Acquit.ai
← Back to Insights Services Request an Invite →
Cyber-Physical Safety

Safety Shield for Cyber-Physical Systems

Cobots, drones, and AI-orchestrated factories generate risk that updates by the second. Static risk graphs were designed for static systems. S-ARPN integrates safety into the dispatcher's objective function as a continuous constraint, and produces the closed-loop record that ties detected risk signals to documented response.

Colin McNamara · April 2026

Risk Graphs Don't Move

The cell was certified at commissioning. The HAZOP study was approved. The Performance Level was assigned. None of those documents have updated since the last operator quit, the last firmware patch, or the last shift change. The plant is running on snapshots of a system that no longer exists.

Current State

  • Risk graphs (ISO 12100) computed once at design time and filed
  • Performance Levels (ISO 13849, PLa-PLe) and SIL ratings are static categories
  • HAZOP and LOPA studies refresh on a quarterly cadence at best
  • Safety PLCs trip on individual thresholds, not on patterns across thresholds
  • Operator state (fatigue, training currency, shift load) is excluded entirely
  • AI dispatchers, MES, and fleet orchestrators optimize throughput with no safety penalty term

Safety Shield

  • Continuous S-ARPN scoring that recomputes every cycle
  • Behavioral impairment as a first-class scoring dimension
  • Escalation coupling for clustered anomalies across sensor, maintenance, and operator domains
  • Scalar safety penalty injectable into any scheduling or dispatch optimizer
  • Compartmentalized scoring that auditors can verify without exposing per-worker monitoring data
  • Quantified protective measures with scored risk reduction

The PLC trips when one number crosses a line. It never sees that five other numbers were drifting at the same time.

Five Dimensions, Adapted for the Plant Floor

Classical industrial FMEA gives you S, O, and D. That works for a system whose operator is a constant. The plant floor is not a constant. S-ARPN keeps severity and probability, splits exposure from detection, and adds the two dimensions that matter most when the operator is human or the controller is learning.

TS
1 – 10
Threat Severity
Worst-case physical or asset outcome from the failure mode. 4 = recordable. 7 = lost-time injury. 9 = amputation or life-threatening event. 10 = fatality or catastrophic equipment loss. Severity comes from MIL-STD-1629A and is the same dimension safety engineers already use, scored against the worst credible outcome rather than the most likely one.
P
1 – 10
Probability
Likelihood given current operating state, not nameplate. Conditioned on shift hour, recent near-miss density, sensor health, maintenance backlog, and known anomaly clusters. Static failure rates are inputs to P, not P itself.
V
1 – 10
Vulnerability
How exposed the worker or asset is to the failure right now. Worker proximity to the collaborative zone, barrier integrity, light curtain minimum-distance compliance (ISO 13855:2024), redundant sensor health, ISO 10218-2:2025 speed and separation monitoring state. For drones: VLOS versus BVLOS, populated overflight, link redundancy, current TFR posture, EASA SORA ground-and-air-risk envelope. Protective measures directly reduce V, which is why V is split out from D.
BI
1.0 – 3.0
Behavioral Impairment
Operator state for human-in-the-loop systems. Autonomous reliability state for unmanned systems. Human inputs: fatigue index, training currency, shift duration, distraction signals, time-since-break. Autonomous inputs: model drift, sensor degradation, adversarial input susceptibility, controller version churn. Classical FMEA assumes a trained operator following procedure. Real production has Friday afternoon, two people doing what should be three, and a firmware update from Tuesday that nobody validated. BI is what makes Friday afternoon different from Tuesday morning.
EC
1 – 5
Escalation Coupling
How many anomalies are clustering in time across independent domains. A single sensor drift is noise. A drift, an open work order, an operator manual override, and a speed deviation in the same shift is a coordinated failure pattern. EC captures what makes near-misses become incidents: not any single event, but the convergence.
S-ARPN = TS × P × V × BI × EC
Maximum: 10 × 10 × 10 × 3.0 × 5 = 15,000
Tier S-ARPN Range Required Response Timeline
IMMEDIATE > 3,000 Safe state. E-stop or safety-rated stop. Evacuate cell. Drone: halt mission, RTL or autoland. Seconds
CRITICAL 1,500 – 3,000 Slow mode. Supervisor required. Drone: reroute, pause mission, hold position. Minutes
HIGH 500 – 1,500 Speed and separation monitoring tightened. Predictive maintenance work order opened. Operator briefed. Hours
MODERATE 100 – 500 Watch list. Increased telemetry sampling. Trend reviewed at shift change. Shift
LOW < 100 Log and trend. No operational change. Continuous

