{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"deadweight_loss_reduction__systems_cybernetics","opaque_id":"deadweight_loss_reduction__systems_cybernetics__A","search_lanes":{"direct_problem":{"queries":["fixed conservative actuator limits state dependent safety envelope control plant reference governor","dynamic safety envelope process control state-dependent constraints","industrial product dynamic operating envelope control constraints process plant real-time optimization safety envelope","Honeywell dynamic operating envelope process control constraint limits"],"source_ids":["SRC2","SRC3","SRC5"],"no_result_note":null},"closest_prior_art":{"queries":["reference governor survey 1998 constraint management maximal output admissible set Gilbert Kolmanovsky","explicit reference governor constraint management industrial control actuator limits","command governor state dependent constraints constrained control systems survey","control barrier function safety filter actuator constraints industrial systems"],"source_ids":["SRC1","SRC2","SRC4","SRC5"],"no_result_note":null},"historical_terminology":{"queries":["reference governor survey 1998 constraint management maximal output admissible set Gilbert Kolmanovsky","command governor state dependent constraints constrained control systems survey","formal verification reference governor safety constraints fallback control system invariant model checking","runtime assurance simplex architecture verified safety controller fallback plant control"],"source_ids":["SRC1","SRC6","SRC8"],"no_result_note":null},"products_practices_standards":{"queries":["Honeywell dynamic operating envelope process control constraint limits","Siemens process control state-dependent constraints safety envelope","Enforce Safety Constraints with Control Barrier Functions MATLAB Simulink","site:iec.ch IEC 61511-1 2016 functional safety process industry official"],"source_ids":["SRC3","SRC4","SRC7"],"no_result_note":null},"non_english_regional":{"queries":["\"gouverneur de référence\" commande contraintes système","\"Referenz-Governor\" Regelung Beschränkungen","\"governador de referência\" controle restrições","\"gobernador de referencia\" control restricciones"],"source_ids":["SRC7","SRC8"],"no_result_note":null},"composition_subproblems":{"queries":["formal verification reference governor safety constraints fallback control system invariant model checking","runtime assurance simplex architecture verified safety controller fallback plant control","reachability analysis safety filter actuator constraints fallback controller verified","shadow mode evaluation adaptive control envelope industrial plant"],"source_ids":["SRC2","SRC4","SRC5","SRC6","SRC7"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"Reference and Command Governors for Systems with Constraints: A Survey on Theory and Applications","url":"https://www.merl.com/publications/TR2016-102","publisher":"Mitsubishi Electric Research Laboratories; published in Automatica/Elsevier","date_or_year":"2017 (MERL record dated August 2016)","source_type":"SECONDARY_RESEARCH","language":"English","claims_supported":["Reference and command governors are established add-on schemes that modify references only when needed to enforce state and control constraints.","The literature covers linear and nonlinear systems, uncertainty, distributed variants, practical applications, model predictive control, and input shaping.","The core state-aware constraint-management lever predates the proposal and has an extensive literature."]},{"source_id":"SRC2","title":"Safety-centered process control design based on dynamic safe set","url":"https://oaktrust.library.tamu.edu/server/api/core/bitstreams/bae91e91-cdbd-4e9d-9d87-c353a6825124/content","publisher":"Texas A&M University","date_or_year":"2019","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Dynamic safe sets use maximal output-admissible sets and reference-governor theory to identify plant states that guarantee safety-constraint satisfaction under bounded disturbances.","The approach explicitly incorporates actuator limits, safety-critical constraints, state-dependent margins, and supervisory attenuation only when necessary.","A CSTR case study reported superior control response with a reference governor and analyzed safety-performance trade-offs.","The authors expressly warn that unmodeled disturbances remain outside the guarantee."]},{"source_id":"SRC3","title":"A Total Integrated Approach","url":"https://process.honeywell.com/content/dam/process/en/ccc/english/support/white-papers/documents/hon-ia-ccc-whitepaper-a-total-integrated-approach-v0b.pdf","publisher":"Honeywell International / Compressor Controls Corporation","date_or_year":"2025","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Generic compressor controllers require extra margins that reduce the available operating envelope.","Adaptive open- and closed-loop control can reduce those margins without sacrificing reliability and can maximize the usable operating zone.","The documented industrial implementation used limiting loops, state-dependent strategies near surge and choke, dynamic simulation, verification before commissioning, and separate emergency shutdown protection.","The case identifies ConocoPhillips, engineering contractors, OEMs, and CCC as actual adopters and implementers and reports increased volumes and improved control stability."]},{"source_id":"SRC4","title":"Enforce Safety Constraints with Control Barrier Functions","url":"https://www.mathworks.com/help/slcontrol/ug/barrier-certificate-enforcement-for-control-design.html","publisher":"MathWorks","date_or_year":"Undated; accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Commercial control software supports real-time state-contingent safety filtering through control barrier functions.","The implementation selects the control action closest to the baseline command while satisfying safety and actuator bounds.","The safe set is expressed as a forward-invariant set, but users must verify that the combined filter and baseline controller retain the original control objectives."]