{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"deadweight_loss_reduction__systems_cybernetics","opaque_id":"deadweight_loss_reduction__systems_cybernetics__A","search_lanes":{"direct_problem":{"queries":["fixed conservative actuator limits tracking error throughput constrained control plant","actuator saturation constraints control performance degradation process plant","advanced process control lost opportunity constrained throughput operating envelope"],"source_ids":["SRC3","SRC6","SRC8"],"no_result_note":null},"closest_prior_art":{"queries":["state dependent constraints control invariant set reference governor actuator limits safety","dynamic maximal admissible set reference governor switching logic","safety filter actuator constraints invariant set backup controller"],"source_ids":["SRC1","SRC2","SRC7"],"no_result_note":null},"historical_terminology":{"queries":["older terminology override selector control process safety limits","reference governor maximal output admissible set constrained control 1990s","拘束システム リファレンスガバナ 最大 正 不変 集合"],"source_ids":["SRC2","SRC5","SRC6"],"no_result_note":null},"products_practices_standards":{"queries":["advanced process control product push operating envelope to constraints throughput","process control safety interlock independence guidance operating limits","commercial plant constraint handling control barrier function PID"],"source_ids":["SRC3","SRC4","SRC8"],"no_result_note":null},"non_english_regional":{"queries":["zustandsabhängige Beschränkungen Regelung invariante Menge Sicherheit Stellgrößen","commande prédictive contraintes sécurité enveloppe fonctionnement dynamique procédé industriel","control predictivo restricciones seguridad envolvente operativa dinámica planta industrial","制約付き制御 安全 不変集合 リファレンスガバナ アクチュエータ 制限"],"source_ids":["SRC6"],"no_result_note":null},"composition_subproblems":{"queries":["verified invariant set command selector fallback controller actuator constraint","dynamic safety margin reference governor tracking performance switching","independent interlock advanced controller common cause failure process plant","shadow mode evaluation advanced process control safety constraints"],"source_ids":["SRC1","SRC4","SRC7","SRC8"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"Overshoot Mitigation Using the Reference Governor Framework","url":"https://www.nist.gov/publications/overshoot-mitigation-using-reference-governor-framework","publisher":"National Institute of Standards and Technology","date_or_year":"2020","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["A reference governor can reformulate tracking overshoot as constraint management.","A dynamic maximal admissible set can vary in real time with the reference signal.","Switching logic can use the dynamic admissible set while preserving recursive feasibility and stability under the paper's assumptions."]},{"source_id":"SRC2","title":"Reference Governors for Control of Systems With Constraints","url":"https://ieeecss.org/presentation/force-webinars/reference-governors-control-systems-constraints","publisher":"IEEE Control Systems Society","date_or_year":"n.d.","source_type":"TRADE_PROFESSIONAL","language":"English","claims_supported":["Reference governors are established add-on schemes for constraint handling and limit protection.","They use prediction, optimization, invariance, or returnability to minimally modify commands when future constraint violations are possible.","The addressed constraints include actuator limits and process temperature or pressure safety limits."]},{"source_id":"SRC3","title":"Honeywell Advanced Process Control","url":"https://process.honeywell.com/us/en/products/industrial-software/process-optimization/advanced-process-control","publisher":"Honeywell","date_or_year":"accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Commercial advanced process control is marketed for pushing operating envelopes toward constraints while managing product specifications.","The product targets increased throughput on constrained processes and performs real-time layered and plant-wide optimization.","Honeywell reports identifying lost operating opportunities at a refinery, supporting the existence of economically material constraint-related underperformance, although the claim is vendor supplied."]},{"source_id":"SRC4","title":"Control systems","url":"https://www.hse.gov.uk/comah/sragtech/techmeascontsyst.htm","publisher":"UK Health and Safety Executive","date_or_year":"accessed 2026-08-04","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Process control, alarms, trips, interlocks, and emergency shutdown systems have distinct safety roles.","Adequate margins between normal and safe operating limits, safety-lifecycle controls, validation, testing, and modification management are required considerations.","Protective interlocks should prevent hazardous control actions and protective systems should be sufficiently independent to address systematic and common-cause failures."]},{"source_id":"SRC5","title":"Chapter 12: Override (Selector) Control","url":"https://www.globalspec.com/reference/54033/203279/chapter-12-override-selector-control","publisher":"GlobalSpec, excerpting an ISA process-control text by Harold L. Wade","date_or_year":"2004","source_type":"TRADE_PROFESSIONAL","language":"English","claims_supported":["Override control, also called selector control, is established process-control terminology.","A normal controller can yield to another process variable or controller under abnormal conditions to prevent safety, process, or equipment limits from being exceeded.","Selector logic can change the controlling measurement as process conditions change."]