{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp11_mechanism_context_external20_20260804","research_id":"eoa_inverse_innovation_exp11_external_scrutiny_20260804","cell_id":"layer_decay_and_expiration_management__systems_cybernetics","opaque_id":"layer_decay_and_expiration_management__systems_cybernetics__C","search_lanes":{"direct_problem":{"queries":["industrial control system temporary overrides bypasses time limit review stale control logic management","control system obsolete control logic accumulation patches actuator override lifecycle","site:hse.gov.uk process control overrides bypasses temporary recorded reviewed","industrial control bypass override log time limit removal regulator guidance"],"source_ids":["SRC1","SRC2","SRC4","SRC8"],"no_result_note":null},"closest_prior_art":{"queries":["Simplex architecture controller switching runtime assurance original paper","safe adaptive controller changes reference model robust stability","controller shadow mode remove actuator contribution retain logging replay rollback dependency check","industrial controller change replay simulation compare active shadow controller stability eigenvalue"],"source_ids":["SRC4","SRC6","SRC7"],"no_result_note":null},"historical_terminology":{"queries":["temporary bypass standing bypass inhibit override industrial control forgotten historical 1990","controller change safe switching bumpless transfer legacy control law decommissioning","process control management of change temporary modification override register older guidance","obsolete supplementary controller logic removal dependency rollback industrial plant"],"source_ids":["SRC1","SRC2","SRC6","SRC7","SRC8"],"no_result_note":null},"products_practices_standards":{"queries":["official industrial control version control rollback change management controller logic product manual","site:rockwellautomation.com FactoryTalk AssetCentre control logic version control backup disaster recovery","site:abb.com control software version control change management backup restore controller application","site:isa.org ISA 61511 bypass override management change lifecycle"],"source_ids":["SRC2","SRC3","SRC4","SRC5"],"no_result_note":null},"non_english_regional":{"queries":["Regelungstechnik Überbrückung Bypass zeitlich begrenzt Änderungsmanagement Steuerungslogik","automatización industrial bypass anulación temporal control de cambios lógica PLC","自动控制 旁路 超时 管理 运行时保证 控制器 切换","commande industrielle by-pass temporaire gestion modification automate restauration"],"source_ids":["SRC5"],"no_result_note":null},"composition_subproblems":{"queries":["control law shadow mode replay controller contribution actuator command logging decommission","control overlay dependency check rollback restoration controller logic modification validation","superseded control logic inventory owner lifecycle restoration test stability","safe controller change approximate closed loop model stability rollback"],"source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"no_result_note":null}},"sources":[{"source_id":"SRC1","title":"29 CFR 1910.119 Appendix C — Compliance Guidelines and Recommendations for Process Safety Management","url":"https://osha.prod.pace.dol.gov/laws-regs/regulations/standardnumber/1910/1910.119AppC","publisher":"Occupational Safety and Health Administration","date_or_year":"1992; current web edition accessed 2026","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Management of change expressly covers computer-program revisions and changes to alarms and interlocks.","Temporary changes have caused catastrophes and can become permanent unless detected, time-limited, and monitored.","The guidance calls for restoration to original or designed condition, documentation, duration, approvals, authorization, testing, and multidisciplinary review."]},{"source_id":"SRC2","title":"Beyond alarm management","url":"https://www.isa.org/intech-home/2017/september-october/features/beyond-alarm-management","publisher":"International Society of Automation","date_or_year":"2017","source_type":"TRADE_PROFESSIONAL","language":"English","claims_supported":["Industrial alarm practice uses an evergreen inventory, periodic automated comparison against an approved master, mismatch reporting, and management of change.","Safety-instrumented-function bypasses require rigorous control because bypasses add risk and have sometimes been missed or forgotten.","State-based control additions alter online configuration according to operating regime, demonstrating that regime-dependent overlays exist in practice."]