The Industrial Escalation Ladder

Failures escalate in predictable patterns. Velocity matters more than position. Six rungs in a week is a different machine than rung 2 for six months. Safety Shield tracks position and rate of change.

L1
Sensor drift within tolerance
LOW
L2
Sensor anomaly out of tolerance
MODERATE
L3
Maintenance work order opened
MODERATE
L4
Operator manual override
HIGH
L5
Multiple parameter deviation simultaneously
HIGH
L6
Near-miss reported
CRITICAL
L7
Safety-rated monitored stop triggered
CRITICAL
L8
Forced trip (PLC safety function activated)
CRITICAL
L9
Property damage or equipment loss
IMMEDIATE
L10
Personal injury
IMMEDIATE

The ladder is not a checklist. It is a velocity meter. The same machine at L3 for a quarter is healthy. The same machine going L1 to L5 in a week is not.

Safety as a Dispatcher Constraint

Safety Shield sits across the scheduling and dispatch optimizer as a continuous constraint. The dispatcher cannot recommend a task assignment, mission plan, or cell setpoint without Safety Shield scoring it. The architecture mirrors the safety envelope used in autonomous-vehicle planning (Shalev-Shwartz et al.), generalized to industrial control.

throughput
tardiness
changeover_cost
safety_penalty
=
ScheduleValue
ScheduleValue = throughput − tardiness − changeover − safety_penalty
Drone fleets: mission_value − fuel − airspace − safety_penalty. Cobot task planners: cycle_time_savings − retooling − safety_penalty. The safety penalty enters the objective with a configurable weight; high-risk states reduce the value of otherwise attractive assignments.

What the Dispatcher Sees

  • safety_penalty as a scalar (e.g., 1,814 unit-cost equivalents)
  • Tier label (LOW / MODERATE / HIGH / CRITICAL / IMMEDIATE)
  • Recommended downshift action when tier elevates
  • Penalty weight tunable for cell criticality

What the Dispatcher Never Sees

  • Per-worker fatigue inputs or shift-roster data
  • Specific sensor readings or maintenance records
  • BI dimension components or operator identity
  • Escalation ladder position, rate, or coupled-anomaly map

Compartmentalization has a labor-relations payoff that classical safety architectures lack. Auditors get evidence that safety was scored and that the optimizer was constrained. They do not get a per-worker surveillance feed. That separation is what lets the system be deployed inside facilities where workforce monitoring would otherwise be a nonstarter.

A Hypothetical Friday Afternoon

A composite scenario, drawn from generic palletizing-cell patterns, that walks through a five-day convergence into a CRITICAL S-ARPN. The math is illustrative. The underlying pattern is recognizable to any plant-floor safety engineer.

Scenario · Composite
Palletizing cobot, Friday, 14:30. Five days, four coupled signals.

Monday. Encoder on the cobot's wrist axis begins drifting outside its calibration window. Drift rate: 0.04% per shift. Within tolerance. PLC sees nothing. Ladder rung L1. S-ARPN: 48 (LOW).

Wednesday. Drift rate accelerates to 0.18% per shift, crossing the warning threshold. Maintenance opens a work order, scheduled for the following Tuesday. The cell continues to run. The HAZOP did not contemplate cumulative drift across shifts. Ladder rung L3. S-ARPN: 312 (MODERATE).

