{"schema_version":1,"research_id":"eoa_inverse_innovation_exp03_external48_20260801","source_assessment_id":"eoa_inverse_innovation_exp03_opportunity320_20260801","cell_id":"negative_space_design__systems_cybernetics","selection_stratum":"HIGH_UPSIDE_RESEARCH_OPTION","search_queries":["site:hse.gov.uk alarm systems operator alarm flooding human factors control room guidance","site:isa.org ISA-18.2 alarm shelving suppression official standard","dark cockpit philosophy normal indications extinguished abnormal aviation official","primary research alarm flood operator performance detection latency control room","site:nrc.gov NUREG-0700 alarm suppression display operator suppressed alarm status alarm history PDF","site:ntrs.nasa.gov dark cockpit annunciators extinguished normal abnormal primary systems annunciations","controlled experiment false alarm rate analyst performance cybersecurity primary paper 2023","NUREG-0700 alarm suppression temporarily suppressed alarms displayed history guideline 4.3","site:hf.tc.faa.gov Human Factors Design Standard HF-STD-001 FAA 2003"],"sources":[{"source_id":"SRC01","title":"Alarm management","publisher":"UK Health and Safety Executive","url":"https://www.hse.gov.uk/humanfactors/topics/alarm-management.htm","source_class":"OFFICIAL_GUIDANCE","publication_date":"","accessed_at":"2026-08-02","claims_supported":["Poor alarm-system design has contributed to major incidents, including a prolonged barrage of alarms before the Milford Haven refinery incident.","Alarms should direct attention to conditions requiring timely assessment or action, be relevant and actionable, and accommodate human limitations."]},{"source_id":"SRC02","title":"A Controlled Experiment on the Impact of Intrusion Detection False Alarm Rate on Analyst Performance","publisher":"arXiv","url":"https://arxiv.org/abs/2307.07023","source_class":"PRIMARY_RESEARCH","publication_date":"2023-07-13","accessed_at":"2026-08-02","claims_supported":["In a controlled experiment with 51 participants, the 86% false-alarm condition took about 40% longer than the 50% condition and had substantially lower escalation precision.","The experiment did not find a statistically significant difference in sensitivity, limiting claims that lower alarm competition necessarily reduces missed true alarms."]},{"source_id":"SRC03","title":"ISA-18 Series of Standards","publisher":"International Society of Automation","url":"https://www.isa.org/standards-and-publications/isa-standards/isa-18-series-of-standards","source_class":"STANDARD","publication_date":"","accessed_at":"2026-08-02","claims_supported":["The ISA-18 series establishes an alarm-management lifecycle including rationalization, prioritization, monitoring, dynamic alarming, and shelving.","The series treats alarm rate, standing alarms, and operator response time as monitored performance characteristics."]},{"source_id":"SRC04","title":"Control systems","publisher":"UK Health and Safety Executive","url":"https://www.hse.gov.uk/comah/sragtech/techmeascontsyst.htm","source_class":"OFFICIAL_GUIDANCE","publication_date":"","accessed_at":"2026-08-02","claims_supported":["Official guidance calls for alarm processing that prevents overload and lists grouping, first-up alarming, eclipsing, operating-mode suppression, automatic load shedding, and shelving as applicable techniques.","Suppression requires controls that restore alarms when relevant; non-actionable events may be logged instead of alarmed, with a process for assessing logged-event significance.","Alarm-system evaluation should include presentation rate, response times, workload, nuisance alarms, and operator views, and safety-related alarms should remain visible while active."]},{"source_id":"SRC05","title":"Overview of Alarm Display Suppression","publisher":"Siemens","url":"https://docs.tia.siemens.cloud/r/en-us/v20/working-with-alarms-basic-panels-panels-comfort-panels-rt-advanced-rt-professional/working-with-alarms-basic-panels-panels-comfort-panels-rt-advanced-rt-professional/configuring-the-outputting-of-alarms-basic-panels-panels-comfort-panels-rt-advanced-rt-professional/configuring-the-alarm-view-basic-panels-panels-comfort-panels-rt-advanced-rt-professional/configuring-alarm-display-suppression-basic-panels-panels-comfort-panels-rt-advanced-rt-professional/overview-of-alarm-display-suppression-basic-panels-panels-comfort-panels-rt-advanced-rt-professional","source_class":"OFFICIAL_PRODUCT_DOCUMENTATION","publication_date":"2024-11","accessed_at":"2026-08-02","claims_supported":["WinCC supports automatic plant-state-based and manual alarm-display suppression to focus attention on essential alarms.","Suppressed alarms remain logged and accessible through hidden, current, and historical views; alarms can automatically reappear after a timeout or relevant plant-state change.","Siemens warns that automatic suppression should be limited to alarms that require no operator action in the configured state."]