retains an explicit bounded or unresolved label, scope-linked evidence, and manual authority. Only if the problem survives, prespecify false-SAFE, false-UNSAFE, missed-behavior, scope-mismatch, override, and decision-change measures, then compare baseline expert review with exact-fragment checking, finite abstraction, and bounded search on ten representative scores plus seeded unsafe variants. Halt on any false SAFE or model-to-trace mismatch; continue only if the routed method reduces unsupported Boolean conclusions without excluding a prespecified share of routine score practices.","blocking_evidence":["Direct evidence that a theatre company claims or operationally relies on a universal terminating safe/unsafe checker.","The accepted score language, execution semantics, environmental inputs, quantifiers, and checked property, including whether all relevant domains are already finite.","A corpus showing how completed checks, timeouts, abstraction failures, changed scores, and out-of-scope inputs are currently labeled and used in readiness decisions.","A checked correspondence between the formal model and relevant performer, sensor, cue, and machinery behavior.","Prespecified comparison thresholds and pilot results for false SAFE, false UNSAFE, missed behavior, scope mismatch, override, and production-decision change.","Evidence that fragment membership is enforceable and includes enough routine artistic practice to be useful.","Full-text and implementation-level comparison with relevant stage-control standards and commercial systems.","Target-company documentation identifying who may approve verifier reliance, stop work, and authorize artistic changes.","Direct cost evidence from a comparable theatre verification and integration project."],"research_disposition":"PROBLEM_PREVALENCE_STUDY","world_novelty_boundary":"This bounded search does not establish or imply world novelty, and no world-novelty conclusion is made. It found substantial adjacent and overlapping prior art in three-valued abstraction, finite-state visual-script model checking, stage-machinery control standards, and commercial safety supervision; the only remaining claim is a theatre-specific, empirically testable integration and governance difference that may disappear with fuller prior-art or target-practice evidence."}