},{"source_id":"SRC5","title":"Overshoot Mitigation Using the Reference Governor Framework","url":"https://www.nist.gov/publications/overshoot-mitigation-using-reference-governor-framework","publisher":"National Institute of Standards and Technology","date_or_year":"2020","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["A reference governor with a dynamic maximal admissible set varies its constraint set in real time as a function of the reference signal.","Switching logic computes constraint-respecting input commands while addressing tracking overshoot.","The work analyzes stability and recursive feasibility and reports both efficacy and limitations in simulation."]},{"source_id":"SRC6","title":"An Architectural Description of the Simplex Architecture","url":"https://www.sei.cmu.edu/library/an-architectural-description-of-the-simplex-architecture/","publisher":"Carnegie Mellon University Software Engineering Institute","date_or_year":"1996","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Simplex is a longstanding architecture for dependable, evolvable process-control systems.","Its safety and liveness properties were formally specified and checked with the FDR model checker.","It supplies close prior art for verified supervisory switching and dependable fallback, although it does not itself establish the proposed throughput wedge."]},{"source_id":"SRC7","title":"IEC 61511-1:2016 — Functional safety: Safety instrumented systems for the process industry sector, Part 1","url":"https://webstore.iec.ch/en/publication/24241","publisher":"International Electrotechnical Commission","date_or_year":"2016","source_type":"OFFICIAL_STANDARD","language":"English/French","claims_supported":["Process-industry safety-instrumented systems are subject to requirements covering specification, design, installation, operation, and maintenance.","A modified control envelope cannot replace the obligation to achieve or maintain a safe process state.","The standard establishes an identifiable lifecycle and authority boundary for changes affecting safety functions."]},{"source_id":"SRC8","title":"Contribution à la tolérance active aux défauts des systèmes dynamiques par gestion des références","url":"https://docnum.univ-lorraine.fr/public/SCD_T_2011_0052_BOUSSAID.pdf","publisher":"Université de Lorraine","date_or_year":"2011","source_type":"PRIMARY_RESEARCH","language":"French","claims_supported":["French-language literature uses the term gouverneur de référence for supervisory reference management under constraints.","The dissertation formulates repeated finite-dimensional optimization that modifies the reference while respecting state and input constraints.","It independently confirms that the reference-governor concept and constraint-admissible-set terminology were established outside English-only literature by 2011."]}],"problem_evidence":{"status":"SUPPORTED","finding":"The proposed problem exists in at least important industrial subclasses. Honeywell describes conventional generic compressor control as requiring extra margins that shrink the operating envelope and documents adaptive control that safely recovers usable range. Process-control research likewise treats actuator limits and static or overly restrictive safe regions as performance constraints that state-dependent admissible sets can manage. This supports the mechanism, but not the assertion that any particular plant's existing envelope is unnecessarily conservative.","source_ids":["SRC2","SRC3"],"uncertainty":"No telemetry from the target plant was supplied. A fixed margin may encode rare disturbances, model error, common-cause failures, or regulatory assumptions rather than deadweight loss; the wedge must therefore be demonstrated separately for each candidate actuator and state region."},"adopter_evidence":{"status":"SUPPORTED","finding":"Industrial adopters and authorizers are identifiable. The Honeywell case names ConocoPhillips, engineering contractors, OEMs, and the control-system supplier as participants in design, simulation, commissioning, and operation. IEC 61511 establishes the relevant functional-safety lifecycle, making the plant owner/operator and accountable functional-safety organization the necessary authorizers.","source_ids":["SRC3","SRC7"],"uncertainty":"The sources identify adopter classes and one concrete implementation, not a committed adopter for this preserved proposal."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"All load-bearing technical elements have close implementations: reference governors and maximal admissible sets provide state-aware constraint management; dynamic safe sets address process plants and actuator limits; control-barrier-function software selects minimally modified safe commands; Simplex supplies formally analyzed supervisory fallback; and Honeywell documents simulation-verified, commissioned adaptive compressor controls. No retained source demonstrates the proposal's entire combination—formal plant-model verification, proved selector, independent interlocks, shadow pilot, distributional review, and automatic recertification triggers—as one deployed process-plant system.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7"],"uncertainty":"Formal guarantees apply to modeled dynamics and bounded disturbances. Sensor faults, common-cause failures, transition hazards, operator adaptation, and unmodeled disturbances require empirical validation and independent protection layers."},"prior_art":{"disposition":"ESTABLISHED_PRACTICE","closest_analogues":[{"name":"Reference and command governors using maximal output-admissible sets","source_ids":["SRC1","SRC5","SRC8"],"same_problem":true,"same_causal_lever":true,"overlap":"Longstanding supervisory schemes use current state, prediction, invariant/admissible sets, and optimization or switching to modify commands only when a future constraint violation is predicted. This is the proposal's central state-contingent envelope selector.","remaining_difference":"The preserved proposal adds an explicit economic-wedge framing, affected-party review, preregistered shadow evaluation, and plant-specific model-checking and rollback records."},{"name":"Dynamic safe sets and reference-governor control for chemical processes","source_ids":["SRC2"],"same_problem":true,"same_causal_lever":true,"overlap":"The work constructs state-dependent safe sets around plant operating points, includes actuator and safety constraints plus bounded disturbances, and applies a reference governor to a CSTR with improved response.","remaining_difference":"The retained study is a modeled case study and does not supply the proposal's full organizational approval, live rollback, incidence, or near-miss protocol."