},{"source_id":"SRC06","title":"Human Factors Design Standard, Chapter 7: Alarms, Audio, and Voice (HF-STD-001)","publisher":"U.S. Federal Aviation Administration","url":"https://hf.tc.faa.gov/hfds/download-hfds/hfds_pdfs/Ch7_Alarms_audio_and_voice.pdf","source_class":"STANDARD","publication_date":"2003-01","accessed_at":"2026-08-02","claims_supported":["FAA criteria distinguish status information from alarms, restrict filtering to alarms without current operational significance, and permit suppression of derivative alarms when tasks are not impaired.","Suppressed information should remain readily accessible, and complete system failure should itself be reported.","The standard calls for input validation, circuit testing, prioritized presentation, and avoiding auditory alarms for normal conditions."]},{"source_id":"SRC07","title":"Systems Study for an Integrated Digital/Electric Aircraft (IDEA), NASA CR-3840","publisher":"National Aeronautics and Space Administration","url":"https://ntrs.nasa.gov/api/citations/19850007405/downloads/19850007405.pdf","source_class":"PRIMARY_RESEARCH","publication_date":"1985-01","accessed_at":"2026-08-02","claims_supported":["The quiet/dark flight-deck concept reserves attention-getting annunciation for non-normal conditions rather than continuously illuminating normal status.","The proposed alerting design supplies urgency, location, nature, and corrective-action feedback while excluding conditions with no crew-awareness or action requirement."]},{"source_id":"SRC08","title":"Human-System Interface Design Review Guidelines, NUREG-0700 Revision 4","publisher":"U.S. Nuclear Regulatory Commission","url":"https://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0700/r4/index","source_class":"GOVERNMENT_OR_REGULATOR","publication_date":"2026-01","accessed_at":"2026-08-02","claims_supported":["The NRC evaluates nuclear-plant human-system interfaces for conformance with human-factors guidance.","The current review framework explicitly covers alarm systems, automation, degraded interfaces and instrumentation, and integration of interface resources."]}],"problem_evidence":{"support":"MODERATE","rationale":"Official control-room guidance recognizes alarm flooding and irrelevant alarms as threats to timely attention and requires designs that accommodate human limitations. A controlled cybersecurity experiment found slower work and lower precision at a higher false-alarm rate, although it did not find significantly lower true-alarm sensitivity. Evidence therefore supports a general alarm-competition problem but does not establish that continuously displayed routine telemetry causes delayed deviation detection in every target setting.","source_ids":["SRC01","SRC02","SRC04"]},"stakeholder_evidence":{"support":"MODERATE","rationale":"HSE, ISA, FAA, and NRC materials show established institutional responsibility for alarm load, operator performance, interface safety, and degraded-state handling; Siemens supplies corresponding commercial functionality. This demonstrates credible owner, safety, engineering, and regulator roles, but no named organization has requested or committed to evaluating this specific telemetry-wide composition.","source_ids":["SRC03","SRC04","SRC05","SRC06","SRC08"]},"prior_art":{"proximity":"ESTABLISHED_PRACTICE","closest_analogues":[{"name":"Designed suppression, alarm load shedding, shelving, and event logging","similarity":"HSE and ISA already describe suppressing, grouping, shedding, or declining to alarm non-actionable information while prioritizing actionable alarms, monitoring response performance, retaining logged events, and restoring suppressed alarms when relevant.","remaining_difference":"The candidate's potentially testable addition is one integrated treatment of heterogeneous routine telemetry with an explicit, independently legible reason-for-absence/liveness state and automatic reconstruction of a predefined pre-deviation context window.","source_ids":["SRC03","SRC04"]},{"name":"Siemens WinCC alarm-display suppression","similarity":"The shipping product supports state-based or manual hiding, retained logs, hidden and historical views, user