r-io does not model the Loire, a bridge or a barbecue as physical systems. It models the collaboration around them: the actors and their roles, the resources and their states, the objectives, the risks and actualities that threaten them, and the process deduced to treat them. The field reaches this model through sensors, CEP rules and 2L rules; the model reaches the field through tasks given to people.

The plain arrows are the loop that runs on the field. The dashed ones come from the projected space: the same rules played on what is foreseen, used by the supervision (alerts Foreseen) and by the deduction (deadlines, durations of the waits).

• Measures become facts. The CEP rules of a sensor raise the probability of a risk by thresholds and create the actuality when the risk becomes certain; a risk and the actuality it creates are never active together (see the causal chain).
• Resources have states. Each state of a resource declares the effect observed on the field in 2L; r-io deduces the state from the sensors (barbecue On or Off, pool Open, Henri On fire, Wet or Dead). Danger zones are drawn by 2L rules around what generates them.
• The plan is supervised. r-iota keeps the expected world of the deployed solution beside the field and its strategies measure the distance between them (continuous supervision).

Forecasts

• A forecast is a node of the model. The Core concept Forecast Predicts a sensor. Each publication is a snapshot issued at a date, over a horizon (24 h for the Vigicrues forecasts of Orleans), and holds an ensemble of curves: a low, a central and a high one (the 10 %, 50 % and 90 % quantiles of the forecaster).
• It is replayed into the projected space. The projected space is a hidden copy of the knowledge space where the situation at a future date is set from the forecasts, obtained by replaying on each forecast curve the rules of the model: the CEP rules of the sensors, the 2L rules and the cycle risk / actuality. An actuality is foreseen at a date when it appears on at least the share of curves set by Forecast certainty in the supervision dialog (50 % by default); a foreseen risk takes the probability it reaches on the central curve. Nothing in the projected space changes the field: it only informs.
• r-iota shows it. The supervision timeline goes on, dashed, to the horizon of the forecasts, with the projected moments; the Forecast tab lists what may appear, when, on which share of the curves, and when it is released (“Projection only · no operational effect”).
• The deduction uses it. With Include forecast, each preventive procedure is checked against the projected appearance of the problem it prevents, and the corrective is kept alone when the preventive would come too late. The waits of a plan (“wait until the flood has receded”) get a precise end when their 2L condition becomes true on the central curve, and every duration built on them narrows.
• The supervision watches it. Each new forecast is projected again; the prospective distance raises a Foreseen alert when a projected problem is not treated by the running plan.
• The scenarios play it. In r-iosemit a timeline carries planned forecasts beside the measures, and they can be muted (act 1 of Orleans plays the same flood with its four forecasts muted); r-iose draws them as a fan chart. See scenario timelines.

Extrapolation

• From two positions, a vector. For each person or group carrying a GPS, r-io keeps its last two distinct positions and derives its speed and heading. It goes on in a straight line, at constant speed, over a short horizon (10 minutes), and finds the danger zones it is in or will cross: the zones the resource is susceptible to and what generates them (a point resource, such as a barbecue, counts as a contact zone of 1.5 m). For each zone it gives the distance, the time and the date of arrival.
• Recomputed at each position. A child who turns toward the pool gives a new vector; a resource that stops is no longer heading anywhere. Nothing is published to the field: the extrapolation is read by the rules and by r-iota.
• The rules anticipate with it. The 2L function secondsToReach(zone) returns the seconds before the resource is in the zone (0 inside, −1 when it does not head there). The rules of a use case use it to raise a risk before the zone is reached; in the Barbecue, the burn risk of Henri reaches 66 % while he is still out of the zone.
• The race is shown. The Time race card of r-iota sets the arrival of the resource against the end of the action of the plan (see with and without action).
• It can be switched off. Extrapolate the trajectories in the supervision dialog turns off the service, the Time race and the anticipation together: the rules then fall back on what is on the field, which is how the Barbecue compares its second and third runs.

The three acts of Orleans play the same flood. Without forecast (act 1), r-io only reacts to the measures: the preventive closure is deduced at 18:00, the flood comes at 20:00 before it ends, the corrective takes over and its waits keep their modelled interval of 6 to 24 hours. With the forecasts (act 2), the same deduction sees the flood two hours ahead and refuses the preventive closure, whose main task would end at 20:47; the forecast of midnight then gives the waits a projected end and the expected duration of the plan goes from an interval to a precise value.

In act 3 a preventive closure alone is deployed on the first forecast. When the revised forecast projects the flood itself, the supervision raises a Foreseen alert: the running plan does not treat it. r-io deduces again from what was done and grafts the corrective procedure into the running process, without stopping it; the grafted procedure starts when the flood really comes.

In Orleans the operator decides. In the auto mode of the r-iota supervision, each new alert is treated without a human: r-iota deduces a solution and deploys it; when a solution is already running, the new treatment is grafted into it as an immediate branch; the tasks go to the closest available actor. The auto mode can act always, or only when an alert is due within a set horizon; Extrapolate the trajectories lets it act on what is coming, not only on what is there.

The Barbecue scenario plays the same story three times. A child, Henri, walks to a lit barbecue, then to an open pool; the scenario only reads the field to choose its tracks, so what r-iota does changes the ending:

• No supervision: Henri burns at 09:02:54, falls into the pool and dies at 09:05:23.
• Auto mode: the burn is seen only when it happens, too late; the drowning is treated at once, the task goes to Julie, the closest parent, the solution is adapted while it runs (rescue, then cardiac massage) and Henri is saved.
• Auto mode with extrapolation: at 09:01:34 Henri is still out of the danger zone, but his trajectory heads to it and the risk is at 66 %; the deduction starts at 09:01:41, the solution goes to Paul at 09:01:44 and the barbecue is off at 09:02:24, thirty seconds before the time Henri got burned in the first run: nothing happens.

• Before deciding: the time race. In the solution dialog and under the supervision bar, the Time race card of r-iota sets the time a resource needs to reach a danger zone (from its extrapolated trajectory) against the end of the action of the plan (moves and durations of its tasks), and reads In time · 26 s ahead or Too late.
• After the fact: the runs. While a scenario plays, r-iosemit reads r-io every two seconds, as any observer of the field could, and records each key moment with the settings of the supervision. The RUNS mode lists the runs and compares two of them moment by moment; Replay plays a run again with its own settings.

Guided scenarios: Orleans, act 1 · act 2 · act 3 · Henri at the barbecue. Each one is a sheet of the release plan, replayed before a release.

• A twin of an organization. The physical systems (the river, the bridge, the barbecue) appear through their sensors, states and the risks they carry, not through a physical model of their own.
• The action goes through people. The model acts on the field by giving tasks to people (r-io4U, the To Do List of r-ioga), who accept them and report their outcome; in the scenarios these people are played by r-iosemit. A collaboration is a sociotechnical system: the human step is part of the loop, not a gap in it.
• The origin of the data does not matter. r-iosemit is fully decoupled from r-io: a measure or a forecast it plays goes through the same channels (sensors, CEP rules, forecast snapshots) as a real feed would, and r-io cannot tell them apart. The scenarios therefore show the behaviour of the loop; how close the projection is to reality depends on the sensors, the forecasts and the thresholds of each use case.