Vendor and Product Reality

Yokogawa CENTUM VP is the current generation of Yokogawa's DCS lineage, descended from CENTUM CS 3000 and carrying forward the design discipline that made the platform a fixture in Japanese, Korean, Middle Eastern, and Southeast Asian process plants. The architecture pairs Field Control Stations (FCS) running deterministic regulatory and sequence control with Human Interface Stations (HIS) for operator graphics and engineering workstations for configuration. VNet/IP, Yokogawa's real-time control network layered over standard Ethernet, provides the deterministic transport between FCS and HIS, with redundancy and self-healing built in.

ProSafe-RS is the companion safety instrumented system, certified to IEC 61508 SIL3, and is engineered to share a common engineering environment with CENTUM while preserving the architectural separation that safety standards require. The CENTUM/ProSafe-RS pairing is one of the few DCS/SIS combinations that is designed end-to-end by a single vendor for unified engineering, which is why the platform is overrepresented in greenfield projects with stringent safety cases.

Above the control layer, Yokogawa offers Exaquantum (plant historian), Exapilot (procedural automation), and the OpreX portfolio for asset management, advanced process control, and operations management. Cross-system coordination, between CENTUM units, between CENTUM and third-party DCS, between control and enterprise, is handled today through OPC UA, Modbus, dedicated gateways, and increasingly through the Exaquantum data layer. These are competent integrations. They are not, in any architectural sense, a primitive for cascade.

The Architectural Gap

The CENTUM model treats refusal as an exception. An interlock trips, a permissive fails, a control loop saturates, an operator declines a procedure step, each of these is logged as an alarm or a sequence-of-events record and surfaced to the operator. There is no architectural object that says "this refusal is itself an observation, with provenance, with a cascade target, and with admissibility semantics that propagate it upstream to whichever party or system needs to act on it."

The consequence is visible in every major incident review of the last two decades. Refusals are local; cascade is manual. When a downstream unit declines a feed because a quality limit is approaching, the upstream column does not learn this as a structured observation: it learns it because a panel operator picks up a phone and reduces a setpoint. When a ProSafe-RS interlock prevents a startup, the scheduling system at the enterprise layer learns about the refusal hours later, after operations rewrites the daily plan.

Cross-domain cascade is even weaker. A CENTUM-controlled unit interfacing with a third-party DCS, a packaged compressor skid, or a tank-farm SCADA system exchanges measurements and setpoints, but refusals do not propagate as refusals: they appear as missing data or stale values. The missing piece is a primitive in which refusal is itself a credentialed, propagable observation with explicit cascade semantics.

What The AQ Primitive Provides

Cascade propagation is the Adaptive Query primitive directed to the governance-chain-preserving projection of an observed disruption at one region of a physical-world topology to other regions of that topology, producing governed coordination directives at downstream regions that preempt, mitigate, halt, or otherwise coordinate the response to ongoing propagation. As disclosed, the primitive comprises a governance-credentialed topology graph whose nodes represent regions of a physical-world domain and whose edges represent propagation channels between nodes, maintained by one or more governance authorities with domain responsibility; a per-edge propagation function defining how a disruption at a source node projects to connected nodes with governance-policy-defined transit, attenuation, transformation, or amplification characteristics; a per-node aggregation function defining how multiple incoming propagation contributions combine at a receiving node; a cascade-trigger ingest interface that consumes governed disruption observations and maps them to originating cascade nodes; a cascade-computation engine that executes the propagation function across the topology to produce per-node predicted affected regions, magnitudes, and arrival times; a cross-domain cascade composition mechanism combining propagation across two or more topology domains; a cascade-authority resolution mechanism resolving responsibility when a topology spans multiple governance authorities; a preemptive-mitigation directive generator producing governed coordination directives routed to downstream agents; a cascade-halting and containment mechanism specifying governance-policy-defined stop-conditions under which propagation is actively interrupted; a refusal and upstream-coordination mechanism; a topology-learning and adaptive-refinement mechanism updating the graph and functions from observed outcomes; and a cascade-lineage recorder recording each topology reference, propagation computation, directive emission, mitigation, halting event, refusal, and topology update in the governance-chain lineage field.

A skilled implementer can build this over an existing control fabric: model the physical domain as a credentialed node-and-edge graph, attach a propagation function to each edge and an aggregation function to each node, ingest existing disruption and interlock events as cascade triggers, and run a computation engine that emits per-node forecasts and governed mitigation directives. The primitive is disclosed as operating across power, transportation, fluid, thermal, structural, biological, communication, logistics, economic, and cyber-physical topologies, and admits extension to any future topology class through governance-policy-defined topology registration without architectural modification. In the process-industry embodiment relevant to CENTUM, a refusal event carries the identity of the refusing element, the predicate that was violated, the credential under which the refusal was issued, and the cascade target: the set of upstream and cross-domain consumers that must be notified and may need to act.