reveal, and automatic reappearance after time or plant-state changes—covering most of the proposed presentation and recovery mechanics.","remaining_difference":"The documentation does not establish deviation-triggered automatic presentation of a chronological precursor package, a complete liveness/absence-cause taxonomy, or superior operator outcomes relative to ordinary suppression.","source_ids":["SRC05"]},{"name":"FAA suppressed-alarm and separate-status guidance","similarity":"FAA criteria already combine suppression of operationally insignificant or derivative alarms, easy access to suppressed information, separate status presentation, alarm-system failure indication, and reliability testing.","remaining_difference":"The candidate would need to show that its consolidated liveness framing and automatic context reintroduction add measurable benefit beyond this standards-conformant pattern.","source_ids":["SRC06"]},{"name":"Quiet/dark flight-deck philosophy","similarity":"Normal operation is deliberately non-annunciated so that non-normal conditions have perceptual separation, closely matching protected quiescence as the active presentation mechanism.","remaining_difference":"The aircraft source does not test the candidate's telemetry-wide classifier, explicit distinctions among healthy quiet and observability failures, or automatic replay of recent hidden context.","source_ids":["SRC07"]}],"distinctive_claim_remaining":"In a heterogeneous monitoring console already using standards-conformant designed suppression and accessible history, adding an independently visible liveness/absence-cause state plus automatic, deviation-triggered reintroduction of a predefined chronological context window improves detection or diagnosis without increasing misses, precursor loss, confusion, or recovery time. This is a narrow comparative hypothesis, not a novelty claim.","confidence":"HIGH"},"implementation_evidence":{"support":"MODERATE","rationale":"Standards, regulatory guidance, and commercial documentation establish feasibility for filtering, state-based suppression, hidden and historical views, logging, automatic restoration, failure indication, and performance monitoring. They do not establish reliable classification of heterogeneous routine telemetry or safe selection of precursor context for rare and coupled incidents.","source_ids":["SRC03","SRC04","SRC05","SRC06","SRC08"]},"scores":{"meaningful_impact":{"score":4,"rationale":"Alarm overload is safety-relevant in official guidance, and controlled evidence shows that higher false-alarm burden can materially slow analysis and reduce precision. The exact effect on critical misses and real incidents remains unverified.","source_ids":["SRC01","SRC02","SRC04"]},"stakeholder_pull":{"score":3,"rationale":"Standards, regulatory review, and commercial product support demonstrate durable institutional interest in alarm-load management, but there is no adopter interview, study commitment, procurement signal, or named partner for this specific extension.","source_ids":["SRC03","SRC05","SRC08"]},"incremental_advantage":{"score":2,"rationale":"The original full-stream comparator understates existing practice: designed suppression, automatic load shedding, accessible hidden history, quiet/dark presentation, and automatic restoration already exist. Only explicit absence semantics and deviation-triggered precursor reconstruction remain plausible incremental advantages.","source_ids":["SRC04","SRC05","SRC06","SRC07"]},"distinctiveness_plausibility":{"score":2,"rationale":"The remaining integrated context-window and absence-cause claim is specific and testable, but most constituent mechanisms and much of their composition are established practice.","source_ids":["SRC04","SRC05","SRC06","SRC07"]},"technical_implementability":{"score":4,"rationale":"Commercial HMI documentation demonstrates most required interface and logging functions, while official guidance supplies implementation constraints. Classification sensitivity and context selection are the main unresolved engineering problems.","source_ids":["SRC04","SRC05","SRC06"]},"adoption_authority_feasibility":{"score":3,"rationale":"Monitoring owners and safety organizations can plausibly authorize replay or shadow evaluation, while regulated uses require formal human-factors and safety review. No concrete organization's authority map or partner approval has been verified.","source_ids":["SRC04","SRC08"]},"evidence_readiness":{"score":4,"rationale":"Alarm rate, response time, workload, misses, and operator judgments are