Obsidian/Presentations/ERLM/speaker-notes.md

Speaker Notes: Formally Verified Autonomous Hybrid Control

Presentation for Engineering PhDs Audience: General engineering background, not necessarily control/nuclear/formal methods experts

---

Slide 1: Title & Roadmap

Central Thesis: Formally verified autonomous hybrid control is both necessary and achievable for next-generation nuclear power.

Roadmap Overview:

1. The Problem: Economic challenge + fundamental human reliability limits
2. The Technical Challenge: Hybrid systems and why current methods fall short
3. The Solution: Three-thrust approach with formal guarantees + hardware-in-the-loop
4. The Impact: Beyond nuclear applications

---

Slide 2: Economic Challenge

Small modular reactors face an unsustainable staffing cost problem

The Economic Reality:

• Current requirement: 2+ Reactor Operators + 1+ Senior Reactor Operator per unit
• Training timeline: up to 6 years to become licensed reactor operator
• Small modular reactors have same staffing overhead but lower power output
• Result: Higher per-megawatt O&M costs threaten economic viability

The Market Opportunity:

• Datacenter demand projected: 1,050 TWh annually by 2030
• Nuclear O&M costs: 23-30% of levelized cost ($88.24/MWh)
• Annual O&M for datacenter demand alone: $21-28 billion

Key message: Automation is not optional---it's economically essential

---

Slide 3: Safety Imperative

Human operators are the root cause of 70-80% of nuclear incidents

The Human Error Problem:

• 70-80% of events attributed to human error (multiple independent analyses)
• IAEA categorical statement: "Human error was the root cause of ALL severe accidents"
  • Three Mile Island, Chernobyl, Fukushima

Three Mile Island (1979):

• 100+ simultaneous alarms overwhelmed operators
• Operators shut down emergency cooling based on incorrect assessment
• Result: 44% of fuel melted
• Risk assessment was off by 500-fold (5% actual vs 0.01% predicted)

Fundamental Cognitive Limitations:

• Working memory: 7±2 items (Miller, 1956)
• Human Error Probability degrades under stress:
  • Optimal conditions: 0.001-0.01 (0.1-1%)
  • Accident conditions: 0.1-1.0 (10-100%) = essentially guaranteed failure
• Four decades of training improvements haven't changed the 70-80% ratio

---

Slide 4: The Paradox

Nuclear control faces a fundamental tension

The Paradox: Human operators are both essential for flexibility and the primary source of failure

Why We Need Humans:

• Strategic decision-making
• Procedure interpretation
• Handling novel situations
• Adaptive judgment
• Legal authority (10 CFR 55)

Why Humans Fail:

• Working memory: 7±2 items
• Response time: seconds vs milliseconds
• Cognitive biases (confirmation, anchoring)
• Stress degrades performance 10-50x
• Error rates: 0.001 → 1.0 under accident conditions

Current Division of Labor:

• Automated: Emergency protection (trip systems, ECCS) = terminal operations
• Manual: Strategic operations (startup, mode transitions, power changes) = routine operations
• Problem: This is backwards! We automate terminal ops but manually handle routine ops.

Goal: Combine the reliability of automation with the sophistication of human decision-making

---

Slide 5: Hybrid Systems

Hybrid systems combine continuous dynamics with discrete mode switching

Nuclear plants are inherently hybrid systems

Continuous Dynamics:

• Reactor temperature, neutron flux, pressure, flow rates, heat transfer
• Governed by differential equations: ẋ(t) = f(x(t), q(t), u(t))

Discrete Decisions:

• Mode transitions, control strategy changes, safety system actuation, procedure steps
• Governed by logic: q(k+1) = ν(x(k), q(k), u(k))

Example: Reactor Startup

• Cold Shutdown → Heatup → Approach Criticality → Low Power
• Each mode has continuous dynamics; transitions are discrete strategic decisions
• This is exactly what human operators do today

---

Slide 6: Current Gaps

Existing methods can handle either continuous or discrete, but not both

Formal Methods (HARDENS):

• Can verify discrete logic (requirements → verified binaries)
• Achieved in 9 months, low cost
• BUT: Cannot handle continuous dynamics

Control Theory:

• Can verify continuous stability (Lyapunov, LQR, robust control)
• BUT: Cannot verify discrete transitions or mode switching

THE GAP: Hybrid system verification with formal guarantees spanning both continuous and discrete

HARDENS Achievement:

• Complete RTS verification (discrete only)
• TRL 3-4, no experimental validation
• Requirements → formal specs → verified implementation
• But: No continuous dynamics, no closed-loop verification

We need to bridge this gap.

