{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"deadweight_loss_reduction__systems_cybernetics","opaque_id":"deadweight_loss_reduction__systems_cybernetics__A","search_lanes":{"direct_problem":{"queries":["fixed conservative actuator constraints performance reference governor safe constraint enforcement plant control","reference governor survey constraints performance degradation conservative fixed limits","dynamic operating envelope industrial plant state dependent actuator limits safety"],"source_ids":["S02","S07"],"no_result_note":null},"closest_prior_art":{"queries":["reference governor survey constraints performance degradation conservative fixed limits","Reference and command governors survey 2017 Garone Di Cairano Kolmanovsky pdf","runtime assurance Simplex architecture safety controller fallback verified switching","MathWorks reference governor example constraints"],"source_ids":["S01","S02","S03","S04"],"no_result_note":null},"historical_terminology":{"queries":["Gilbert Kolmanovsky reference governor 1995 output admissible set constraint control","Simplex architecture Sha 1998 safety critical control verified fallback original paper pdf","Reference Management for Control Systems Under Constraints command governor predictive governor"],"source_ids":["S01","S03"],"no_result_note":null},"products_practices_standards":{"queries":["site:mathworks.com/help \"Reference Governor\"","site:osha.gov 1910.119 safe operating limits upper lower process safety management change control system","site:iec.ch IEC 61511 operating limits safety instrumented systems process industry","Australia dynamic operating envelope network constraints official"],"source_ids":["S04","S05","S06","S07"],"no_result_note":null},"non_english_regional":{"queries":["\"gobernador de referencia\" restricciones control sistemas","参考调节器 约束 控制 安全 系统","zustandsabhängige Begrenzung Stellgröße Regelung Sicherheit","site:energy.gov.au dynamic operating envelopes export limits real time"],"source_ids":["S07","S08"],"no_result_note":null},"composition_subproblems":{"queries":["runtime assurance Simplex architecture safety controller fallback verified switching","bounded safe invariant set reference governor offline simulation online measurement","constraint enforcement state dependent control action product","IEC 61511 protective systems process hazard management of change"],"source_ids":["S02","S03","S04","S05","S06"],"no_result_note":null}},"sources":[{"source_id":"S01","title":"Reference and Command Governors for Systems with Constraints: A Survey on Theory and Applications","url":"https://shadow.merl.com/publications/docs/TR2016-102.pdf","publisher":"Mitsubishi Electric Research Laboratories; journal version in Automatica","date_or_year":"2016 report; 2017 journal version","source_type":"SECONDARY_RESEARCH","language":"English","claims_supported":["Reference and command governors are an extensive family of add-on schemes that modify references as needed to enforce state and control constraints.","The surveyed methods use current state measurements or estimates, admissible sets, and predictions to preserve nominal performance when constraints are inactive.","The literature includes linear, nonlinear, uncertain, parameter, networked, and distributed variants plus practical applications.","Reference-governor terminology and closely related approaches date to at least the early 1990s."]},{"source_id":"S02","title":"Parameter-Adaptive Reference Governors with Learned Robust Constraint-Admissible Sets","url":"https://merl.com/publications/docs/TR2023-005.pdf","publisher":"Mitsubishi Electric Research Laboratories; Control Engineering Practice","date_or_year":"2023","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Worst-case robust reference-governor formulations can be overly conservative and perform poorly when uncertainty is narrower than the worst-case set.","The proposed parameter-adaptive governor combines offline simulations and online measurements to estimate time-varying robust constraint-admissible sets.","It selects references close to the desired reference while enforcing constraints despite parameter uncertainty.","The method was evaluated on an electromagnetic actuator and a vehicle rollover example, but does not establish deployment in the unspecified plant of this proposal."]},{"source_id":"S03","title":"The Simplex Architecture for Safe On-Line Control System Upgrades","url":"https://experts.illinois.edu/en/publications/the-simplex-architecture-for-safe-on-line-control-system-upgrades/","publisher":"IEEE / University of Illinois","date_or_year":"1998","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Simplex is an established architecture for introducing higher-performance control while retaining a trusted safety path and fault-tolerance mechanism.","The architecture was demonstrated on a plasma-enhanced chemical vapor deposition process used in semiconductor manufacturing.","Verified fallback or reversion is therefore older adjacent prior art for the proposal's selector-and-fallback composition."]},{"source_id":"S04","title":"Constraint Enforcement for Control Design","url":"https://www.mathworks.com/help/slcontrol/ug/constraint-enforcement-for-control-design.html","publisher":"MathWorks","date_or_year":"Accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A commercially documented Simulink block modifies a nominal control action in real time to the closest action satisfying constraints and action bounds.","Its constraint coefficients may depend on plant state and may be derived from plant dynamics or learned from experimental or simulation data.","MathWorks warns that modifying actions can alter stability margins, supporting the need for separate verification and testing."]