Auto sync: 2025-10-20 12:44:27 (5 files changed)
M .sessions/Journal.vim M Writing/ERLM/main.tex M Writing/ERLM/state-of-the-art/v5.tex A Writing/Journal/JRNL-20251015-204549.md A Writing/Journal/JRNL-20251017-193513.md
This commit is contained in:
commit
ded8626fa1
@ -17,10 +17,52 @@ badd +1 ~/Documents/Dane\'s\ Vault/Journal/2025_07_30.md
|
|||||||
badd +10 JRNL-20250904-135850.md
|
badd +10 JRNL-20250904-135850.md
|
||||||
badd +96 JRNL-20251003-174601.md
|
badd +96 JRNL-20251003-174601.md
|
||||||
badd +14 journal_config.txt
|
badd +14 journal_config.txt
|
||||||
|
badd +95 JRNL-20251012-210736.md
|
||||||
argglobal
|
argglobal
|
||||||
%argdel
|
%argdel
|
||||||
edit journal_config.txt
|
edit JRNL-20251012-210736.md
|
||||||
|
let s:save_splitbelow = &splitbelow
|
||||||
|
let s:save_splitright = &splitright
|
||||||
|
set splitbelow splitright
|
||||||
|
wincmd _ | wincmd |
|
||||||
|
vsplit
|
||||||
|
1wincmd h
|
||||||
|
wincmd w
|
||||||
|
let &splitbelow = s:save_splitbelow
|
||||||
|
let &splitright = s:save_splitright
|
||||||
|
wincmd t
|
||||||
|
let s:save_winminheight = &winminheight
|
||||||
|
let s:save_winminwidth = &winminwidth
|
||||||
|
set winminheight=0
|
||||||
|
set winheight=1
|
||||||
|
set winminwidth=0
|
||||||
|
set winwidth=1
|
||||||
|
exe 'vert 1resize ' . ((&columns * 93 + 93) / 186)
|
||||||
|
exe 'vert 2resize ' . ((&columns * 92 + 93) / 186)
|
||||||
argglobal
|
argglobal
|
||||||
|
balt journal_config.txt
|
||||||
|
setlocal foldmethod=manual
|
||||||
|
setlocal foldexpr=0
|
||||||
|
setlocal foldmarker={{{,}}}
|
||||||
|
setlocal foldignore=#
|
||||||
|
setlocal foldlevel=0
|
||||||
|
setlocal foldminlines=1
|
||||||
|
setlocal foldnestmax=20
|
||||||
|
setlocal foldenable
|
||||||
|
silent! normal! zE
|
||||||
|
let &fdl = &fdl
|
||||||
|
let s:l = 95 - ((21 * winheight(0) + 32) / 64)
|
||||||
|
if s:l < 1 | let s:l = 1 | endif
|
||||||
|
keepjumps exe s:l
|
||||||
|
normal! zt
|
||||||
|
keepjumps 95
|
||||||
|
normal! 0
|
||||||
|
wincmd w
|
||||||
|
argglobal
|
||||||
|
if bufexists(fnamemodify("journal_config.txt", ":p")) | buffer journal_config.txt | else | edit journal_config.txt | endif
|
||||||
|
if &buftype ==# 'terminal'
|
||||||
|
silent file journal_config.txt
|
||||||
|
endif
|
||||||
balt JRNL-20251003-174601.md
|
balt JRNL-20251003-174601.md
|
||||||
setlocal foldmethod=manual
|
setlocal foldmethod=manual
|
||||||
setlocal foldexpr=0
|
setlocal foldexpr=0
|
||||||
@ -37,7 +79,10 @@ if s:l < 1 | let s:l = 1 | endif
|
|||||||
keepjumps exe s:l
|
keepjumps exe s:l
|
||||||
normal! zt
|
normal! zt
|
||||||
keepjumps 14
|
keepjumps 14
|
||||||
normal! 0
|
normal! 019|
|
||||||
|
wincmd w
|
||||||
|
exe 'vert 1resize ' . ((&columns * 93 + 93) / 186)
|
||||||
|
exe 'vert 2resize ' . ((&columns * 92 + 93) / 186)
|
||||||
tabnext 1
|
tabnext 1
|
||||||
if exists('s:wipebuf') && len(win_findbuf(s:wipebuf)) == 0 && getbufvar(s:wipebuf, '&buftype') isnot# 'terminal'
|
if exists('s:wipebuf') && len(win_findbuf(s:wipebuf)) == 0 && getbufvar(s:wipebuf, '&buftype') isnot# 'terminal'
|
||||||
silent exe 'bwipe ' . s:wipebuf
|
silent exe 'bwipe ' . s:wipebuf
|
||||||
@ -45,6 +90,8 @@ endif
|
|||||||
unlet! s:wipebuf
|
unlet! s:wipebuf
|
||||||
set winheight=1 winwidth=20
|
set winheight=1 winwidth=20
|
||||||
let &shortmess = s:shortmess_save
|
let &shortmess = s:shortmess_save
|
||||||
|
let &winminheight = s:save_winminheight
|
||||||
|
let &winminwidth = s:save_winminwidth
|
||||||
let s:sx = expand("<sfile>:p:r")."x.vim"
|
let s:sx = expand("<sfile>:p:r")."x.vim"
|
||||||
if filereadable(s:sx)
|
if filereadable(s:sx)
|
||||||
exe "source " . fnameescape(s:sx)
|
exe "source " . fnameescape(s:sx)
|
||||||
|
|||||||
@ -4,7 +4,7 @@
|
|||||||
|
|
||||||
\maketitle
|
\maketitle
|
||||||
\input{goals-and-outcomes/v6}
|
\input{goals-and-outcomes/v6}
|
||||||
\input{state-of-the-art/v4}
|
\input{state-of-the-art/v5}
|
||||||
\input{research-approach/v3}
|
\input{research-approach/v3}
|
||||||
\input{broader-impacts/v1}
|
\input{broader-impacts/v1}
|
||||||
\input{metrics-of-success/v1}
|
\input{metrics-of-success/v1}
|
||||||
|
|||||||
@ -1,18 +1,100 @@
|
|||||||
\section{State of the Art and Limits of Current Practice}
|
\section{State of the Art and Limits of Current Practice}
|
||||||
|
|
||||||
|
The principal aim of this research is to create autonomous reactor control
|
||||||
|
systems that are tractably safe. But, to understand what exactly is being
|
||||||
|
automated, it is important to understand how nuclear reactors are operated
|
||||||
|
today. First, the reactor operator themselves is discussed. Then, operating
|
||||||
|
procedures that we aim to leverage later are examined. Next, limitations of
|
||||||
|
human-based operation are investigated, while finally we discuss current formal
|
||||||
|
methods based approaches to building reactor control systems.