recognized evaluation measures, and a non-live crossover can isolate the remaining incremental claim against actual prior art.","source_ids":["SRC02","SRC04","SRC06"]},"safety_net_benefit":{"score":4,"rationale":"Retained logs, accessible hidden information, separate status, explicit failure indication, restoration controls, and critical-alarm exclusions create a strong safety envelope for replay or shadow testing. They do not validate live suppression.","source_ids":["SRC04","SRC05","SRC06"]},"scalability":{"score":3,"rationale":"The pattern appears across process control, aviation, cybersecurity, and commercial HMI products, suggesting broad applicability; classification rules, liveness semantics, precursor dependencies, accessibility, and governance remain domain-specific.","source_ids":["SRC02","SRC04","SRC05","SRC06","SRC07"]}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Preregister and conduct one non-live, three-condition crossover in one operational domain, covering representative data preparation, three prototype views, seeded deviations, 24–36 target-domain participants, human-factors and safety review, participant coordination, instrumentation, accessibility checks, and analysis.","confidence":"MODERATE","assumptions":["Representative replay data can be obtained under existing permissions or safely synthesized.","The comparison includes full stream, standards-like suppression with accessible history, and the candidate's explicit liveness plus automatic context view.","No live alarms, controls, or source records are altered.","Existing workstations and ordinary software infrastructure are sufficient."],"source_ids":["SRC02","SRC04","SRC05","SRC06"]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"Build shadow-mode capability for one bounded system, including telemetry integration, classification rules, liveness and absence-cause instrumentation, context-window logic, immutable logging, security and data review, accessibility, safety analysis, operator training, validation, and rollback controls.","confidence":"LOW","assumptions":["Existing monitoring, identity, logging, and historian systems expose supported integration points.","Safety-critical alarms remain outside suppression.","The organization supplies engineering, operations, human-factors, security, compliance, and evaluation labor.","No new control-room hardware fleet is required."],"source_ids":["SRC03","SRC04","SRC05","SRC06","SRC08"]},"operational_launch":{"band_2026_usd":"1M_TO_5M","scope":"Prepare and govern controlled live use across a bounded multi-team program, including parallel operation, rare-event replay, independent safety assurance, failure-mode testing, compliance evidence, software integration, training, change management, accessibility remediation, incident monitoring, and rollback exercises.","confidence":"LOW","assumptions":["Launch is organizational or program-scale rather than national-infrastructure scale.","The system passes predefined non-inferiority thresholds for critical misses and diagnosis accuracy.","Regulatory certification beyond ordinary organizational assurance is not required; unusually regulated deployments could exceed this band.","Existing consoles, telemetry storage, and equipment are extended rather than replaced."],"source_ids":["SRC04","SRC05","SRC06","SRC08"]},"annual_recurring":{"band_2026_usd":"250K_TO_1M","scope":"Maintain classification and context policies, software and licenses, liveness checks, drift and miss monitoring, audit evidence, operator training, accessibility support, incident review, periodic replay tests, data governance, and cross-team safety oversight.","confidence":"LOW","assumptions":["Operation remains within one organization or bounded program.","Telemetry and plant states change enough to require continuing tuning and review.","No dedicated hardware refresh program is included.","Ongoing performance auditing and controlled modification follow alarm-management practice."],"source_ids":["SRC03","SRC04","SRC05","SRC08"]}},"verified_pipeline_gates":{"externally_supported_problem":{"status":"YES","reason":"Official guidance documents alarm flooding, irrelevant alarms, and human-capability limits, while controlled primary research shows higher false-alarm burden can slow analysis and reduce precision. Support is for the general problem, not universal prevalence or a proven miss-rate effect.","source_ids":["SRC01","SRC02","SRC04"]},"externally_credible_adopter_or_authorizer":{"status":"YES","reason":"Monitoring-system owners and operations or safety