NOVUS

ZeroState is a second check before anyone opens a pipe in a refinery or chemical plant. THE PROBLEM Before maintenance, every valve feeding a line must be closed, the line vented, and the isolation proved. When a valve leaks or an instrument lies, a worker opens a pipe still full of hot, toxic or flammable fluid. US Chemical Safety Board investigations show it again and again: at BP Amoco Augusta (2001) a plugged gauge read zero and 3 workers were killed; at Tosco Avon (1999) passing valves killed 4; at Giant Ciniza (2004) a valve was open while the crew believed it was closed. Lockout/tagout is OSHA’s 4th most-cited standard (2,177 citations in FY2025). Today’s permit software records what someone declared, and camera tools check that a lock is on a valve. Nothing checks whether the energy is actually gone. WHAT ZEROSTATE DOES A technician says what they are about to open. ZeroState loads the confirmed isolation plan and checks every step as it is done, against the plant’s own live data (Modbus, OPC UA) and a camera. It trusts no single instrument: it compares the control system’s valve feedback with flow, pressure and a pressure-hold test, and with a camera reading of the valve’s own display. When the witnesses disagree, it says STOP with the evidence. It also checks the plan itself (every path closed, nothing boxed in) and the process (steps in order, a second person verifies). It is read-only by network design, it never says “safe”, and a person always signs. META MODELS Muse Spark reads each valve display from the camera frame and SAM 3.1 finds the display. Muse Voice Transcribe lets a gloved technician mark steps by voice. Muse Spark turns an isolation list or a photo of one into a draft plan a person confirms, and explains a STOP using only measured evidence. The verdict itself stays in deterministic code: models add evidence and objections, never approval. RESULTS (sealed before running) 180 live jobs on two simulated plants, each batch sealed with a hash before the first job: 0 of 180 dangerous misses (said “no discrepancy” when the line was not isolated) 1 of 46 clean jobs stopped by mistake 0 writes to the plant, counted by a network monitor Baselines on 65 jobs: a simple gauge check missed 11 small leaks; Muse Spark on its own missed none but wrongly stopped 7 of 16 clean jobs, which is why the verdict is not left to a model. Camera reading: 398 of 400 displays within 1 %, none wrong. WHAT WAS BUILT DURING THE EVENT Pre-existing: the GRFICSv3 chemical plant simulator (Fortiphyd Logic, open source, GPL v3), which we patched to add sensor faults and leaks. Built Oct 31 to Nov 4: ZeroState, a second plant (a nitrogen gas line over OPC UA), the sealed benchmark and the website. Limits: both plants are simulators and the camera is simulated; voice is below our own accuracy target. Next step: a pilot on real site data. Try it, no key needed: https://zerostate-bay.vercel.app