Refusal-as-first-class-observation means that a CENTUM interlock trip, a ProSafe-RS demand, a control-loop saturation, or a procedural decline is emitted on the same observation channel as a temperature reading or a flow measurement, with the same provenance and admissibility guarantees. Downstream consumers, historians, advanced process control, enterprise scheduling, receive refusals as structured events rather than as alarm noise.

Upstream coordination is the second capability. When a downstream receiving agent cannot or should not apply a proposed mitigation, the refusal is itself a first-class governed observation that lets upstream agents seek alternative mitigations, solicit additional corroborating observations, or escalate to higher-authority coordination. The disclosed refusal-reason classifications include, without limitation, evidential-insufficiency, capability-exceedance, cost-threshold, priority-conflict, authority-insufficiency, dispositional, and safety-boundary refusals, plus composite and any governance-policy-defined reason. Each upstream consumer applies its own admissibility logic to decide whether to throttle, pause, continue, or propose an alternative. The cascade is structural, not procedural: it does not depend on a panel operator noticing and acting, and a rejected mitigation triggers governance-chain-preserving escalation rather than silent failure.

Cross-domain cascade extends the same semantics across boundaries that CENTUM does not own. A refusal originating in a CENTUM unit propagates into a third-party DCS, a packaged skid controller, a tank-farm SCADA, or an enterprise scheduling system as a refusal, carrying its credential and predicate, rather than as a degraded measurement. Each receiving domain admits the refusal under its own credential rules and cascades it further as appropriate.

Composition Pathway

CENTUM VP composes with the cascade-propagation primitive at the Exaquantum and OPC UA layer, without modification to FCS logic or ProSafe-RS engineering. Existing interlock trips, permissive failures, sequence aborts, and operator declines are mapped to refusal observations as they emit. The mapping is configuration, not control-logic change: the refusing element is named, the predicate is captured from the existing engineering, and the cascade target is declared in the composition layer.

Outbound, refusals propagate over OPC UA and over Yokogawa's standard north-bound interfaces to the historian, to APC packages, and to enterprise systems. Inbound, refusals originating in adjacent third-party systems, a Honeywell or Emerson DCS on a neighboring unit, a packaged skid controller, a tank-farm SCADA, arrive as cascade observations and are presented to CENTUM operators and to upstream loops as structured events with provenance.

For ProSafe-RS, the composition respects the architectural separation that SIL3 certification requires. Refusals from the SIS are emitted on the Exaquantum side of the boundary, carrying credentials that identify them as safety-originated; no cascade observation crosses back into the SIS logic. The result is that safety demands cascade upstream and across domains as observations, without compromising the integrity argument.

Commercial and Licensing Implication

Adaptive Query holds the disclosure covering cascade propagation as an architectural primitive: refusal as a first-class governed observation, upstream coordination, and cross-domain cascade composition over a governance-credentialed topology. Yokogawa's CENTUM VP, ProSafe-RS, Exaquantum, and OpreX product lines are strong closed-loop and safety platforms; alarm management, sequence-of-events recording, and OPC UA integration are competent capabilities that address a different layer than this credentialed-cascade primitive.

The commercial implication for Yokogawa and for Yokogawa customers is direct. Operations that depend on structured cascade, integrated complexes where a refusal in one unit must propagate through a multi-vendor control fabric, regulated industries where the audit trail of refusals is itself a deliverable, and advanced operations programs that aim to close the loop between control and enterprise can be delivered on the CENTUM stack today only through bespoke per-project work. Composing with the AQ primitive provides a single substrate against which those programs compose, with the architectural definition aligned. For Yokogawa, it is a path to extend the CENTUM footprint at exactly the boundaries where modern operations programs increasingly live.

Disclosure Scope

The invention described here, the cascade propagation primitive of the governed spatial mesh, is disclosed in U.S. Provisional Application No. 64/049,409. Every statement in this article about what the primitive is and does, including the governance-credentialed topology graph, per-edge propagation functions, per-node aggregation functions, the cascade-computation engine, preemptive-mitigation directives, cascade halting and containment, refusal as a first-class governed observation with upstream coordination, cross-domain cascade composition, and cascade-lineage recording, traces to that disclosure. This article is a dated public disclosure tied to that filing.

References to Yokogawa CENTUM VP, ProSafe-RS, Exaquantum, Exapilot, OpreX, VNet/IP, and to any other named product, vendor, standard, protocol, or market are provided solely as external context to situate the invention. They are the property of their respective owners, are described at the architecture level from publicly known information, and are not claims of U.S. Provisional Application No. 64/049,409. Nothing in the competitor or market framing should be read as an assertion of what any third party's product does or does not do beyond widely known, architecture-level fact, and nothing here is legal or investment advice.