management are credible non-live authorizers, and official NRC material confirms regulator review of alarm, automation, degraded-interface, and integrated-HSI design in nuclear settings. A specific willing partner remains unidentified.","source_ids":["SRC04","SRC08"]},"distinct_testable_incremental_claim":{"status":"YES","reason":"After accounting for established suppression, the remaining claim can compare standards-like suppression against the same interface augmented with explicit liveness/absence causes and automatic pre-deviation context reintroduction.","source_ids":["SRC04","SRC05","SRC06"]},"bounded_next_evidence_step":{"status":"YES","reason":"A one-domain, non-live, preregistered crossover can measure detection latency, critical misses, diagnosis, false escalation, absence-state confusion, and context recovery without changing operational systems.","source_ids":["SRC02","SRC04","SRC06"]},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"For the proposed replay-only step, critical alarms can be declared unsuppressible, all source data retained, monitoring failure explicitly displayed, and the console immediately reset. This gate does not authorize shadow or live deployment.","source_ids":["SRC04","SRC05","SRC06"]},"credible_cost_scope_and_range":{"status":"UNCERTAIN","reason":"The resource bands include labor, data, software, equipment assumptions, safety, compliance, coordination, training, and evaluation, and existing products establish technical scope. No target architecture, labor rates, vendor quotation, regulatory classification, or deployment scale was available to validate the bands directly.","source_ids":["SRC03","SRC04","SRC05","SRC08"]}},"next_evidence_step":"With one monitoring-system owner, preregister a non-live Latin-square crossover using representative replay or synthetic streams and 24–36 target-domain operators. Compare (A) the current full stream, (B) standards-like designed suppression with visible suppression status and on-demand hidden/history access, and (C) the same suppression plus independently visible liveness/absence-cause states and automatic reintroduction of a predefined pre-deviation context window. Seed identical deviations, including weak and coupled precursors; make every critical deviation unsuppressible. Measure detection latency, critical misses, false escalation, diagnosis accuracy and time, context recovery, reveal use, workload, and confusion among healthy quiet, filtering, permission loss, sensor failure, network failure, and software failure. Falsify advancement if C does not beat B by a preregistered minimally important detection or diagnosis margin, or if C increases critical misses, hides any seeded critical event, impairs diagnosis/context recovery, or increases absence-state confusion.","blocking_evidence":["No setting-specific study shows that routine non-alarm telemetry density independently predicts delayed detection or diagnosis after accounting for severity, staffing, interface quality, and sensor adequacy.","No evidence shows that explicit liveness and automatic precursor-context reconstruction outperform existing designed suppression with accessible hidden and historical views.","Sensitivity for weak, interacting, low-grade, and novel precursors has not been established for any proposed routine-versus-actionable classifier.","Operators have not demonstrated reliable discrimination among healthy quiet, intentional filtering, permission loss, sensor failure, network failure, and interface failure.","Transfer from seeded replay to rare, prolonged, coupled, or novel incidents remains unknown.","No concrete adopter, authority map, architecture inventory, vendor quotation, or regulatory classification validates the deployment cost bands."],"research_disposition":"KNOWN_PRACTICE_DIFFUSION","world_novelty_boundary":"This bounded search found established quiet/dark presentation, filtering, designed suppression, automatic load shedding, logging, readily accessible suppressed history, separate status indication, failure annunciation, and automatic restoration in official guidance, standards, research, and commercial documentation. It did not exhaust patents, proprietary implementations, every industry, or non-English literature. Accordingly, ESTABLISHED_PRACTICE describes proximity within this search only; it is not a world-novelty determination. The only remaining research claim is the comparative value of explicit absence/liveness semantics plus deviation-triggered chronological context reconstruction across heterogeneous telemetry."}