},{"source_id":"SRC6","title":"拘束条件を有する制御系の解析および設計に関する研究","url":"https://dspace.jaist.ac.jp/dspace/bitstream/10119/869/3/601paper.pdf","publisher":"Japan Advanced Institute of Science and Technology Repository","date_or_year":"1999","source_type":"PRIMARY_RESEARCH","language":"Japanese","claims_supported":["Actuator saturation and protective limits can materially degrade control performance or destabilize a constrained system.","Constrained positively invariant sets can characterize states from which constraints remain satisfied under bounded disturbances.","The dissertation constructs reference-governor and switching-control methods that reshape commands online, use operating state, preserve constraints, and improve performance in simulations."]},{"source_id":"SRC7","title":"Soft-minimum and soft-maximum barrier functions for safety with actuation constraints","url":"https://scholars.uky.edu/en/publications/soft-minimum-and-soft-maximum-barrier-functions-for-safety-with-a/","publisher":"University of Kentucky; article published in Automatica","date_or_year":"2025","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Real-time optimization can select minimally modified control signals subject to actuator and safety constraints.","Finite-horizon prediction under a known backup controller can define a forward-invariant subset of the safe set.","The reported method guarantees feasibility and transitions within a framework that retains one or more backup controllers under its stated model assumptions."]},{"source_id":"SRC8","title":"Improve PID Design to Handle Plant Constraints","url":"https://www.mathworks.com/help/slcontrol/ug/improve-pid-to-handle-plant-constraints.html","publisher":"MathWorks","date_or_year":"accessed 2026-08-04","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["Actuator saturation can cause windup, sluggish recovery, overshoot, instability, and suboptimal performance.","Control-barrier-function blocks restrict control inputs to keep states inside a modeled safe set and can provide formal guarantees under their assumptions.","Anti-windup is a simpler rival intervention when saturation handling, rather than an unnecessarily restrictive envelope, explains the deficit."]}],"problem_evidence":{"status":"PARTLY_SUPPORTED","finding":"The general problem is real: actuator and process constraints can degrade tracking and stability, while commercial advanced process control explicitly seeks additional throughput by operating constrained processes closer to limits. However, the searched evidence does not establish that a particular plant's fixed envelope is unnecessarily conservative rather than reserving margin for rare disturbances, model error, or common-cause failures. That plant-specific wedge remains a hypothesis requiring telemetry and hazard evidence.","source_ids":["SRC3","SRC6","SRC8"],"uncertainty":"Vendor evidence is not independent outcome verification, and the academic examples do not demonstrate the frequency or magnitude of unnecessary fixed-envelope binding in the proposed plant context."},"adopter_evidence":{"status":"SUPPORTED","finding":"An identifiable adopter and authorization chain exists at the organizational level: the plant owner or operator's control engineering and operations teams could adopt the system, while the accountable functional-safety authority and applicable regulator or authority having jurisdiction would authorize safety-relevant modification. Independent protection-system responsibilities make authorization more specific than a generic managerial adopter.","source_ids":["SRC3","SRC4"],"uncertainty":"No named plant, owner, regulator, bargaining representative, or individual signatory is supplied, so identification is role-based rather than site-specific."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"The main technical components already exist: reference governors, dynamic admissible sets, invariant-set switching, constraint-aware commercial APC, barrier-function safety filters, backup controllers, and independent trips or interlocks. This supports feasibility for bounded modeled systems, but does not demonstrate a certified implementation of the complete proposal in a hazardous process plant or validate its sensing, residual detection, operator response, and common-cause assumptions.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC6","SRC7","SRC8"],"uncertainty":"Much of the formal evidence is simulation or model-dependent, and the commercial source does not show that safety limits themselves are dynamically relaxed using formally verified state-contingent envelopes."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Reference governors using invariant or maximal admissible sets","source_ids":["SRC1","SRC2","SRC6"],"same_problem":true,"same_causal_lever":true,"overlap":"These methods supervise an existing feedback controller, use current state or reference-dependent admissible sets, minimally reshape commands, and preserve state or input constraints while improving tracking relative to blunt saturation.","remaining_difference":"The retained sources do not combine the method with a named hazardous-plant wedge audit, independent SIS governance, affected-party incidence review, preregistered shadow deployment, and automatic certification invalidation on plant residuals."},{"name":"Backup-control barrier-function safety filter with bounded actuation","source_ids":["SRC7"],"same_problem":true,"same_causal_lever":true,"overlap":"It computes state-contingent control authority inside a forward-invariant safe subset and uses finite-horizon prediction under a known backup controller, closely matching the proposed verified selector and fallback.","remaining_difference":"The evidence is for formal control design and numerical demonstrations, not a plant-specific comparison against a fixed safety envelope or a regulated process-safety change workflow."},{"name":"Commercial advanced process control near operating constraints","source_ids":["SRC3"],"same_problem":true,"same_causal_lever":false,"overlap":"Commercial APC uses real-time models and optimization to increase throughput on constrained processes and monitor lost operating opportunity.","remaining_difference":"The product page describes optimization within managed limits, not formal verification that a fixed worst-case safety limit can be relaxed state by state while independent safety invariants remain unchanged."