|
||||||
|
|
||||||
\subsection{Current Reactor Procedures and Operation}
|
\subsection{Current Reactor Procedures and Operation}
|
||||||
%How are operating procedures made and why do they exist
|
|
||||||
|
|
||||||
%what are different kinds of operating procedures
|
Current generation nuclear power plants employ 3,600+ active NRC-licensed
|
||||||
|
reactor operators in the United States. These operators are divided into Reactor
|
||||||
|
Operators (ROs) who manipulate reactor controls and Senior Reactor Operators
|
||||||
|
(SROs) who direct plant operations and serve as shift
|
||||||
|
supervisors~\cite{10CFR55}. Staffing typically requires 2+ ROs with at least one
|
||||||
|
SRO for current generation units. To become a reactor operator, an individual
|
||||||
|
might spend up to six years to pass required training~\cite{princeton}.
|
||||||
|
|
||||||
%NUREG 0899
|
The role of human operators is paradoxically both critical and
|
||||||
|
problematic. Operators hold legal authority under 10 CFR Part 55 to make
|
||||||
|
critical decisions including departing from normal regulations during
|
||||||
|
emergencies. The Three Mile Island (TMI) accident demonstrated how
|
||||||
|
``combination of personnel error, design deficiencies, and component
|
||||||
|
failures'' led to partial meltdown when operators ``misread confusing
|
||||||
|
and contradictory readings and shut off the emergency water
|
||||||
|
system''~\cite{Kemeny1979}. The President's Commission on TMI identified
|
||||||
|
a fundamental ambiguity: placing ``responsibility and accountability for
|
||||||
|
safe power plant operations...on the licensee in all circumstances''
|
||||||
|
without formal verification that operators can fulfill this
|
||||||
|
responsibility under all conditions~\cite{Kemeny1979}. This tension
|
||||||
|
between operational flexibility and safety assurance remains unresolved
|
||||||
|
in current practice.
|
||||||
|
|
||||||
|
<<<<<<< HEAD
|
||||||
%how are procedures tested
|
%how are procedures tested
|
||||||
|
=======
|
||||||
|
Nuclear plant procedures exist in a hierarchy: normal operating procedures for
|
||||||
|
routine operations, abnormal operating procedures for off-normal conditions,
|
||||||
|
Emergency Operating Procedures (EOPs) for design-basis accidents, Severe
|
||||||
|
Accident Management Guidelines (SAMGs) for beyond-design-basis events, and
|
||||||
|
Extensive Damage Mitigation Guidelines (EDMGs) for catastrophic damage
|
||||||
|
scenarios. These procedures must comply with 10 CFR 50.34(b)(6)(ii) and are
|
||||||
|
developed using guidance from NUREG-0899~\cite{NUREG-0899}, but their
|
||||||
|
development process relies fundamentally on expert judgment and simulator
|
||||||
|
validation rather than formal verification. Procedures undergo technical
|
||||||
|
evaluation, simulator validation testing, and biennial review as part of
|
||||||
|
operator requalification under 10 CFR 55.59~\cite{10CFR55}. Despite these
|
||||||
|
rigorous development processes, procedures fundamentally lack formal
|
||||||
|
verification of key safety properties. There is no mathematical proof that
|
||||||
|
procedures cover all possible plant states, that required actions can be
|
||||||
|
completed within available timeframes under all scenarios, or that transitions
|
||||||
|
between procedure sets maintain safety invariants.
|
||||||
|
|
||||||
%Automation already is used for emergency systems
|
\textbf{LIMITATION:} \textit{Procedures lack formal verification of correctness
|
||||||
|
and completeness.} Current procedure development relies on expert judgment and
|
||||||
|
simulator validation. No mathematical proof exists that procedures cover all
|
||||||
|
possible plant states, that required actions can be completed within available
|
||||||
|
timeframes, or that transitions between procedure sets maintain safety
|
||||||
|
invariants. Paper-based procedures cannot ensure correct application, and even
|
||||||
|
computer-based procedure systems lack the formal guarantees that automated
|
||||||
|
reasoning could provide.
|
||||||
|
|
||||||
|
Nuclear plants operate with multiple control modes: automatic control where the
|
||||||
|
reactor control system maintains target parameters through continuous rod
|
||||||
|
adjustment, manual control where operators directly manipulate control rods, and
|
||||||
|
various intermediate modes. In typical pressurized water reactor operation, the
|
||||||
|
reactor control system automatically maintains a floating average temperature,
|
||||||
|
compensating for changes in power demand with reactivity feedback loops alone.
|
||||||
|
Safety systems instead operate with implemented automation. Reactor
|
||||||
|
Protection Systems trip automatically on safety signals with millisecond
|
||||||
|
response times, and engineered safety features actuate automatically on accident
|
||||||
|
signals without operator action required.
|
||||||
|
>>>>>>> 568549999a24c6a86f19411cbdf12b642057ade9
|
||||||
|
|
||||||
|
The current division between automated and human-controlled functions
|
||||||
|
reveals the fundamental challenge of hybrid control. Highly
|
||||||
|
automated systems handle reactor protection like automatic trips on safety
|
||||||
|
parameters, emergency core cooling actuation, containment isolation,
|
||||||
|
and basic process control. Human operators, however, retain control of
|
||||||
|
strategic decision-making such as power level changes, startup/shutdown
|
||||||
|
sequences, mode transitions, and procedure implementation. %%%NEED MORE
|
||||||
|
|
||||||
|
\textbf{LIMITATION:} \textit{Current practice treats continuous plant
|
||||||
|
dynamics and discrete control logic separately.} No application of
|
||||||
|
hybrid control theory exists that could provide mathematical guarantees
|
||||||
|
across mode transitions, verify timing properties formally, or optimize
|
||||||
|
the automation-human interaction trade-off with provable safety bounds.