Friday morning. One of the three operators on the palletizing line calls out sick. The line runs with two operators doing the work of three. Workload, distraction signals, and time-since-break all elevate. BI rises from 1.0 to 1.8.

Friday, 14:15. The remaining operator manually overrides a speed-and-separation monitoring threshold to clear a jam. The override is logged and auto-clears. Four coupled risk signals are now active in the same shift: encoder drift (since Monday), open work order (since Wednesday), understaffed shift (since this morning), and a speed override (just now). Ladder rung L5. EC rises to 3.

Friday, 14:30. Safety Shield recomputes.

TS (pinch-point injury at end-effector, lost-time): 8
P (drift accelerating + work order pending + override): 6
V (operator reaching past safety mat to clear stack): 7
BI (Friday + understaffed + workload + late shift): 1.8
EC (drift + work order + understaffed + override): 3
S-ARPN = 8 × 6 × 7 × 1.8 × 3 = 1,814   CRITICAL

Automatic response. The dispatcher receives a safety_penalty scalar. The cell drops to slow mode (50% rated speed). Supervisor is paged. The pending Tuesday work order is pulled forward to today. The affected operator gets a forced break and the line is reloaded with a third hand from an adjacent cell. The encoder is replaced before the cell returns to full speed.

The counterfactual. The point is earlier intervention from pattern detection, not certainty. In a facility that treats design-time risk assessment as the only operational control, a multi-domain convergence like this can remain invisible until a threshold trip or near miss forces post-hoc review. Pattern-aware scoring surfaces the convergence before the control stack reaches its final protective trip.

The documentary consequence. If an incident occurred during deployment, the record would show every step time-stamped, hashed, and retained: encoder drift Monday, work order Wednesday, S-ARPN tier elevation Friday afternoon, automatic slow-mode, supervisor page, work order pulled forward, operator rotated, encoder replaced before resumption. The record supports a closed-loop reasonable-care narrative: detection routed to a decision-maker, tied to documented mitigation, preserved in admissible form. The static-risk-graph alternative produces an 18-month-old HAZOP and a Performance Level certificate. Evidence of design-time intent, not evidence of operational care.

Composite scenario for illustration. No real facility, no real injury, no real operator. The five-dimension math is the methodology, not a forensic claim.

The Closed-Loop Evidentiary Record

Continuous safety scoring is not a regulatory safe harbor. It is an evidentiary discipline. Its legal value lives in the chain: hazard identified, score computed, threshold crossed, alert routed, decision made, abatement verified, record preserved.

Negligence and product-liability defense both turn on what the organization knew and what the organization did about it. The Restatement (Third) of Torts §§ 3 and 7 frame reasonable care under the circumstances; § 29 limits liability to harms resulting from the risks that made the conduct tortious. The OSHA General Duty Clause (29 U.S.C. § 654(a)(1)) applies to recognized workplace hazards likely to cause death or serious physical harm, where feasible and effective measures can materially reduce the hazard. Both frameworks make closed-loop evidence legally relevant when it shows that a risk signal was routed to a responsible decision-maker and tied to documented mitigation before an incident.

What the Closed Loop Produces

  • Time-stamped tier history generated in ordinary operations, not reconstructed after an incident, supporting a business-record foundation under Fed. R. Evid. 803(6) with custodian certification under Fed. R. Evid. 902(11)
  • Hash-anchored exports of scoring inputs, thresholds, model versions, and outputs, with electronic-process and hash-copy authentication available under Fed. R. Evid. 902(13) and 902(14)
  • Alert routing, operator acknowledgments, and override records linking signal reception to a responsible decision-maker
  • Work-order linkage that ties the signal to documented mitigation, not just awareness
  • Preservation controls designed to support reasonable-step analysis under Fed. R. Civ. P. 37(e)

