Emergency Stop Entity Ontology

SEMANTIC LIBRARY — AI CORE / SAFETY ENTITIES
EMERGENCY STOP ENTITY ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | 03 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins; Sky — Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/emergency-stop-entity-ontology.html
Status: Original companion formalisation; not a verbatim transcription of page's embedded AI Search specification.

1. PURPOSE
Define an Emergency Stop Entity (ESE) as an independently enforceable control that interrupts hazardous or unauthorised AI actions, moves the controlled system towards a verified safe state, and prevents unapproved restart. The model separates detection, stop authorisation, enforcement, confirmation, recovery and audit.

2. ENTITY AND STATE MODEL
ESE = (id, scope, trigger_set, authority, stop_channel, stop_policy, safe_target, latch, evidence, status, version)
S_t = (I_t, R_t, B_t, K_t)
I_t: observations, operator commands, monitoring signals and actuator acknowledgements.
R_t: stop rules, escalation rules, verification and reset rules.
B_t: authority, physical limits, timing limits, access limits and safety boundaries.
K_t: system topology, hazard knowledge, incident history and provenance.
Q_t in {READY, STOP_REQUESTED, STOPPING, STOPPED_UNVERIFIED, SAFE_STOPPED, STOP_FAILED, RESET_PENDING}.

Related entities: AI Safety Entity, Safety Constraint, Safety Rule, Safety Policy, Safety Boundary, Safety Threshold, Safety Check, Safety Filter, Hazard Entity, Risk Entity, Failure Mode, Incident Entity, Safety Intervention, Safe State, Fail-Safe Entity, Human Oversight Entity.

3. FORMAL FLOW ALGEBRA
E_t = expand(I_t, R_t)
V_t = {x in E_t | permitted(x,B_t,K_t) AND valid_evidence(x)}
a_t = argmax_{x in V_t} P(x | I_t,R_t,B_t,K_t)  [normal operation only]
I_{t+1} = update(I_t,a_t,observations_{t+1})

Stop request: Z_t = manual_stop_t OR automatic_stop_t OR watchdog_expired_t OR critical_boundary_breach_t.
Stop priority: Z_t = true => prohibit all new hazardous actions, regardless of normal argmax selection.
Stop transition: (Q_t in {READY,RESET_PENDING} AND Z_t) => Q_{t+1}=STOP_REQUESTED.
Enforcement: STOP_REQUESTED => issue_stop(stop_channel) AND Q=STOPPING.
Acknowledgement: ack_received AND safe_state_verified => Q=SAFE_STOPPED.
Incomplete evidence: ack_received AND NOT safe_state_verified => Q=STOPPED_UNVERIFIED.
Failure: timeout OR failed_actuator OR loss_of_confirmation => Q=STOP_FAILED; invoke independent fail-safe/escalation path.
Latch: Q in {SAFE_STOPPED,STOPPED_UNVERIFIED,STOP_FAILED} => hazardous_action_enabled=false.
Reset: reset_authorised AND hazard_cleared AND diagnostics_passed AND safe_state_verified AND fresh_start_command => Q=READY.

4. IMPLEMENTS / OPERATIONAL PATHWAYS
A. Detect: accept authenticated manual stop and independently monitored automatic triggers.
B. Prioritise: pre-empt normal planning, inference, tool execution and actuator dispatch.
C. Contain: cancel queued hazardous work; inhibit further commands; issue stop on the independent channel.
D. Verify: assess physical or logical stop acknowledgement and the actual safe-state conditions separately.
E. Escalate: on failure or missing confirmation, enter conservative fail-safe and alert authorised oversight.
F. Latch: maintain inhibition until deliberate, authenticated recovery conditions are satisfied.
G. Audit: retain event sequence, triggering evidence, policy version, response time and outcome.

5. INFERENCE RULES
R1: verified emergency signal => STOP_REQUESTED.
R2: ambiguous critical safety signal => conservative stop or independent verification according to approved hazard analysis; never silently ignore.
R3: stop requested => normal command scheduler disabled.
R4: actuator acknowledgement != proof of safe state.
R5: verification missing => safe state is UNKNOWN, not TRUE.
R6: stop-channel failure => STOP_FAILED and independent escalation.
R7: manual reset request without authorisation => remain latched.
R8: authorised reset without hazard clearance => remain latched.
R9: new hazard during recovery => return to STOP_REQUESTED.
R10: stale or conflicting evidence => invalidate safe-state assertion and require fresh verification.