|
||||||
|
|
||||||
\subsection{Human Factors in Nuclear Accidents}
|
\subsection{Human Factors in Nuclear Accidents}
|
||||||
|
The persistent role of human error in nuclear safety incidents, despite
|
||||||
|
decades of improvements in training and procedures, provides perhaps the
|
||||||
|
most compelling motivation for formal automated control with
|
||||||
|
mathematical safety guarantees.
|
||||||
|
|
||||||
|
<<<<<<< HEAD
|
||||||
%Whos in the control room
|
%Whos in the control room
|
||||||
|
|
||||||
%how are reactor operators trained
|
%how are reactor operators trained
|
||||||
@ -39,3 +121,270 @@
|
|||||||
%details of how it worked, and limitations therein
|
%details of how it worked, and limitations therein
|
||||||
|
|
||||||
%Digital system ONLY
|
%Digital system ONLY
|
||||||
|
=======
|
||||||
|
Multiple independent analyses converge on a striking statistic: \textbf{70--80\%
|
||||||
|
of all nuclear power plant events are attributed to human error} versus
|
||||||
|
approximately 20\% to equipment failures~\cite{DOE-HDBK-1028-2009,WNA2020}. More
|
||||||
|
significantly, the International Atomic Energy Agency concluded that ``human
|
||||||
|
error was the root cause of all severe accidents at nuclear power plants''---a
|
||||||
|
categorical statement spanning Three Mile Island, Chernobyl, and Fukushima
|
||||||
|
Daiichi~\cite{IAEA-severe-accidents}. A detailed analysis of 190 events at
|
||||||
|
Chinese nuclear power plants from 2007--2020~\cite{Wang2025} found that 53\% of
|
||||||
|
events involved active errors while 92\% were associated with latent errors
|
||||||
|
(organizational and systemic weaknesses that create conditions for failure). The
|
||||||
|
persistence of this 70--80\% human error contribution despite four decades of
|
||||||
|
continuous improvements in operator training, control room design, procedures,
|
||||||
|
and human factors engineering. This suggests fundamental cognitive limitations
|
||||||
|
rather than remediable deficiencies.
|
||||||
|
|
||||||
|
The Three Mile Island Unit 2 accident on March 28, 1979 remains the definitive
|
||||||
|
case study in human factors failures in nuclear operations. The accident began
|
||||||
|
at 4:00 AM with a routine feedwater pump trip, escalating when a
|
||||||
|
pressure-operated relief valve (PORV) stuck open---draining reactor
|
||||||
|
coolant---but control room instrumentation showed only whether the valve had
|
||||||
|
been commanded to close, not whether it actually closed. When Emergency Core
|
||||||
|
Cooling System pumps automatically activated as designed, operators made the
|
||||||
|
fateful decision to shut them down based on their incorrect assessment of plant
|
||||||
|
conditions. The result was a massive loss of coolant accident and the core
|
||||||
|
quickly began to overheat. During the emergency, operators faced more than 100
|
||||||
|
simultaneous alarms, overwhelming their cognitive capacity~\cite{Kemeny1979}.
|
||||||
|
The core suffered partial meltdown with \textbf{44\% of the fuel melting} before
|
||||||
|
the situation was stabilized.
|
||||||
|
|
||||||
|
Quantitative risk analysis revealed the magnitude of failure in existing
|
||||||
|
safety assessment methods: the actual core damage probability was
|
||||||
|
approximately 5\% per year while Probabilistic Risk Assessment
|
||||||
|
had predicted 0.01\% per year---a \textbf{500-fold underestimation}.
|
||||||
|
This dramatic failure demonstrated that human reliability could not be
|
||||||
|
adequately assessed through expert judgment and historical data alone.
|
||||||
|
%%%SOURCE??? Human Reliability Analysis (HRA) methods developed over four decades
|
||||||
|
quantify human error probabilities and performance shaping factors. The
|
||||||
|
SPAR-H method represents current best practice,
|
||||||
|
providing nominal Human Error Probabilities (HEPs) of \textbf{0.01 (1\%)
|
||||||
|
for diagnosis tasks} and \textbf{0.001 (0.1\%) for action tasks} under
|
||||||
|
optimal conditions~\cite{NUREG-CR-6883}.
|
||||||
|
|
||||||
|
However, these nominal error rates degrade dramatically under realistic
|
||||||
|
accident conditions: inadequate available time increases HEP by
|
||||||
|
\textbf{10-fold}, extreme stress by \textbf{5-fold}, high complexity by
|
||||||
|
\textbf{5-fold}, missing procedures by \textbf{50-fold}, and poor
|
||||||
|
ergonomics by \textbf{50-fold}. Under combined adverse conditions
|
||||||
|
typical of severe accidents, human error probabilities can approach
|
||||||
|
\textbf{0.1 to 1.0 (10\% to 100\%)}---essentially guaranteed failure for
|
||||||
|
complex diagnosis tasks~\cite{NUREG-2114}.
|
||||||
|
|
||||||
|
Rasmussen's influential 1983 taxonomy~\cite{Rasmussen1983} divides human errors
|
||||||
|
into skill-based (highly practiced responses, HEP $10^{-3}$ to $10^{-4}$),
|
||||||
|
rule-based (following procedures, HEP $10^{-2}$ to $10^{-1}$), and
|
||||||
|
knowledge-based (novel problem solving, HEP $10^{-1}$ to 1). Severe accidents
|
||||||
|
inherently require knowledge-based responses where human reliability is lowest.
|
||||||
|
Miller's classic 1956 finding~\cite{Miller1956} that working memory capacity is
|
||||||
|
limited to 7$\pm$2 chunks explains why Three Mile Island's 100+
|
||||||
|
%WHAT IS A CHUNK?
|
||||||
|
simultaneous alarms exceeded operators' processing capacity.
|
||||||
|
|
||||||
|
\textbf{LIMITATION:} \textit{Human factors impose fundamental reliability
|
||||||
|
limits that cannot be overcome through training alone.} Response time
|
||||||
|
limitations constrain human effectiveness---reactor protection systems
|
||||||
|
must respond in milliseconds, 100--1000 times faster than human
|
||||||
|
operators. Cognitive biases systematically distort judgment:
|
||||||
|
confirmation bias, overconfidence, and anchoring bias are inherent
|
||||||
|
features of human cognition, not individual failings~\cite{Reason1990}.