---

Slide 7: Approach Overview

Unifying discrete synthesis and continuous verification enables end-to-end guarantees

Three-Thrust Integrated Approach:

Thrust 1 (Procedures → Temporal Logic):

• Use NASA FRET to translate written procedures to formal specifications
• Example: "If high temp, insert rods until reset" becomes G(T_high → X(rods ∧ ...))
• Realizability checking catches errors in procedures before implementation

Thrust 2 (Temporal Logic → Discrete Automaton):

• Reactive synthesis generates correct-by-construction state machine
• Discrete controller is mathematically guaranteed to follow specifications

Thrust 3 (Continuous Controllers):

• Use reachability analysis and barrier certificates
• Compositional verification: local proofs, global guarantees

Innovation: Each piece uses state-of-the-art tools; innovation is in the integration

---

Slide 8: Thrust 1 - Procedures to Logic

NASA's FRET tool translates procedures into unambiguous logic

The Challenge: Natural language is ambiguous; machines need precise specifications

Example Translation:

• Natural: "If a high temperature alarm triggers, control rods must immediately insert and remain inserted until operator reset."
• Logic: G(HighTemp → X(RodsInserted ∧ (¬RodsWithdrawn U OpReset)))

FRETish Structure: 6 components eliminate ambiguity

• [Scope] [Condition] [Component] SHALL [Timing] [Response]

Realizability Checking: Catches errors before implementation

• Detects conflicting requirements
• Identifies undefined behaviors (gaps left to human judgment)
• These are "bugs in the procedures"---better to find them early!

Output: Unambiguous temporal logic ready for synthesis

---

Slide 9: Thrust 2 - Reactive Synthesis

Reactive synthesis generates provably correct discrete controllers

What is Reactive Synthesis?

• Input: Temporal logic formula (what should happen)
• Output: Finite state machine (how to make it happen)
• Guarantee: If a solution exists, it is correct by construction

Example: Simplified Reactor Automaton

• Nodes = discrete modes (what control strategy to use)
• Edges = transition conditions (when to switch)
• No switching errors possible---the automaton is mathematically guaranteed to satisfy specifications

This is the "Operator's Decision-Making" Automated

Tool: Strix (SYNTCOMP competition winner)

Output: Discrete controller with formal correctness guarantee

---

Slide 10: Thrust 3 - Continuous Verification

Continuous controllers verified using three complementary techniques

Three Types of Continuous Modes:

1. Stabilizing: Stay in current mode (e.g., full-power operation)
2. Transitory: Drive toward next mode (e.g., startup heatup)
3. Expulsory: Force to safe mode (e.g., SCRAM)

Three Verification Techniques:

1. Reachability Analysis:

   • Compute reachable state sets
   • Verify boundary conditions met
   • Recent advances: Neural Hamilton-Jacobi for high dimensions

2. Assume-Guarantee:

   • Local verification, global guarantees
   • Each mode verified independently

3. Barrier Certificates:

   • Prove safe set forward invariance
   • Guarantee transitions occur correctly

Key Innovation: Design continuous controllers after synthesizing automaton

• Automaton defines transition boundaries
• Design each mode to satisfy its local transitions
• Compositional verification avoids intractable global analysis

Output: Verified continuous modes + discrete automaton = Complete hybrid controller

---

Slide 11: Key Insight

Automaton-first design makes verification tractable

Traditional Approach (Intractable):

• Design everything at once
• Verify entire trajectory through all modes
• Computationally intractable for complex systems

Our Approach (Tractable):

1. Synthesize Discrete Automaton (tells us what boundaries to verify)
2. Define Transition Boundaries (from automaton structure)
3. Design Continuous Modes Locally (each controller designed for its specific job)
4. Verify Each Mode Independently (local verification is tractable)
5. Compose via Assume-Guarantee (interface contracts guarantee composition)

Key Message: Decomposition is the key to tractable verification

---

Slide 12: Demonstration

SmAHTR autonomous startup provides a rigorous test case

Small Modular Advanced High Temperature Reactor (SmAHTR):

• Liquid-salt cooled reactor design
• Well-documented startup procedures
• Representative of next-generation SMR designs

Startup Sequence: Cold → Controlled Heating → Approach Criticality → Low-Power Physics → Full Power

Each mode has different control objective:

• Temp control → Ramp rate → Reactivity → Neutron flux → Load following

Implementation Platform:

• Simulation: High-fidelity Simulink model (thermal-hydraulics + neutron kinetics)
• Hardware: Emerson Ovation control system (industry standard)
• Integration: ARCADE platform (hardware-in-the-loop)
• Validation: Real-time performance on actual control equipment

Why This Matters:

• Multiple coordinated subsystems
• Strict timing/temperature constraints
• Complex nonlinear dynamics
• This is not a toy problem---it's representative of deployment challenges

---

Slide 13: Expected Outcomes

Success measured by progression to TRL 5

Technology Readiness Level Progression:

• Current: TRL 2-3 (basic concepts, HARDENS precedent)
• Target: TRL 5 (validated prototype in relevant environment)
• Gap: Experimental validation with continuous dynamics

Three Concrete Deliverables:

1. Procedure Translation Methodology

• Engineers generate verified controllers from regulatory procedures
• No formal methods expertise required

2. Continuous Verification Framework

• Standard control design + iterative verification
• Mathematical proof of safe mode transitions

3. SmAHTR Hardware-in-the-Loop Demonstration

• Autonomous startup on industrial control hardware
• Real-time performance validation
• Clear path to deployment

Key Message: TRL 5 proves both theoretical validity and practical implementability

---

Slide 14: Broader Impact

This methodology generalizes to any safety-critical hybrid system

Common Pattern Across Domains:

• Written procedures exist
• Continuous dynamics + discrete decisions
• Safety is paramount
• Autonomy has economic benefits

Application Domains:

• Chemical Process: Batch processes, safety interlocks
• Aerospace: Flight phases, emergency procedures
• Autonomous Transport: Driving modes, emergency maneuvers
• Medical Devices: Therapy modes, patient monitoring
• Power Grid: Generation modes, fault response

Economic Multiplier:

• Nuclear O&M (datacenter demand): $21-28B annually
• Broader safety-critical infrastructure: Much larger

Regulatory Pathway:

• Proving concept in nuclear (highest safety bar)
• Establishes precedent: mathematical proof as regulatory evidence
• Easier adoption in other industries

Key Message: Nuclear is the proving ground; impact extends far beyond

---

Slide 15: Innovation Summary

The innovation is systematic integration to bridge a fundamental gap

What's NOT New (but state-of-the-art):

• Temporal logic
• Reactive synthesis
• Reachability analysis
• Barrier certificates
• Hardware-in-the-loop

These are mature techniques from computer science and control theory.

What IS New:

• Integration: Unifying discrete and continuous verification
• Methodology: Systematic tool-supported workflow
• Decomposition: Automaton-first design enables tractable verification
• Practical: Targets existing industrial hardware

Comparison to HARDENS:

Feature	HARDENS (2022)	This Work
Discrete verification	✓	✓
Continuous verification	✗	✓
Hybrid system verification	✗	✓
Experimental validation	TRL 3-4	TRL 5
Hardware-in-the-loop	✗	✓

Key Enabling Insight: Automaton-first design makes continuous verification tractable by decomposing the problem into local verifications with compositional guarantees

---

Slide 16: Conclusion

Formally verified autonomous hybrid control: necessary, achievable, timely

Three Converging Imperatives:

1. Economic: SMRs need autonomy to be viable

• $21-28B annual O&M for datacenter demand alone
• Per-megawatt staffing costs threaten SMR economics

2. Safety: Human error causes 70-80% of incidents

• Training can't overcome fundamental cognitive limits
• Error probability: 0.001 → 1.0 under accident conditions

3. Technical: Tools now exist to verify hybrid systems

• HARDENS proved discrete verification is feasible
• Control theory provides continuous verification tools
• We can now bridge the gap

This Research Closes the Gap: HARDENS (Discrete) + Continuous Verification = Complete Hybrid System

Vision: Control engineers generate high-assurance autonomous controllers from procedures.

• No formal methods PhD required
• Mathematical proof included
• Deployable on existing industrial hardware

---

Slide 17: Questions

Contact Information:

• Dane A. Sabo: dane.sabo@pitt.edu
• Dr. Dan G. Cole: dgcole@pitt.edu
• University of Pittsburgh, Cyber Energy Center

---

Key Talking Points to Remember

Opening (Slides 1-4)

• Hook with economics: $21-28B annual market
• Pivot to safety: 70-80% human error is a fundamental problem
• The paradox: We need human sophistication but can't tolerate human unreliability

Technical Middle (Slides 5-11)

• Hybrid systems are how nuclear plants actually operate
• Current tools only handle half the problem
• Our innovation: integration of existing tools with automaton-first decomposition
• Emphasize "correct by construction" throughout

Demonstration & Impact (Slides 12-16)

• SmAHTR is real, not toy problem
• TRL 5 means practical feasibility, not just theory
• Nuclear is proving ground, but impact is much broader
• Now is the right time: economics + safety + technical maturity converge

Anticipate Questions

• "Why not just train operators better?" → 40 years of improvements haven't changed 70-80% ratio; cognitive limits are fundamental
• "How does this compare to ML/AI approaches?" → We provide mathematical proofs, not statistical confidence
• "What about edge cases?" → That's the point! Realizability checking finds specification gaps; formal verification proves all cases
• "Timeline?" → HARDENS did discrete in 9 months; we're building on that foundation
• "Why nuclear first?" → Highest safety bar + best documented procedures + huge economic driver