},{"name":"Override or selector control","source_ids":["SRC5"],"same_problem":false,"same_causal_lever":true,"overlap":"Established process practice switches the controlling variable or controller according to operating conditions so normal control authority is retained until a safety, equipment, or process limit becomes relevant.","remaining_difference":"Classical selector control does not itself calculate a verified reachable-state envelope, prove a terminating selector and fallback, or establish that a fixed limit causes measurable lost throughput."},{"name":"Control-barrier-function augmentation and anti-windup alternatives","source_ids":["SRC8"],"same_problem":true,"same_causal_lever":false,"overlap":"Both address poor performance or safety risk caused by plant and actuator constraints; barrier filters restrict unsafe inputs, while anti-windup treats saturation-induced controller pathology.","remaining_difference":"Anti-windup does not expose additional certified actuator authority, and the product guidance does not establish state-contingent relaxation of a conservative plant envelope."}],"contrastive_claim_remaining":"For one predeclared actuator class and finite operating region in a specified plant, the existing fixed limit binds in states where a robust reachable-set certificate permits additional authority, and a verified state-contingent selector with independent interlocks and automatic fallback yields a material preregistered improvement in tracking or throughput over both the fixed-envelope baseline and retuning or anti-windup, without worsening invariant margin, interlock demand, near misses, operator workload, or worker and community exposure. This is a contextual empirical and assurance claim, not a new general control architecture.","contrastive_claim_falsifier":"The claim is falsified if telemetry shows that the envelope rarely binds or binds only when credible safety or physical constraints apply; no operationally meaningful less-restrictive robust invariant region can be certified; retuning or anti-windup captures the benefit; or shadow or bounded-live evidence shows no material gain or any deterioration in safety margin, residuals, interlock demand, near misses, workload, or affected-party exposure.","confidence":"HIGH","search_limitations":"The bounded search used exactly eight retained direct sources across six lanes. It did not exhaust patents, proprietary plant procedures, paid standards, vendor implementation records, accident investigations, or every language and industry. Several formal results depend on model assumptions and simulation, while the commercial performance statements are first-party claims."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Independent technical evidence establishes that constraints and saturation can degrade control performance, and first-party industrial evidence identifies throughput and lost-opportunity consequences in constrained processes. Whether a particular fixed envelope is avoidably conservative remains testable rather than assumed.","source_ids":["SRC3","SRC6","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"The plant owner or operator's operations and control-engineering functions are identifiable adopters, and the accountable functional-safety authority plus applicable regulator or authority having jurisdiction are identifiable authorizers for a safety-relevant change.","source_ids":["SRC3","SRC4"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although the control architecture has close prior art, a distinct plant-context claim remains: demonstrate unnecessary fixed-limit binding and incremental performance versus retuning or anti-windup within a predeclared actuator and state region while holding independently protected safety outcomes noninferior.","source_ids":["SRC1","SRC3","SRC6","SRC7","SRC8"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"A finite offline replay and shadow-mode comparison can be preregistered for one actuator class using existing telemetry, a robust invariant-set certificate, explicit excluded states, baseline and rival controllers, residual triggers, and no live command authority.","source_ids":["SRC3","SRC4","SRC7"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"There is no stop for the proposed offline and shadow-only first step if independent trips and interlocks remain untouched, common-cause dependencies are reviewed, and no risk-reduction credit is assigned to the experimental selector. Live relaxation would require a later safety-lifecycle authorization and is not authorized by this gate.","source_ids":["SRC4"]},"adequate_search_evidence":{"status":"PASS","rationale":"The bounded search covered the direct problem, closest technical prior art, historical terminology, products and standards, Japanese and other regional terminology, and combinations of verification, invariant sets, fallback control, interlocks, and shadow evaluation. All eight retained sources were opened; they span seven publisher organizations and include primary research, official guidance, and first-party product sources.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"With a willing named plant, preregister an offline replay and shadow study for one actuator class. First document the HAZOP and SIS boundary, independent interlocks, model uncertainty, sensor-fault assumptions, fixed-envelope binding rate, and exposure metrics. Compare the existing controller, retuning or anti-windup, and the verified selector on identical disturbance episodes. Require independent functional-safety review, zero live command authority, automatic expiry, and halt on invariant prediction, unexplained residual, sensor disagreement, interlock demand, workload increase, or adverse near-miss signal.","world_novelty_boundary":"This result identifies close public analogues and a remaining plant-specific empirical claim only. The bounded search cannot establish world novelty, patentability, freedom to operate, market size, routine prevalence across all industries, or realized safety and throughput impact."}