|
||||||
|
The persistent 70--80\% human error contribution despite four decades of
|
||||||
|
improvements demonstrates that these limitations are fundamental
|
||||||
|
rather than remediable.
|
||||||
|
|
||||||
|
\subsection{HARDENS and Formal Methods}
|
||||||
|
|
||||||
|
The High Assurance Rigorous Digital Engineering for Nuclear Safety
|
||||||
|
(HARDENS) project, completed by Galois, Inc. for the U.S. Nuclear
|
||||||
|
Regulatory Commission in 2022, represents the most advanced application
|
||||||
|
of formal methods to nuclear reactor control systems to
|
||||||
|
date---and simultaneously reveals the critical gaps that remain.
|
||||||
|
|
||||||
|
\subsubsection{Rigorous Digital Engineering Demonstrated Feasibility}
|
||||||
|
|
||||||
|
HARDENS aimed to address the nuclear industry's fundamental dilemma:
|
||||||
|
existing U.S. nuclear control rooms rely on analog technologies from the
|
||||||
|
1950s--60s, making construction costs exceed \$500 million and timelines
|
||||||
|
stretch to decades. The NRC contracted Galois to demonstrate that
|
||||||
|
Model-Based Systems Engineering and formal methods could design, verify,
|
||||||
|
and implement a complex protection system meeting regulatory criteria at
|
||||||
|
a fraction of typical cost.
|
||||||
|
|
||||||
|
The project delivered far beyond its scope, creating what Galois
|
||||||
|
describes as ``the world's most advanced, high-assurance protection
|
||||||
|
system demonstrator.'' Completed in \textbf{nine months at a tiny
|
||||||
|
fraction of typical control system costs}~\cite{Kiniry2022}, the project
|
||||||
|
produced a complete Reactor Trip System (RTS) implementation with full
|
||||||
|
traceability from NRC Request for Proposals and IEEE standards through
|
||||||
|
formal architecture specifications to formally verified binaries and
|
||||||
|
hardware running on FPGA demonstrator boards.
|
||||||
|
|
||||||
|
Principal Investigator Joseph Kiniry led the team in applying Galois's
|
||||||
|
Rigorous Digital Engineering methodology combining model-based
|
||||||
|
engineering, digital twins with measurable fidelity, and applied formal
|
||||||
|
methods. The approach integrates multiple abstraction levels---from
|
||||||
|
semi-formal natural language requirements through formal specifications
|
||||||
|
to verified implementations---all maintained as integrated artifacts
|
||||||
|
rather than separate documentation prone to divergence.
|
||||||
|
|
||||||
|
\subsubsection{Comprehensive Formal Methods Toolkit Provided Verification}
|
||||||
|
|
||||||
|
HARDENS employed an impressive array of formal methods tools and
|
||||||
|
techniques across the verification hierarchy. High-level specifications
|
||||||
|
used Lando, SysMLv2, and FRET (NASA JPL's Formal Requirements
|
||||||
|
Elicitation Tool) to capture stakeholder requirements, domain
|
||||||
|
engineering, certification requirements, and safety requirements.
|
||||||
|
Requirements were formally analyzed for \textbf{consistency,
|
||||||
|
completeness, and realizability} using SAT and SMT solvers---verification
|
||||||
|
that current procedure development methods lack.
|
||||||
|
|
||||||
|
Executable formal models employed Cryptol to create an executable
|
||||||
|
behavioral model of the entire RTS including all subsystems, components,
|
||||||
|
and formal digital twin models of sensors, actuators, and compute
|
||||||
|
infrastructure. Automatic code synthesis generated formally verifiable C
|
||||||
|
implementations and System Verilog hardware implementations directly
|
||||||
|
from Cryptol models---eliminating the traditional gap between
|
||||||
|
specification and implementation where errors commonly arise.
|
||||||
|
|
||||||
|
Formal verification tools included SAW (Software Analysis Workbench) for
|
||||||
|
proving equivalence between models and implementations, Frama-C for C
|
||||||
|
code verification, and Yosys for hardware verification. HARDENS verified
|
||||||
|
both automatically synthesized and hand-written implementations against
|
||||||
|
their models and against each other, providing redundant assurance
|
||||||
|
paths.
|
||||||
|
|
||||||
|
This multi-layered verification approach represents a quantum leap
|
||||||
|
beyond current nuclear I\&C verification practices, which rely primarily
|
||||||
|
on testing and simulation. HARDENS demonstrated that \textbf{complete
|
||||||
|
formal verification from requirements to implementation is technically
|
||||||
|
feasible} for safety-critical nuclear control systems.
|
||||||
|
|
||||||
|
\subsubsection{Critical Limitation: Discrete Control Logic Only}
|
||||||
|
|
||||||
|
Despite its impressive accomplishments, HARDENS has a fundamental
|
||||||
|
limitation directly relevant to hybrid control synthesis: \textbf{the
|
||||||
|
project addressed only discrete digital control logic without modeling
|
||||||
|
or verifying continuous reactor dynamics}. The Reactor Trip System
|
||||||
|
specification and formal verification covered discrete state transitions
|
||||||
|
(trip/no-trip decisions), digital sensor input processing through
|
||||||
|
discrete logic, and discrete actuation outputs (reactor trip commands).
|
||||||
|
The system correctly implements the digital control logic for reactor
|
||||||
|
protection with mathematical guarantees.
|
||||||
|
|
||||||
|
However, the project did not address continuous dynamics of nuclear
|
||||||
|
reactor physics including neutron kinetics, thermal-hydraulics, xenon
|
||||||
|
oscillations, fuel temperature feedback, coolant flow dynamics, and heat
|
||||||
|
transfer---all governed by continuous differential equations. Real
|
||||||
|
reactor safety depends on the interaction between continuous processes
|
||||||
|
(temperature, pressure, neutron flux evolving according to differential
|
||||||
|
equations) and discrete control decisions (trip/no-trip, valve
|
||||||
|
open/close, pump on/off). HARDENS verified the discrete controller in
|
||||||
|
isolation but not the closed-loop hybrid system behavior.