},{"source_id":"SRC3","title":"ISA-TR84.00.02-2022: Safety Integrity Level Verification of Safety Instrumented Functions — Preview","url":"https://www.isa.org/getmedia/7aa120c2-2a4e-4967-b883-f25ae3210e1c/tr_840002_preview.pdf","publisher":"International Society of Automation","date_or_year":"2022","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["The safety-instrumented-system lifecycle includes operation and maintenance, modification, decommissioning, verification, and functional-safety assessment.","Modification must maintain required safety integrity and use the applicable lifecycle phase during management of change.","Decommissioning requires review, and verification tests phase outputs for correctness and consistency."]},{"source_id":"SRC4","title":"SF_Override","url":"https://help.plc.abb.com/sf_override.html","publisher":"ABB","date_or_year":"Undated; accessed 2026","source_type":"FIRST_PARTY_PRODUCT","language":"English","claims_supported":["A commercial safety PLC function block conditionally withdraws and restores override authority while retaining explicit state and diagnostics.","The override automatically terminates when its conditions clear or a predetermined maximum time expires.","The implementation limits authority to necessary movements and reduced-risk conditions and fails inactive on error or timeout."]},{"source_id":"SRC5","title":"FactoryTalk AssetCentre","url":"https://www.rockwellautomation.com/es-es/products/software/factorytalk/maintenancesuite/assetcentre.html","publisher":"Rockwell Automation","date_or_year":"2026 product page","source_type":"FIRST_PARTY_PRODUCT","language":"Spanish","claims_supported":["A commercial automation-asset product provides version control, automated backup, disaster recovery, audit tracking, change tracking, reporting, and lifecycle management.","It supports backup-and-compare tasks and lifecycle visibility for automation devices, including controllers from multiple vendors.","These capabilities establish practical infrastructure for inventory, chronology, evidence preservation, and restoration, but not response-gated overlay expiration."]},{"source_id":"SRC6","title":"A Software Architecture for Dependable and Evolvable Industrial Computing Systems","url":"https://www.sei.cmu.edu/library/a-software-architecture-for-dependable-and-evolvable-industrial-computing-systems/","publisher":"Carnegie Mellon University Software Engineering Institute","date_or_year":"1995","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["The Simplex architecture was designed for safe and reliable online upgrades of industrial computing systems despite errors in new modules.","Retaining an assured alternative while transferring execution authority is longstanding prior art.","Simplex addresses safe technology insertion and upgrade, not expiration governance for accumulated overlays."]},{"source_id":"SRC7","title":"Safe adaptive controller changes based on reference model adjustments","url":"https://personalpages.manchester.ac.uk/staff/Alexander.Lanzon/publications/open_pdf_files/cdc-03_Lecchini-Lanzon-Anderson.pdf","publisher":"IEEE Conference on Decision and Control; hosted by University of Manchester","date_or_year":"2003","source_type":"PRIMARY_RESEARCH","language":"English","claims_supported":["Safe controller change based on approximate closed-loop models and robust-stability bounds predates the proposal.","The paper warns that a controller designed from an approximate model can destabilize the real plant and proposes bounded intermediate controller changes with re-identification.","This closely anticipates model-gated authority transition, but not stale-overlay inventory, expiry, legal holds, archival states, or matched three-arm replay."]},{"source_id":"SRC8","title":"Plant modification / Change procedures","url":"https://www.hse.gov.uk/comah/sragtech/techmeasplantmod.htm","publisher":"UK Health and Safety Executive","date_or_year":"2025","source_type":"OFFICIAL_GUIDANCE","language":"English","claims_supported":["Poorly controlled plant and process changes increase risk, and all modifications should undergo traceable safety, engineering, and technical review.","A change can affect remote parts of a plant, supporting dependency and impact checks before removal or decommissioning.","Authorization should involve competent personnel and relevant operations, technical, safety, environmental, and quality functions; modifications should be inspected, tested, and shown to meet design intent."]