},{"source_id":"S05","title":"29 CFR 1910.119 — Process Safety Management of Highly Hazardous Chemicals","url":"https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119","publisher":"U.S. Occupational Safety and Health Administration","date_or_year":"Current regulation accessed 2026-08-04; originally promulgated 1992","source_type":"OFFICIAL_STANDARD","language":"English","claims_supported":["For covered plants, the employer is an identifiable dutyholder and process-hazard analysis must involve engineering, operations, and process-specific expertise.","Hazard analysis must address controls, control-failure consequences, human factors, and effects on employees.","Changes require a technical basis, safety and health review, authorization requirements, updated procedures, and affected-worker training before startup.","This creates a mandatory authority boundary for live envelope changes but not an absolute bar to an offline shadow study."]},{"source_id":"S06","title":"IEC TR 61511-0:2018 — Functional Safety for the Process Industry and IEC 61511","url":"https://webstore.iec.ch/en/publication/60766","publisher":"International Electrotechnical Commission","date_or_year":"2018","source_type":"OFFICIAL_STANDARD","language":"English","claims_supported":["Process-industry hazards can affect health, safety, environment, and plant assets.","Where inherent safety is insufficient, protective systems are required to reduce risk to an acceptable level.","The IEC 61511 series supplies a functional-safety lifecycle and safety-integrity framework relevant to any live change affecting safety functions."]},{"source_id":"S07","title":"DER Interoperability Assessment Framework","url":"https://www.energy.gov.au/sites/default/files/2021-12/FTI%20-%20Assessment%20Framework%20for%20DER%20interoperability%20policy%20-%20December%202021.pdf","publisher":"Australian Government Department of Industry, Science, Energy and Resources","date_or_year":"2021","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Static export limits continuously impose one value, while dynamic limits permit greater exports when network conditions allow and tighten during congestion.","A South Australian trial using real-time measurements increased reported average available export capacity relative to a 5 kW static limit.","Dynamic operating envelopes are upper and lower bounds varying by time, location, congestion, thermal conditions, load, and other network state.","This is a regional, non-plant analogue with substantially the same fixed-limit problem and state-contingent-envelope lever."]},{"source_id":"S08","title":"CN107272422B — 基于参考调节器的贴片机驱动系统的多变量约束控制方法 [Reference-governor-based multivariable constrained control method for a placement-machine drive system]","url":"https://patents.google.com/patent/CN107272422B/zh","publisher":"Harbin Institute of Technology Shenzhen; CN patent record via Google Patents","date_or_year":"Filed 2017; granted and published 2020","source_type":"OTHER","language":"Chinese","claims_supported":["The Chinese disclosure applies a reference governor to an industrial placement-machine actuator system.","It predicts state and control-input evolution, adjusts the reference in real time, and constrains displacement, velocity, and control input to protect equipment while maintaining control performance.","It demonstrates that the relevant concepts and terminology are not confined to English-language literature."]}],"problem_evidence":{"status":"SUPPORTED","finding":"The general problem is externally supported: worst-case robust constraint designs can be overly conservative and degrade performance, and an official Australian field example reports greater usable capacity after replacing a static limit with a condition-dependent limit. This does not show that the envelope binds unnecessarily in any particular plant named by the proposal, because no plant or telemetry was supplied.","source_ids":["S02","S07"],"uncertainty":"The apparent reserve in a specific plant could encode rare disturbances, common-cause failures, sensor faults, or undocumented safety assumptions rather than avoidable conservatism."},"adopter_evidence":{"status":"PARTLY_SUPPORTED","finding":"Identifiable organizational roles exist: covered-process employers, process-safety and operations teams, management-of-change authorizers, and—in the regional analogue—distribution network service providers. However, the proposal names no facility, owner, jurisdiction, regulator, actuator, or accountable individual whose adoption authority can be verified.","source_ids":["S05","S06","S07"],"uncertainty":"OSHA and IEC applicability depends on plant type and jurisdiction, and additional sector-specific regulators or worker representatives may possess approval or veto authority."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Core components have been implemented separately: reference governors and adaptive admissible sets, a Simplex fallback architecture demonstrated on a semiconductor process, a first-party state-dependent constraint-enforcement software block, and dynamic-limit field trials. The exact combined package—formal plant-specific envelope certification, bounded shadow trial, distributional review, automatic rollback, and accountable live authorization—was not demonstrated by the retained sources.","source_ids":["S01","S02","S03","S04","S07","S08"],"uncertainty":"Most cited control results are analytical, simulated, experimental, or application-specific; they do not establish reliability, operator response, certification cost, or net benefit in the unspecified target plant."},"prior_art":{"disposition":"SUBSTANTIAL_COLLISION","closest_analogues":[{"name":"Reference and command governors using constraint-admissible sets","source_ids":["S01"],"same_problem":true,"same_causal_lever":true,"overlap":"They use measured or estimated state and prediction to modify commands only when necessary, enforce state and actuator constraints, preserve an existing controller, and avoid permanently conservative filtering.","remaining_difference":"The proposal adds a particular assurance and governance wrapper—shadow evaluation, affected-party review, expiry, monitoring, and rollback—but does not identify a new control mechanism beyond the surveyed governor family."