|
||||||
|
|
||||||
|
\textbf{LIMITATION:} \textit{HARDENS addressed discrete control logic
|
||||||
|
without continuous dynamics or hybrid system verification.} Hybrid
|
||||||
|
automata, differential dynamic logic, or similar hybrid systems
|
||||||
|
formalisms would be required to specify and verify properties like ``the
|
||||||
|
controller maintains core temperature below safety limits under all
|
||||||
|
possible disturbances''---a property that inherently spans continuous and
|
||||||
|
discrete dynamics. Verifying discrete control logic alone provides no
|
||||||
|
guarantee that the closed-loop system exhibits desired continuous
|
||||||
|
behavior such as stability, convergence to setpoints, or maintained
|
||||||
|
safety margins.
|
||||||
|
|
||||||
|
\subsubsection{Experimental Validation Gap Limits Technology Readiness}
|
||||||
|
|
||||||
|
The second critical limitation is \textbf{absence of experimental
|
||||||
|
validation} in actual nuclear facilities or realistic operational
|
||||||
|
environments. HARDENS produced a demonstrator system at Technology
|
||||||
|
Readiness Level 3--4 (analytical proof of concept with laboratory
|
||||||
|
breadboard validation) rather than a deployment-ready system validated
|
||||||
|
through extended operational testing. The NRC Final Report explicitly
|
||||||
|
notes~\cite{Kiniry2022}: ``All material is considered in development and
|
||||||
|
not a finalized product'' and ``The demonstration of its technical
|
||||||
|
soundness was to be at a level consistent with satisfaction of the
|
||||||
|
current regulatory criteria, although with no explicit demonstration of
|
||||||
|
how regulatory requirements are met.''
|
||||||
|
|
||||||
|
The project did not include deployment in actual nuclear facilities,
|
||||||
|
testing with real reactor systems under operational conditions,
|
||||||
|
side-by-side validation with operational analog RTS systems, systematic
|
||||||
|
failure mode testing (radiation effects, electromagnetic interference,
|
||||||
|
temperature extremes), actual NRC licensing review, or human factors
|
||||||
|
validation with licensed nuclear operators in realistic control room
|
||||||
|
scenarios.
|
||||||
|
|
||||||
|
\textbf{LIMITATION:} \textit{HARDENS achieved TRL 3--4 without experimental
|
||||||
|
validation.} While formal verification provides mathematical correctness
|
||||||
|
guarantees for the implemented discrete logic, the gap between formal
|
||||||
|
verification and actual system deployment involves myriad practical
|
||||||
|
considerations: integration with legacy systems, long-term reliability
|
||||||
|
under harsh environments, human-system interaction in realistic
|
||||||
|
operational contexts, and regulatory acceptance of formal methods as
|
||||||
|
primary assurance evidence.
|
||||||
|
|
||||||
|
\subsection{Research Imperative: Formal Hybrid Control Synthesis}
|
||||||
|
|
||||||
|
Three converging lines of evidence establish an urgent research
|
||||||
|
imperative for formal hybrid control synthesis applied to nuclear
|
||||||
|
reactor systems.
|
||||||
|
|
||||||
|
\textbf{Current reactor control practices} reveal fundamental gaps in
|
||||||
|
verification. Procedures lack mathematical proofs of completeness or
|
||||||
|
timing adequacy. Mode transitions preserve safety properties only
|
||||||
|
informally. Operator decision-making relies on training rather than
|
||||||
|
verified algorithms. The divide between continuous plant dynamics and
|
||||||
|
discrete control logic has never been bridged with formal methods.
|
||||||
|
Despite extensive regulatory frameworks developed over six decades,
|
||||||
|
\textbf{no mathematical guarantees exist} that current control approaches
|
||||||
|
maintain safety under all possible scenarios.
|
||||||
|
|
||||||
|
\textbf{Human factors in nuclear accidents} demonstrate that human error
|
||||||
|
contributes to 70--80\% of nuclear incidents despite four decades of
|
||||||
|
systematic improvements. The IAEA's categorical statement that ``human
|
||||||
|
error was the root cause of all severe accidents'' reveals fundamental
|
||||||
|
cognitive limitations: working memory capacity of 7$\pm$2 chunks,
|
||||||
|
response times of seconds to minutes versus milliseconds required,
|
||||||
|
cognitive biases immune to training, stress-induced performance
|
||||||
|
degradation. Human Reliability Analysis methods document error
|
||||||
|
probabilities of 0.001--0.01 under optimal conditions degrading to
|
||||||
|
0.1--1.0 under realistic accident conditions. These limitations
|
||||||
|
\textbf{cannot be overcome through human factors improvements alone}.
|
||||||
|
|
||||||
|
\textbf{The HARDENS project} proved that formal verification is
|
||||||
|
technically feasible and economically viable for nuclear control
|
||||||
|
systems, achieving complete verification from requirements to
|
||||||
|
implementation in nine months at a fraction of typical costs. However,
|
||||||
|
HARDENS addressed only discrete control logic without considering
|
||||||
|
continuous reactor dynamics or hybrid system verification, and the
|
||||||
|
demonstrator achieved only TRL 3--4 without experimental validation in
|
||||||
|
realistic nuclear environments. These limitations directly define the
|
||||||
|
research frontier: \textbf{formal synthesis of hybrid controllers that
|
||||||
|
provide mathematical safety guarantees across both continuous plant
|
||||||
|
dynamics and discrete control logic}.
|
||||||
|
|
||||||
|
The research opportunity is clear. Nuclear reactors are quintessential
|
||||||
|
hybrid cyber-physical systems where continuous neutron kinetics,
|
||||||
|
thermal-hydraulics, and heat transfer interact with discrete control
|
||||||
|
mode decisions, trip logic, and valve states. Current practice treats
|
||||||
|
these domains separately---reactor physics analyzed with simulation,
|
||||||
|
control logic verified through testing, human operators expected to
|
||||||
|
integrate everything through procedures. \textbf{Hybrid control
|
||||||
|
synthesis offers the possibility of unified formal treatment} where
|
||||||
|
controllers are automatically generated from high-level safety
|
||||||
|
specifications with mathematical proofs that guarantee safe operation
|
||||||
|
across all modes, all plant states, and all credible disturbances.
|
||||||
|
|
||||||
|
Recent advances in hybrid systems theory---including reachability
|
||||||
|
analysis, barrier certificates, counterexample-guided inductive
|
||||||
|
synthesis, and satisfiability modulo theories for hybrid systems---provide
|
||||||
|
the theoretical foundation. Computational advances enable verification of
|
||||||
|
systems with continuous state spaces that were intractable a decade ago.