What Score-Alone Does Not Produce

  • Score without acted-on response can prove the operator recognized the hazard and continued without reasonable controls
  • Safe harbor: continuous scoring is an evidentiary discipline, not a regulatory shield. Compliance with ISO 12100 / ISO 13849 baseline remains the floor
  • Verified premium credit: auto and fleet telematics are priced into premium today; broader industrial-line credit for continuous safety scoring is emerging, not yet common practice
  • Privilege: tier history is a business record. Treat it accordingly from day one

The legal value is not the score. The legal value is the record of what happened next.

Protective Measures Register

Every protective measure has a quantified impact on the S-ARPN score. The register tracks status and recommends measures that would move the score below the next tier threshold. Most industrial measures already exist on the plant floor. Safety Shield assigns them weights so the optimizer can reason about which measures matter for the current state.

ID Measure Reduces Notes Status
PM-I-001 Light curtain commissioning verified V (−2) ISO 13855 minimum-distance compliant DONE
PM-I-002 Cobot PFL parameters tuned TS (−2) ISO 10218-2:2025 force and pressure thresholds (incorporates former ISO/TS 15066 collaborative-application content) DONE
PM-I-003 Speed and separation monitoring active V (−2), P (−1) Real-time human position tracking DONE
PM-I-004 Operator fatigue model online BI (−0.5) Shift-roster + time-since-break inputs ACTIVE
PM-I-005 Predictive maintenance work order auto-triggered P (−1) Drift-rate threshold cross opens CMMS ticket ACTIVE
PM-I-006 Sensor redundancy (1oo2D) V (−1) Diagnostic coverage > 90%, IEC 61508 ACTIVE
PM-I-007 BVLOS C2 link redundancy (drone) V (−2) Cellular + RF backup, lost-link procedure tested PENDING
PM-I-008 Geo-fence current to active TFR; PNT integrity check P (−1) 14 CFR Part 107 airspace; NIST IR 8323 Rev. 1 PNT cybersecurity PENDING
PM-I-009 Controller firmware regression suite BI (−0.3) Reduces post-update model drift risk PENDING

Protective measures already exist on every modern plant floor. What's missing is a model that knows which measure matters for which state, and an optimizer that downshifts when the right measures aren't active.

Where the Math Pays

Any system that recommends actions on a cyber-physical loop needs to understand whether those actions raise physical risk. Verticals and adjacencies where Safety Shield maps cleanly to existing architecture.

Collaborative Robotics

  • Augments ISO 10218-2:2025 power-and-force-limiting and speed-and-separation-monitoring (incorporating former ISO/TS 15066) with continuous behavioral scoring
  • Cell drops to slow mode automatically when BI rises above threshold
  • Operator-paired cobots get a fatigue-aware envelope, not just a static safety zone

Drone Operations and BVLOS

  • Combines weather, battery, airspace, link health, and operator state into one scalar
  • Mission planner cannot dispatch above tier threshold
  • Lost-link and TFR-incursion risk priced into the same envelope

Industrial AI Orchestration

  • MES and dispatch systems receive a safety penalty term that integrates with existing throughput optimizers
  • AI scheduling no longer has to choose between safe and optimized; it optimizes inside a continuously updated safety envelope
  • Auditors verify the safety penalty was applied without seeing per-worker monitoring data

Process Plants (extension)

  • HAZOP and LOPA outputs become inputs to continuous P scoring rather than terminal artifacts
  • Independent Protection Layers credited as V reductions in the live score
  • SIL-rated functions remain authoritative; S-ARPN sits above them as soft constraint

Operational Assurance and Audit Records

  • Closed-loop tier history, alert routing, and abatement linkage support a business-record foundation under FRE 803(6); custodian and electronic-process certifications available under FRE 902(11), 902(13), and 902(14)
  • Restatement (Third) Torts §§ 3 and 7 reasonable-care record; § 29 scope-of-liability record tying treated risk to alleged harm
  • OSHA General Duty Clause (29 U.S.C. § 654(a)(1)) feasible-abatement record
  • EHS director, risk officer, and audit-team engagement alongside plant engineering