}],"problem_evidence":{"status":"SUPPORTED","finding":"The underlying problem is externally established. OSHA expressly includes computer-program revisions, alarms, and interlocks in management of change and states that temporary changes can become permanent unless detected, time-limited, monitored, and restored. ISA reports that safety-function bypasses have been forgotten, while HSE recognizes cross-plant effects and increased risk from poorly controlled modifications. These sources support persistence, opaque configuration, authority, and unsafe-removal concerns, although they do not quantify the prevalence of expired model overlays as a separate class.","source_ids":["SRC1","SRC2","SRC8"],"uncertainty":"Evidence is strongest for temporary process changes, bypasses, alarms, interlocks, and controller revisions. It does not establish that spectral conflict from accumulated overlays is common or that overlay accumulation is a leading cause relative to plant drift, sensor faults, or base-controller defects."},"adopter_evidence":{"status":"SUPPORTED","finding":"An identifiable authorizer exists: the accountable employer, plant owner/operator, or control-system owner, supported by competent operations, maintenance, technical, safety, environmental, and quality reviewers. Standards and regulator guidance make authorization and multidisciplinary review explicit.","source_ids":["SRC1","SRC3","SRC8"],"uncertainty":"Exact legal authority, regulator involvement, and affected-person participation vary by facility and jurisdiction; the public sources do not define a universal approval structure."},"implementation_evidence":{"status":"PARTLY_SUPPORTED","finding":"Most enabling components are already implementable: formal change lifecycles, time-limited override authority, diagnostics, configuration inventory, versioning, audit, backup, comparison, restoration, safe controller switching, and model-based stability bounds. No retained source implements the complete proposed composition of supersession/regime-validity gates, dependency and hold checks, actuator-contribution-only shadowing, matched three-arm replay, attribution diagnostics, and archival disposition.","source_ids":["SRC1","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"],"uncertainty":"The retained product pages do not prove routine use at every installation. Identifying one overlay's contribution may be infeasible in nonlinear or tightly coupled plants, and local modal analysis cannot establish global nonlinear safety."},"prior_art":{"disposition":"ADJACENT_PRIOR_ART","closest_analogues":[{"name":"Process-safety management of temporary changes and bypasses","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC8"],"same_problem":true,"same_causal_lever":true,"overlap":"Established practice inventories and authorizes temporary control changes, imposes duration or automatic timeout, monitors active bypasses, tests modifications, preserves documentation, restores normal conditions, and reviews decommissioning and cross-system effects.","remaining_difference":"The sources do not combine non-safety superseded-overlay selection with regime-validity scoring, contribution-only shadowing, matched baseline and age-only replay arms, preregistered attribution diagnostics, and evidence-preserving archive disposition."},{"name":"FactoryTalk AssetCentre automation-asset lifecycle management","source_ids":["SRC5"],"same_problem":true,"same_causal_lever":false,"overlap":"Provides centralized inventory, version control, change tracking, auditing, automated backup, comparison, lifecycle visibility, and recovery for automation assets.","remaining_difference":"It manages configurations and recovery but does not itself decide whether a particular overlay should retain actuator-path authority based on regime validity or measured response."},{"name":"Simplex safe online controller upgrade","source_ids":["SRC6"],"same_problem":false,"same_causal_lever":true,"overlap":"Uses retained assured components and controlled authority transfer to permit reversible evolution of industrial control systems despite potentially faulty new components.","remaining_difference":"It addresses safe insertion and fallback rather than accumulated expired overlays, supersession, retention policy, holds, or evidence-governed decommissioning."},{"name":"Safe adaptive controller changes","source_ids":["SRC7"],"same_problem":false,"same_causal_lever":true,"overlap":"Uses identified closed-loop models and robust-stability limits to gate controller changes, with intermediate changes and re-identification when model support is inadequate.","remaining_difference":"It changes controllers to improve a reference-model objective; it does not govern stale-overlay lifecycles or test withdrawal against continued activation and age-only expiry."