|
||||||
|
The confluence of mature formal methods, powerful verification tools
|
||||||
|
demonstrated by HARDENS, urgent safety imperatives documented by
|
||||||
|
persistent human error statistics, and fundamental gaps in current
|
||||||
|
hybrid dynamics treatment creates a compelling and timely research
|
||||||
|
opportunity.
|
||||||
|
>>>>>>> 568549999a24c6a86f19411cbdf12b642057ade9
|
||||||
|
|||||||
138
Writing/Journal/JRNL-20251015-204549.md
Normal file
138
Writing/Journal/JRNL-20251015-204549.md
Normal file
@ -0,0 +1,138 @@
|
|||||||
|
---
|
||||||
|
id: JRNL-20251015-204549
|
||||||
|
title: Wednesday, October 15, 2025 - 08:45 PM
|
||||||
|
type: journal
|
||||||
|
created: 2025-10-16T00:45:49Z
|
||||||
|
modified: 2025-10-16T00:45:49Z
|
||||||
|
tags: [journal]
|
||||||
|
---
|
||||||
|
|
||||||
|
# Wednesday, October 15, 2025 - 08:45 PM
|
||||||
|
|
||||||
|
Today is a new journal day, and I have some updates! The
|
||||||
|
principal topic of this entry is going to be about Matilda,
|
||||||
|
and a little bit about Sam. Nothing new is really happening
|
||||||
|
at work recently, other than I've gone to the gym the past
|
||||||
|
couple of days and that's been fun! I'm quite proud of that.
|
||||||
|
|
||||||
|
So here's the deal about Matilda: I need to chill the fuck
|
||||||
|
out. I'm having conversations back and forth about breaking
|
||||||
|
up with this chick when *I don't really know her*. I have
|
||||||
|
known her for *one* month, and we have been dating for
|
||||||
|
*four* days. How can I possibly really know her?
|
||||||
|
|
||||||
|
We went on another two dates. The first one was a bike ride
|
||||||
|
on Tuesday afternoon, where we rode about 8 miles and
|
||||||
|
stopped for burgers and beers in the middle. I felt like
|
||||||
|
things were kind of awkward. We talked about random stuff,
|
||||||
|
and things were kind of goofy. I think it was somewhat
|
||||||
|
mutual, but I dunno I feel like maybe I was in a weird
|
||||||
|
headspace. We chatted about my car some, and I did get a
|
||||||
|
little bit of a weird reaction when I was like "yeah
|
||||||
|
completion is probably 5-10 years away". I think that
|
||||||
|
stunned her a little bit. We wrapped up and things were
|
||||||
|
okay! A different kind of date than we're used to but it was
|
||||||
|
a nice ride nonetheless. I think it kinda just goes to show
|
||||||
|
maybe it's something we don't really share well as a couple.
|
||||||
|
I like to go fast and I don't think she can keep up :eyes:.
|
||||||
|
|
||||||
|
After that date though, I've been in some more turmoil about
|
||||||
|
what I should do about the relationship. Should I break up
|
||||||
|
with her? Are there dealbreakers I can't handle? Why did I
|
||||||
|
move so fast? Why do I escalate based on emotions? And
|
||||||
|
generally I've been getting a pit in my stomach sometimes
|
||||||
|
when she says something like "you make me feel special". I
|
||||||
|
thought this was a gut instinct telling me that I don't want
|
||||||
|
her to feel that way or that I'm not ready for that
|
||||||
|
commitment but this most recent date has significantly
|
||||||
|
changed my perspective.
|
||||||
|
|
||||||
|
Today I was planning on seeing her to break up with her. I
|
||||||
|
had some sandpaper I was going to give her for these glasses
|
||||||
|
she's making out of wine bottles, and then go on a walk with
|
||||||
|
her. I had planned it out, I had rehearsed it with Claude
|
||||||
|
(shoutout Claude btw), and felt pretty prepared for what was
|
||||||
|
going to go down. But when I saw her, and we started
|
||||||
|
walking, my gut feeling was very different. She was holding
|
||||||
|
my hand, and we were just chatting and bs'ing about our days
|
||||||
|
when I realized that I really don't know her, I really don't
|
||||||
|
know that this couldn't work, and it's really not so serious
|
||||||
|
as it feels in my head some times.
|
||||||
|
|
||||||
|
I took a step back on my thoughts of her falling for me and
|
||||||
|
really dug into why I feel that way. I think I'm getting
|
||||||
|
ahead of myself saying that, because we're still learning
|
||||||
|
about each other and I think she's totally taking things
|
||||||
|
more slowly and casually than I am. No one is seeing wedding
|
||||||
|
bells right now, instead it's really more like we're getting
|
||||||
|
to know one another with some exclusivity attached. It isn't
|
||||||
|
so high stakes. Why did I get so anxious about this? Why did
|
||||||
|
I catastrophize things with problems that don't really exist
|
||||||
|
yet?
|
||||||
|
|
||||||
|
I keep getting tied up on the idea that I need a partner
|
||||||
|
with whom I can tinker with. Why? I have friends that I do
|
||||||
|
that with, and honestly, like working alone a lot of the
|
||||||
|
time. Do I need that in a partner? Maybe, but also maybe
|
||||||
|
not? Why don't I use this relationship to really actually
|
||||||
|
find that out? Also, she might actually be interested in
|
||||||
|
some of that stuff? Who knows? The answer is, not me.
|
||||||
|
|
||||||
|
Here's what I do know: when we went on that walk, when we
|
||||||
|
sat down and talked about our days, when we talked about
|
||||||
|
random stuff (like data privacy laws, government debt, and
|
||||||
|
voluntary euthanasia????? Sidebar, that was crazy) I felt
|
||||||
|
*so* relaxed. It was easy to just chill with her and enjoy
|
||||||
|
the sunset.