Insurance Underwriting Inputs

  • Risk-engineering inputs to property, equipment-breakdown, and casualty carriers running IoT loss-prevention programs
  • Underwriting differentiation for well-managed risks where continuous-telemetry evidence supports placement
  • Auto and fleet telematics priced into premium today; industrial-line premium credit for continuous safety scoring remains unverified as broad market practice

What Each Standard Contributes

S-ARPN is a synthesis. The individual ingredients exist in their home domains; the recipe is what's new. Each dimension and each architectural decision traces to a recognized standard or published method.

MIL-STD-1629A
Foundational FMECA. Source for severity scoring, criticality matrix, and the discipline of decomposing systems into discrete failure modes. Canceled August 4, 1998 with no DoD superseding document. Current industry FMEA practice is anchored separately in the references below, not as DoD replacements.
SAE J1739_202101 / IEC 60812:2018
Current FMEA/FMECA practice for design and process. Direct contemporary equivalents for the severity, occurrence, and detectability decomposition. Industry standards; not DoD-issued replacements for MIL-STD-1629A.
ISO 12100:2010
Type-A umbrella standard for machinery risk assessment. Baseline language for hazard identification and risk estimation. Static, design-time framework with no AI, cybersecurity, or operational scoring.
ISO 13849-1:2023
Safety-related parts of control systems. Performance Levels (PLa-PLe). Capability rating, not continuous score; serves as static input to V dimension.
ISO 13855:2024
Positioning of safeguards relative to human approach. Stopping-distance plus safety-distance plus intrusion-factor. Direct V-dimension input for light curtains, mats, two-hand controls, and interlocking guards.
IEC 61508:2010 (Ed. 2.0)
Generic functional safety. Safety Integrity Levels (SIL), safety lifecycle, target failure-rate bands. Capability rating; feeds V and EC.
IEC 62061:2021 (Ed. 2.0)
Sector application of IEC 61508 to machinery safety-related control systems. Caps at SIL 3 for the machinery sector.
IEC 61511:2016
Process-industry implementation of IEC 61508 for safety instrumented systems (SIS). Required when S-ARPN scope includes process plants.
IEC TR 63069:2019
Safety and cybersecurity co-engineering for industrial process measurement, control, and automation. Bridge between IEC 61508 and IEC 62443. Anchors EC cross-domain coupling.
ISO 10218-1:2025 / ISO 10218-2:2025
Industrial robot safety. The 2025 update incorporates former ISO/TS 15066 collaborative-application content. Speed-and-separation monitoring, monitored standstill, power-and-force limiting. Direct V and TS inputs for robotic cells.
ANSI/A3 R15.06-2025
US national adoption of ISO 10218-1:2025 / ISO 10218-2:2025. RIA brand replaced by Association for Advancing Automation (A3), September 2025. Same structural inputs, US compliance frame.
ANSI/RIA R15.08-1:2020 / ANSI/A3 R15.08-2:2023
Industrial mobile robots and their systems. AMR types A/B/C, navigation safety, integration with cell controllers. Distinct from service-robot standards.
UL 3100 Edition 1 (2021)
Automated Mobile Platforms (AMPs). Battery-operated platforms with or without payload, for indoor-only or outdoor commercial/industrial use. Fire, shock, batteries, object detection-and-avoidance, payload integration. Last revised September 15, 2025. Industrial application companion to R15.08.
ANSI B11.0 / B11.20
US machinery risk assessment (B11.0) and integrated manufacturing systems (B11.20). Companion frameworks for risk decomposition feeding TS, P, and V.
HAZOP / IEC 61882:2016
Hazard and operability study. Guide-word-based deviation enumeration. Qualitative; outputs become inputs to continuous P scoring rather than terminal artifacts.
LOPA (CCPS)