},{"name":"Parameter-adaptive reference governor with learned robust constraint-admissible sets","source_ids":["S02"],"same_problem":true,"same_causal_lever":true,"overlap":"It explicitly targets poor performance caused by worst-case conservatism and uses offline data plus online state and parameter evidence to expose a less conservative safe admissible region.","remaining_difference":"The paper does not evaluate the proposal's unspecified process plant, throughput objective, worker/community incidence, or regulatory workflow."},{"name":"Dynamic export limits and dynamic operating envelopes","source_ids":["S07"],"same_problem":true,"same_causal_lever":true,"overlap":"A blanket static capacity limit is replaced by time- and condition-dependent limits that release capacity when constraints permit and tighten during congestion, with reported field-trial capacity gains.","remaining_difference":"The controlled substrate is an electrical distribution connection rather than an actuator inside a feedback-controlled process plant."},{"name":"Simplex runtime fallback plus state-dependent constraint enforcement product","source_ids":["S03","S04"],"same_problem":false,"same_causal_lever":true,"overlap":"These sources respectively supply the trusted fallback architecture and a productized mechanism that selects the nearest state-dependent constrained action in real time.","remaining_difference":"Neither source alone asserts that a fixed worst-case plant envelope is the binding cause of lost throughput, and the complete site-specific safety case remains to be made."}],"contrastive_claim_remaining":"Only an application-specific empirical claim remains credible: for a named actuator and predeclared state region in a named plant, a verified state-contingent selector could improve tracking or throughput relative to both the fixed envelope and controller retuning while meeting predeclared invariant-margin, interlock, near-miss, workload, and affected-party-risk thresholds. This is not presently a distinct mechanism claim because the plant, region, thresholds, and implementation are unspecified.","contrastive_claim_falsifier":"Telemetry shows the fixed envelope rarely binds or binds only when a credible safety or physical constraint is active; verification finds no meaningful additional admissible region; retuning within the existing envelope captures the benefit; or shadow/live results show no material performance gain or worse invariant margin, residuals, interlocks, near misses, operator workload, or risk incidence.","confidence":"HIGH","search_limitations":"The bounded eight-source search covered six adversarial lanes and multiple publishers, but was not an exhaustive patent, standards, vendor, or multilingual search. Some standards detail is paywalled. No plant-specific records, incident data, telemetry, controller model, or regulator decision were available. The evidence supports substantial collision with known mechanisms, not worldwide routine use of the complete package."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Primary research directly identifies poor performance from worst-case conservative reference-governor designs, and official regional evidence documents additional usable capacity from dynamic rather than static limits.","source_ids":["S02","S07"]},"identifiable_adopter_or_authorizer":{"status":"INDETERMINATE","rationale":"The legal and organizational authorizer class is identifiable, but no actual plant, employer, jurisdiction, regulator, or accountable safety authority is named, so adoption authority cannot be confirmed for a real site.","source_ids":["S05","S06"]},"distinct_testable_incremental_claim":{"status":"FAIL","rationale":"Reference governors, adaptive constraint-admissible sets, state-dependent constraint-enforcement products, and verified fallback architectures already cover the proposed causal mechanism. Without a named application and prespecified comparative thresholds, the remaining statement is a generic application hypothesis rather than a distinct incremental research claim.","source_ids":["S01","S02","S03","S04","S07"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A finite offline replay and shadow-mode comparison on one actuator class and a predeclared state region is bounded, reversible, and consistent with prior offline/online admissible-set evaluation. It can compare the fixed envelope, retuning rival, and state-contingent governor without issuing plant commands.","source_ids":["S02","S03","S04"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"No safety stop prevents the proposed no-command offline/shadow step. Any live authority remains gated by plant hazard analysis, management-of-change authorization, updated procedures, training, and applicable functional-safety requirements; independent interlocks must not be disabled.","source_ids":["S03","S05","S06"]},"adequate_search_evidence":{"status":"PASS","rationale":"Exactly eight opened direct sources span all six required lanes, six publisher groups, two languages or regional contexts, historical terminology, products, regulation, standards, primary research, and component combinations. Seven sources are primary, official, standards, guidance, or first-party product sources.","source_ids":["S01","S02","S03","S04","S05","S06","S07","S08"]}},"strict_success":false,"screen_survival":false,"remaining_research_value":"MODERATE","recommended_next_step":"Reframe the work as site-specific applied validation rather than a new mechanism. Identify one plant, actuator, accountable safety authority, governing standards, and binding-limit telemetry; preregister a no-command shadow comparison of the fixed envelope, controller retuning, and an established reference-governor or safety-filter implementation, with explicit model-residual, invariant-margin, performance, workload, near-miss, incidence, expiry, and rollback criteria. Do not proceed to live authority without the site's formal change and safety approvals.","world_novelty_boundary":"This bounded search supports a high-confidence finding of substantial collision with known reference-governor, adaptive admissible-set, state-dependent constraint-enforcement, dynamic-envelope, and Simplex mechanisms. It cannot establish world novelty, patentability, freedom to operate, complete standards compliance, market size, routine global adoption, or realized impact."}