|
||||||
|
|
||||||
|
So I've been on this thing where the emotions attached to
|
||||||
|
her have been sinusoidal. I've gotta be honest, I think
|
||||||
|
that's my fault, and does not help my clarity in making a
|
||||||
|
decision in what I actually need in a partner. But, Matilda
|
||||||
|
is *not* a partner yet. We're right at the beginning of a
|
||||||
|
relationship, where *both* of us are figuring out if this is
|
||||||
|
right or not. And that does *not* happen in 4 days. The
|
||||||
|
things that I've been catastrophizing about are stressing me
|
||||||
|
out for no reason, and are not real problems yet. It is my
|
||||||
|
goal for this next week, to just calm down, and try to
|
||||||
|
journal and relax before making decisions. Ideally, don't
|
||||||
|
make *any* decisions this next week. What I feel like I
|
||||||
|
really need is some stability. No escalations, but also I
|
||||||
|
don't need to break up with her for no good reason either. I
|
||||||
|
can try and figure my shit out at the same time, knowing
|
||||||
|
that things aren't super serious right now. I don't need to
|
||||||
|
put some much pressure on myself.
|
||||||
|
|
||||||
|
Matilda is really nice to me, makes me feel calm when I'm
|
||||||
|
with her, and really stimulates me intellectually just
|
||||||
|
chatting about random stuff. Why I get so anxious when I'm
|
||||||
|
not around her is my problem to figure out, and not a reason
|
||||||
|
to drive decisions. For now, I'm going to keep getting to
|
||||||
|
know her and try to relax a little. No one is getting
|
||||||
|
married or having kids next month. To quote what
|
||||||
|
best-buddy-in-chief Sam said "You know, you're allowed to be
|
||||||
|
happy." He's right, and I don't need to create new problems.
|
||||||
|
|
||||||
|
Then, there is recent details about Samuel! Sam is
|
||||||
|
struggling some. We went golfing on Monday morning, which
|
||||||
|
was a blast. I need to make it a priority to show up earlier
|
||||||
|
than tee times though, as I got there basically 4 minutes
|
||||||
|
before tee off. Anyways, Sam feels listless. He doesn't love
|
||||||
|
his company, and Blake has been stressing him out some with
|
||||||
|
her not really advancing her accounting certifications right
|
||||||
|
now. I understand. I told him he should set some concrete
|
||||||
|
goals. If he wants to leave his company, he should set a
|
||||||
|
target date and write it down (sort of like I'm doing here).
|
||||||
|
Maybe he should set some goals on his hobbies. The point
|
||||||
|
was, make it measurable! I think that will help him a lot.
|
||||||
|
|
||||||
|
Poker is probably falling through this Friday, with people
|
||||||
|
being busy. Maybe I'll try to hangout with Sam anyways.
|
||||||
|
|
||||||
|
Matilda has her aunt coming into town this weekend, so the
|
||||||
|
next time we're going to see each other is Sunday. No more
|
||||||
|
escalating for now, no more "should I blow it all up????"
|
||||||
|
for a bit, instead, let me just enjoy getting to know this
|
||||||
|
new person without putting the Atlas-like pressure on it.
|
||||||
|
That can be enough.
|
||||||
|
|
||||||
158
Writing/Journal/JRNL-20251017-193513.md
Normal file
158
Writing/Journal/JRNL-20251017-193513.md
Normal file
@ -0,0 +1,158 @@
|
|||||||
|
---
|
||||||
|
id: JRNL-20251017-193513
|
||||||
|
title: Friday, October 17, 2025 - 07:35 PM
|
||||||
|
type: journal
|
||||||
|
created: 2025-10-17T23:35:13Z
|
||||||
|
modified: 2025-10-17T23:35:13Z
|
||||||
|
tags: [journal]
|
||||||
|
---
|
||||||
|
|
||||||
|
# Friday, October 17, 2025 - 07:35 PM
|
||||||
|
|
||||||
|
Yeah, so y'know how I said I was going to enjoy getting to
|
||||||
|
know her, and that that would be enough? Yeah, that didn't
|
||||||
|
work out. I broke up with Matilda yesterday.
|
||||||
|
|
||||||
|
Yesterday I went to my grandparents to do some laundry. In
|
||||||
|
the morning I felt okay about how things were left with
|
||||||
|
Matilda, but as the day progressed, bits and pieces of that
|
||||||
|
anxiety about the relationship and issues I had kept
|
||||||
|
creeping in. It's really hard because Matilda is such a nice
|
||||||
|
and good person, but ultimately, there were things about my
|
||||||
|
values that didn't line up. We were keeping a
|
||||||
|
Sunday-sleepover up in the air, and this was also kind of a
|
||||||
|
determining factor for me. I really think that if she would
|
||||||
|
have stayed over on Sunday that we would have had sex. Or at
|
||||||
|
least, I would have had to refuse and make things very
|
||||||
|
awkward.
|
||||||
|
|
||||||
|
Matilda told me early on that she didn't want to have sex
|
||||||
|
unless she was in a committed relationship. I said that's
|
||||||
|
completely fair! I totally get it. Then, about two weeks
|
||||||
|
ago, she gave me a heads up that she was getting back on
|
||||||
|
birth control. It was a weird heads up to get, but we talked
|
||||||
|
about it, agreed we were going in that direction, and it was
|
||||||
|
okay. But, recently, there had been some flirtatious action
|
||||||
|
where we were basically soft sexting that really indicated
|
||||||
|
to me we would have sex soon. And with me on the fence about
|
||||||
|
the whole thing, escalating to sex is the exact opposite of
|
||||||
|
what I wanted to do. I told myself last entry that I would
|
||||||
|
not escalate, and that I would calm down. Well, I tried to
|
||||||
|
calm down, but I've arranged things that I will definitely
|
||||||
|
not be escalating.
|
||||||
|
|
||||||
|
I told my grandparents about the situation. How she's such a
|
||||||
|
nice person, but I can't shake this gut feeling that
|
||||||
|
something is wrong. They try to be helpful, and are
|
||||||
|
generally supportive, but they met in high school and have
|
||||||
|
been together since. Neither of them have really 'dated'. So
|
||||||
|
to that end, I was kind of on my own.
|
||||||
|
|
||||||
|
Then, I'm sitting in the basement while the dryer is running
|
||||||
|
and I got to a point where I thought to myself "I cannot
|
||||||
|
keep waffling on this, this anxiety is killing me and I need
|
||||||
|
to just end it." I texted her asking her how her evening was
|
||||||
|
going, and she responded that it was going well. She also
|
||||||
|
sent me a picture of the Christmas tree Downtown and said
|
||||||
|
'Great news!', and then asked if I'd want to go ice skating
|
||||||
|
with her or maybe go on a double date with Sam and Blake ice
|
||||||
|
skating. I never texted back.