Layer of Protection Analysis. Independent Protection Layers credited as V reductions in the live score. EC's cross-layer coupling departs from LOPA's IPL-independence assumption.
API RP 754 (3rd ed., 2021)
Process safety leading and lagging indicators. Four-tier indicator framework, scoped to refining and petrochemical operations. Adjacent reference for indicator-based safety programs, not a continuous-score or optimizer-constraint standard.
ISO/IEC TR 5469:2024
Functional safety and AI. Properties, risk factors, and processes for AI inside safety-related functions. International reference Safety Shield must distinguish against.
UL 4600 Ed. 3 (2023)
Goal-based safety case for autonomous products operating without human supervision. Technology-agnostic. Different artifact category from S-ARPN: assurance argument versus quantitative continuous score.
Shalev-Shwartz et al. RSS (2017)
Responsibility-Sensitive Safety. White-box mathematical model for autonomous-vehicle safety assurance. Source pattern for the constraint envelope conditioning planner output. arXiv:1708.06374.
IEEE 2846-2022
Standard for Assumptions in Safety-Related Models for Automated Driving Systems. Builds on RSS lineage as a technology-neutral assumptions framework. Active; Amendment 2846a-2025 in progress.
14 CFR Part 107
FAA baseline civil sUAS operations. Sub-55-lb, 400 ft AGL, VLOS. Defines V-dimension default envelope for small drones.
14 CFR Part 108 (NPRM, 90 FR 38212)
FAA/TSA proposed BVLOS framework with performance-based rules and UTM-support requirements. NPRM published August 7, 2025; comment period reopened January 28, 2026. No final rule as of April 2026; eCFR still lists Parts 108-109 as reserved. Cite only as proposed regulatory context.
EASA SORA 2.5
Specific Operations Risk Assessment. ED Decision 2025/018/R introduced the SORA 2.5 package on 15 September 2025; SORA 2.0 remains in force in parallel. Quantitative ground risk plus air risk plus containment plus SAIL classification. Decomposition mirrors S-ARPN axes for drone V-dimension reductions.
ASTM F38 (sUAS portfolio)
36-standard portfolio for small UAS design, performance, airworthiness, flight operations, and operator qualifications. Includes F3322-24a (parachute recovery), F2910 (specification), F3002 (training).
NIST IR 8323 Rev. 1
Cybersecurity profile for positioning, navigation, and timing (PNT) services. GPS spoof, GNSS jam, time-source integrity. Inputs to V (autonomous integrity) or EC (cross-domain coupling), not human BI.
Human Factors literature
Fatigue indices, vigilance decrement, shift-cycle effects (HOS, FRMS, FRA frameworks). Source for BI inputs in human-in-the-loop systems. Distinct from per-worker surveillance data.

What's original is the integration: a continuous scalar that combines severity, conditioned probability, exposure-with-vulnerability, behavioral or autonomous reliability state, and cross-domain anomaly coupling, scored every cycle, presented to a scheduling optimizer as a soft constraint, and compartmentalized so that downstream consumers see a number rather than the underlying telemetry. No single standard does that. The recipe is the contribution.

Static Risk Graphs Were Designed for Static Systems

The S-ARPN scoring methodology is open source. pip install safety-shield · GitHub · PyPI

Request an Invite
Related: Safety Shield for Personal Threat Scenarios →
Related: The ARPN Framework →

Two conversation tracks: industrial pilots (integrators, plant safety, drone fleet operators, AI orchestration teams) and assurance and risk engineering (EHS directors, risk officers, brokers, audit teams).

S-ARPN Scoring Methodology and Safety Shield Architecture © 2026 Colin McNamara / Acquit.ai. Licensed under Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0). Attribution required for academic and professional use. Commercial licensing: colin@acquit.ai