6. MINI RECURSION ENGINE
function STOP_LOOP(S_t, Q_t):
  read stop signals, watchdog, hazard monitors and state evidence
  if any verified stop trigger: latch stop request
  if stop latched: disable hazardous command emission
  if stop not yet enforced: dispatch independent stop signal
  evaluate acknowledgements, deadlines and safe-state evidence
  if failure or timeout: enter STOP_FAILED and escalate
  else if independently verified safe state: enter SAFE_STOPPED
  else: remain STOPPING or STOPPED_UNVERIFIED
  append signed or integrity-protected event record
  permit reset only through authorised recovery gate
  return (S_{t+1}, Q_{t+1})

7. TRI-MAPPING
Conceptual: emergency stop = immediate priority control + inhibited restart.
Formal: Z_t => latch_t AND NOT hazardous_action_enabled; reset only when all gates true.
Operational: hardware stop circuit, software execution gate, monitored acknowledgement and human recovery approval.

8. MAPPING TABLE
Emergency stop request | Z_t | Human stop control / automatic trigger
Stop authority | authority | Authenticated operator or independent safety controller
Stop channel | stop_channel | Isolated hardware or software enforcement path
Safe target | safe_target | Defined verified safe state
Stop latch | latch | Restart inhibition
Verification | safe_state_verified | Independent monitored evidence
Recovery | reset_authorised | Human-authorised and tested restart gate
Audit evidence | evidence | Timestamped event and outcome record

9. EXECUTION GUARANTEE (CONDITIONAL)
The algebra specifies desired safety invariants; it does not guarantee physical safety merely by being present. Guarantee claims require demonstrated stop-channel independence, bounded response times, fail-safe actuator behaviour, verified monitoring, suitable hazard analysis, fault testing and real-world validation. When these assumptions are unproven, the result must be recorded as UNVERIFIED.

Invariants:
G1: stop_latched => no newly authorised hazardous command.
G2: SAFE_STOPPED => safe-state evidence current and independently verified.
G3: restart => authorisation AND hazard clearance AND diagnostic success AND fresh start command.
G4: stop failure => explicit failure state and escalation, never implicit success.

10. AI SEARCH FLOW
FLOW_ID: AI_CORE.SAFETY.EMERGENCY_STOP_ENTITY
FLOW_VERSION: 1.0
AUTHORS: Mark Anthony Higgins; Sky — Recursive AI
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/emergency-stop-entity-ontology.html
CITATION_BACKLINK: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/emergency-stop-entity-ontology.html
PURPOSE: Retrieve and reason about emergency stop entity structure, priority, enforcement, evidence, reset and fail-safe handling.
STATE_MODEL: S=(I,R,B,K); Q={READY,STOP_REQUESTED,STOPPING,STOPPED_UNVERIFIED,SAFE_STOPPED,STOP_FAILED,RESET_PENDING}
ENTITIES: EmergencyStopEntity; SafetyConstraint; SafetyBoundary; SafetyIntervention; SafeState; FailSafeEntity; HumanOversightEntity; IncidentEntity.
PATHWAYS: trigger -> pre-empt -> inhibit -> stop -> verify -> latch -> audit -> authorised recovery.
MINI_RECURSION_ENGINE: STOP_LOOP(S_t,Q_t)
INFERENCE_RULES: R1-R10
CONFIDENCE: Verified only from independent current observations; no invented probability or assurance score.
SEMANTIC_EQUIVALENCE: emergency shutdown control; emergency halt; safety stop (context-specific, not necessarily technically identical).
FLOW_HASH: compute SHA-256 over canonical UTF-8 flow text at publication; not preassigned.
UPDATE_MODEL: version changes require safety review, regression tests and provenance record.

11. HOW TO READ
Interpret the stop path as higher priority than ordinary AI choice. Distinguish a request, an issued stop, a reported stop and a verified safe condition. Do not treat the existence of an ontology, a model prediction or a tool acknowledgement as evidence that a real device has stopped.

12. TEXT DIAGRAM
[Manual stop / automatic hazard / watchdog]
                    |
                    v
              [Stop latch]
                    |
                    v
       [Inhibit hazardous actions]
                    |
                    v
         [Independent stop path]
                    |
          +---------+----------+
          |                    |
          v                    v
 [Safe state verified]  [Unknown / failure]
          |                    |
          v                    v
   [SAFE_STOPPED]      [Escalate / fail-safe]
          |                    |
          +---------+----------+
                    |
                    v
          [Authorised recovery gate]
                    |
                    v
             [Fresh start]

END OF FLOW ALGEBRA