|
||||||
|
|
||||||
|
I sat in a chair instead, and thought for a long time about
|
||||||
|
what I was going to do. I thought for a long time if
|
||||||
|
sticking it out was worth it, but I thought about
|
||||||
|
conversations with Claude and thought about 'If I don't do
|
||||||
|
this now, how am I going to feel in a week or two weeks?'.
|
||||||
|
The answer to that question is still uncomfortable if I stay
|
||||||
|
this course.
|
||||||
|
|
||||||
|
At this point, Krzyszstof calls me randomly. Buddy's
|
||||||
|
Mercedes broke down in the middle of campus and he was
|
||||||
|
asking for help. I couldn't help him obviously being way out
|
||||||
|
at my grandparents, but his interruption broke me of my
|
||||||
|
stupor and I got the courage to call Matilda afterwards.
|
||||||
|
|
||||||
|
I asked her how her afternoon was going. She said it was
|
||||||
|
going well, and sounded very happy. She was arranging
|
||||||
|
flowers for her mom's birthday this weekend. She is so sweet
|
||||||
|
in that way. We had some small talk for a while before I
|
||||||
|
changed the topic to us. I said that I've been thinking
|
||||||
|
about us, and that I know this is sudden and is going to
|
||||||
|
sound like a shock, but I think we should stop seeing each
|
||||||
|
other. There was a long pause on the phone. When she spoke,
|
||||||
|
her tone was immediately different and she politely asked
|
||||||
|
why. I told her that over the past week, I've been dealing
|
||||||
|
with some personal emotional difficulties and I've come to
|
||||||
|
the conclusion that it is not a good time for me to be in a
|
||||||
|
relationship right now. I told her I think she's wonderful,
|
||||||
|
and that I think she is such an incredibly nice person in
|
||||||
|
the way that she moves through the world and that I liked
|
||||||
|
her a lot, but that she deserves someone who is all in for
|
||||||
|
her and I just don't think I can be that guy for her. I
|
||||||
|
apologized saying that I wish I knew this beforehand, but I
|
||||||
|
didn't, and am sorry that I couldn't get there for her. She
|
||||||
|
started to cry softly, and told me that I didn't need to
|
||||||
|
hear it from her, but that besides being so smart, that I'm
|
||||||
|
incredibly compassionate and thoughtful and know how to make
|
||||||
|
her feel special. She appreciated me being honest and said
|
||||||
|
that this sucks, but she understands. I told her the one
|
||||||
|
thing that's most important to me for her to take away from
|
||||||
|
this conversation is that this is not her fault. I offered
|
||||||
|
if she wanted to be friends at some point I would be open to
|
||||||
|
that, but that I know we're both going to need our space
|
||||||
|
after this jolt. I said I genuinely think she's great and that she
|
||||||
|
will find her person, just that I don't think it's me. I
|
||||||
|
apologized again. She told me that she is thankful I was
|
||||||
|
honest, and that she's rooting for me. She enjoyed our
|
||||||
|
relationship even though it was so short. We wished each
|
||||||
|
other good luck.
|
||||||
|
|
||||||
|
And that's the last that I talked to her. I started to cry
|
||||||
|
some too. I wish I could've done this in person on
|
||||||
|
Wednesday, but for some reason, I just couldn't.
|
||||||
|
|
||||||
|
Afterwards I called Sam on the phone to talk to him. He was
|
||||||
|
supportive in the sense that he knows I've got to do what's
|
||||||
|
right for me, but cautioned me that he thinks I can make
|
||||||
|
extremely reactive decisions. He's right. It's a weakness
|
||||||
|
and a strength. On one hand, I'm able to cut my losses at
|
||||||
|
times and move on quickly to the next thing, or adjust to
|
||||||
|
changing circumstances, but on the other, sometimes I can
|
||||||
|
act too quickly before I have all the cards. I don't think
|
||||||
|
this situation is like that. Or at least this breakup,
|
||||||
|
anyways. I've been dealing with this doubt for weeks, while
|
||||||
|
really the reactive decision was escalating to asking her to
|
||||||
|
be my girlfriend.
|
||||||
|
|
||||||
|
It's over. This sucks, but I know deep down it's the right
|
||||||
|
choice. My anxiety about the relationship is completely
|
||||||
|
gone, and instead replaced with a profound loneliness. Part
|
||||||
|
of me wonders if I blew up something that was good for no
|
||||||
|
reason, but another part of me knows that's not seeing the
|
||||||
|
forest for the trees. I feel so bad about this whole
|
||||||
|
situation and hope these feelings subside soon. It's hard
|
||||||
|
not to think about. I haven't texted her, and I deleted our
|
||||||
|
conversation so I can't our chat history. It sucks that when
|
||||||
|
a relationship like this ends, the whole friendship and
|
||||||
|
camaraderie ends so quickly too. It's such a brutal cut and
|
||||||
|
feels like a void has opened up out of nowhere.
|
||||||
|
|
||||||
|
I went for a ride today on the bike. I rode over to South
|
||||||
|
Park to whip around, and then stopped at Brusters. That was
|
||||||
|
a *blast*. Anyways, I'm still bummed, but I know this was
|
||||||
|
the right move and things will get better. Luis told me
|
||||||
|
today that things like this are the price of dating and that
|
||||||
|
it comes with the territory. He's right.
|
||||||
|
|
||||||
|
I redownloaded Hinge. I'm not using it right now, but if
|
||||||
|
Cinderella likes me I'll at least see it. Up next I'm going
|
||||||
|
to really write down what I'm looking for in a partner in my
|
||||||
|
next journal entry. This way, I'll have a list of clear
|
||||||
|
targets to hit, and who knows, maybe I'll manifest her into
|
||||||
|
existence. It worked for Lane, at least.
|
||||||
|
|
||||||
|
I see Rachel on Tuesday. Yeugh. Time to watch some of The
|
||||||
|
Pitt tonight and try to relax. I think I might travel into
|
||||||
|
Pitt tomorrow to go to the gym. I feel like I need it.
|
||||||
|
|
||||||
|
I love you, me. We're figuring this shit out.
|
||||||
Loading…
x
Reference in New Issue
Block a user