},{"name":"Adaptive integrated turbomachinery control","source_ids":["SRC3"],"same_problem":true,"same_causal_lever":true,"overlap":"The commercial case explicitly identifies conservative extra margins as shrinking the operating envelope and uses adaptive, limiting, and state-dependent control strategies to operate closer to constraints without sacrificing reliability, with dynamic simulation and field commissioning.","remaining_difference":"The vendor evidence does not claim formal model checking or exhaustive certification of reachable states, and its performance claims are not an independent controlled comparison."},{"name":"Control-barrier-function safety filter","source_ids":["SRC4"],"same_problem":true,"same_causal_lever":true,"overlap":"A runtime quadratic program computes the closest permissible control action as a function of state while preserving a forward-invariant safe set and actuator bounds.","remaining_difference":"The documentation is a general software workflow, not evidence that a fixed envelope currently causes material lost throughput in a particular process plant."},{"name":"Simplex verified process-control architecture","source_ids":["SRC6"],"same_problem":false,"same_causal_lever":false,"overlap":"It supplies longstanding prior art for formally analyzed supervisory switching and dependable fallback in process control.","remaining_difference":"Simplex addresses assurance for controller changes rather than specifically recovering actuator authority from a blanket envelope."}],"contrastive_claim_remaining":"No credible broad novelty claim remains for replacing a blanket constraint with a verified state-contingent admissible set and fallback. A narrower falsifiable implementation claim remains: in one named plant, actuator class, and preregistered state region, the candidate envelope yields a material improvement over both the fixed-envelope baseline and controller retuning within that baseline, while preserving invariant margins and not worsening interlocks, near misses, operator workload, sensor-disagreement exposure, or affected-party risk after accounting for verification and transition costs.","contrastive_claim_falsifier":"Telemetry shows the limit rarely binds or binds only when credible safety reserve is needed; the certified region is operationally trivial; retuning inside the existing envelope captures the gain; shadow replay or a separately authorized bounded test shows no material performance improvement; or any invariant margin, near-miss indicator, workload measure, sensor-fault response, or affected-party exposure worsens.","confidence":"HIGH","search_limitations":"The bounded eight-source search cannot establish world novelty, patentability, freedom to operate, market size, realized impact, or frequency of adoption across all plants. The commercial evidence is vendor-authored, the IEC standard's full text is paywalled, and no target-plant telemetry, hazard analysis, safety requirements specification, regulator decision, or worker evidence was available."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Independent process-control research and a field-oriented Honeywell case support the existence of conservatism or extra control margins that reduce usable operating range, while also showing that the proposition remains plant-specific.","source_ids":["SRC2","SRC3"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"Plant owners/operators, control and safety engineers, equipment OEMs, integrators, and the accountable functional-safety organization are identifiable; an actual ConocoPhillips-centered implementation is documented, and IEC 61511 supplies the applicable authorization lifecycle.","source_ids":["SRC3","SRC7"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although the general mechanism is established, a plant-specific comparative claim against both the fixed baseline and in-envelope retuning remains measurable using binding time, tracking error, throughput, invariant margin, interlocks, near misses, workload, and exposure metrics.","source_ids":["SRC2","SRC3","SRC4"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"Offline telemetry replay and shadow-mode evaluation on one actuator class and a finite declared state region is bounded, non-commanding, reversible, and directly tests whether the envelope binds unnecessarily and whether the selector improves performance.","source_ids":["SRC2","SRC3","SRC5"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The proposed first step grants no live command authority, preserves independent interlocks, and can be governed through the IEC 61511 lifecycle. Model uncertainty prevents immediate live deployment but does not stop offline replay or shadow evaluation.","source_ids":["SRC4","SRC6","SRC7"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially using current and historical terminology, product and standards searches, French and German/Spanish/Portuguese terminology, and component combinations. Exactly eight retained sources were opened; they span six independent publishing organizations and include primary research, an official standard, government research, and first-party product material.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":false,"screen_survival":false,"remaining_research_value":"MODERATE","recommended_next_step":"Reframe the work as a plant-specific replication and validation study, not a new general control architecture. Obtain approval for read-only telemetry access; predeclare one actuator class, finite state region, uncertainty bounds, baseline and retuning rival, gain and safety metrics, sensor-disagreement tests, workload and affected-party checks, and automatic rejection criteria. Run offline replay and shadow mode before considering any separately authorized live test.","world_novelty_boundary":"This bounded search shows that the central problem-intervention package is established under reference governor, command governor, maximal output-admissible set, dynamic safe set, control-barrier-function safety filter, adaptive operating-envelope control, and Simplex/runtime-assurance terminology. It does not establish exhaustive world novelty, patentability, freedom to operate, adoption prevalence, market size, or realized impact; only a narrowly specified plant-level empirical increment remains open."}