}],"contrastive_claim_remaining":"For one documented, non-safety-critical superseded overlay and fixed operating window, adding regime-validity, dependency, hold, restoration, and attribution gates to reversible actuator-contribution shadowing will improve at least one preregistered response or interpretability metric beyond measurement error relative to both continued activation and age-only expiration, without a new constraint violation, restoration failure, or degradation beyond the baseline test-retest noninferiority bound.","contrastive_claim_falsifier":"The claim is falsified if no eligible authoritative overlay exists; its contribution cannot be identified within preregistered residual, coupling, and spectral-separation tolerances; gated shadowing causes any constraint or restoration failure; response or stability degradation exceeds the baseline noninferiority bound; or no preregistered metric improves relative to both continued activation and age-only expiration.","confidence":"MODERATE","search_limitations":"The bounded search covered six adversarial lanes and opened exactly eight retained sources from seven publisher identities. Searches used English plus German, Spanish, Chinese, and French terminology. Public product material and standards previews omit internal implementation detail; plant-specific procedures and proprietary control architectures may contain closer prior art. The search cannot establish world novelty, patentability, freedom to operate, market size, routine prevalence, or realized impact."},"researchability_gates":{"externally_supported_problem":{"status":"PASS","rationale":"Official guidance and professional practice directly document temporary computer-program, alarm, interlock, and bypass changes persisting beyond intent, alongside risks from poorly controlled modification and restoration.","source_ids":["SRC1","SRC2","SRC8"]},"identifiable_adopter_or_authorizer":{"status":"PASS","rationale":"The plant or control-system owner is identifiable, with competent multidisciplinary authorization roles explicitly recognized by regulator and lifecycle guidance.","source_ids":["SRC1","SRC3","SRC8"]},"distinct_testable_incremental_claim":{"status":"PASS","rationale":"Although lifecycle control, automatic timeout, versioning, safe switching, and model-gated controller change are prior art, the specified three-arm replay and combined validity, dependency, restoration, and attribution gates leave a distinct falsifiable increment.","source_ids":["SRC1","SRC4","SRC5","SRC6","SRC7"]},"bounded_next_evidence_step":{"status":"PASS","rationale":"One offline replay or high-fidelity simulation involving a single non-safety-critical superseded overlay, fixed window, fixed disturbance suite, three arms, and preregistered acceptance thresholds is bounded and reversible.","source_ids":["SRC4","SRC5","SRC6","SRC7"]},"no_unresolved_safety_or_authority_stop":{"status":"PASS","rationale":"The authorized first step is offline, excludes safety-critical withdrawal and irreversible deletion, retains signed restoration artifacts, requires competent owner and safety approval, and stops on diagnostic, constraint, or restoration failure.","source_ids":["SRC1","SRC3","SRC5","SRC8"]},"adequate_search_evidence":{"status":"PASS","rationale":"All six required lanes were searched adversarially. Exactly eight retained sources were opened, spanning seven publisher identities and including two primary research sources, three official-guidance sources, and two first-party product sources.","source_ids":["SRC1","SRC2","SRC3","SRC4","SRC5","SRC6","SRC7","SRC8"]}},"strict_success":true,"screen_survival":true,"remaining_research_value":"MODERATE","recommended_next_step":"With written authorization from the accountable control-system owner and independent safety/compliance review, preregister an offline three-arm matched-replay study for one non-safety-critical superseded overlay: current-active baseline, lifecycle-gated contribution-only shadowing, and age-only shadowing. Freeze the operating window and disturbance suite; define residual, coupling, spectral-separation, constraint, restoration, noninferiority, and metric-improvement thresholds before analysis; preserve signed configurations and logs; halt on any failed gate.","world_novelty_boundary":"The bounded public search found established lifecycle control of temporary changes and bypasses, automatic override expiration, automation-configuration versioning and restoration, safe controller switching, and model-based safe controller change. It did not find the complete proposed composition. This supports only a contrastive incremental research claim within the searched record, not world novelty, patentability, freedom to operate, market size, routine adoption, or realized impact."}