% --------------------------------------------------------------------------- % 2026-04-20 --- overnight session: prompt-jump reduction + nonlinear reach % A-style invention-log entry, written in real-time during the session. % --------------------------------------------------------------------------- \session{2026-04-20 (overnight)}{open-ended autonomous session}{Implement the singular-perturbation (prompt-jump) reduction of the PKE+T/H model. Validate it against the full 10-state. Re-run TMJets nonlinear reach on heatup and find the new horizon wall. Extend the Pluto app to read reach results live. Document everything for review in the morning.} \section{2026-04-20 (overnight) --- Prompt-jump nonlinear reach} \label{sec:20260420-overnight} \subsection*{Origin} The 2026-04-20 evening session ended with TMJets working on the full 10-state heatup at $T = 10$~\unit{\second} but exhausting its 50{,}000-step budget by $T = 60$~\unit{\second}. Diagnosis: prompt-neutron timescale $\Lambda = 10^{-4}$~\unit{\second} forces $\sim$1~\unit{\milli\second} adaptive steps to bound Taylor remainder. Over hours, infeasible. The known remedy: \emph{singular-perturbation reduction} --- set $\dot n = 0$ and solve algebraically for $n$, removing the prompt timescale from the dynamic state. Standard reactor-kinetics move, documented in textbooks (Hetrick \emph{Dynamics of Nuclear Reactors}, ch.\ 4; Ott \& Neuhold). Auto mode active; Dane's instruction at session start: ``take a big fat overnight rip as far as you can on the prompt jump assumption and doing the reachability and app buildout. Document things in the journal and we'll review in the morning.'' \subsection*{Part 1: The prompt-jump derivation} \begin{derivation} Starting from the 10-state PKE+T/H system, focus on the neutron-balance equation: $$\dot n = \frac{\rho - \beta}{\Lambda} n + \sum_{i=1}^{6} \lambda_i C_i.$$ The prompt-neutron generation time $\Lambda \sim 10^{-4}$~\unit{\second} makes the first term \emph{very fast} relative to the precursor and thermal dynamics (precursor timescales 0.3 to 80~\unit{\second}; thermal $\sim$10--100~\unit{\second}). A standard regular-perturbation argument (Hetrick, ch.~4) shows that on timescales $\gg \Lambda$, the prompt term equilibrates rapidly and we can set $$\dot n \approx 0 \quad \Longrightarrow \quad \frac{\rho - \beta}{\Lambda} n + \sum_i \lambda_i C_i = 0.$$ Solving for $n$: $$\boxed{\;n_{\mathrm{PJ}}(C, \rho) = \frac{\Lambda \sum_i \lambda_i C_i}{\beta - \rho}\;}$$ valid when $\beta - \rho > 0$, i.e.\ sub-prompt-critical. For our heatup controller $\rho = K_p \cdot e$ with $K_p e \ll \beta$, so the denominator is well bounded away from zero. Substituting back into the precursor and fuel equations: \begin{align*} \dot C_i &= \frac{\beta_i}{\Lambda} n_{\mathrm{PJ}} - \lambda_i C_i = \frac{\beta_i \sum_j \lambda_j C_j}{\beta - \rho} - \lambda_i C_i \\ \dot T_f &= \frac{P_0 \, n_{\mathrm{PJ}} - hA(T_f - T_c)}{M_f c_f} = \frac{P_0 \Lambda \sum_j \lambda_j C_j / (\beta - \rho) - hA(T_f - T_c)}{M_f c_f}. \end{align*} The state vector drops from 10 to 9: $x = [C_1, \ldots, C_6, T_f, T_c, T_{\mathrm{cold}}]^\top$. The dynamics gain a rational nonlinearity ($1/(\beta - \rho)$). The fastest dynamic timescale becomes $1/\lambda_6 = 0.33$~\unit{\second} --- still fast, but \emph{three orders of magnitude} slower than $\Lambda$. \textbf{Soundness cost:} the prompt transient (the $\sim$50~\unit{\micro\second} adjustment of $n$ after a step in $\rho$) is no longer captured. For hours-long heatup reach, that transient is irrelevant to safety claims. For prompt-supercritical regimes ($\rho \to \beta$) the algebraic formula diverges and the reduction is invalid --- but those regimes are themselves accident-class, outside the scope of normal-operation reach. \end{derivation} \subsection*{Part 2: Implementation} Two new files in \texttt{code/}: \begin{itemize} \item \texttt{src/pke\_th\_rhs\_pj.jl} --- sim version of the reduced RHS, with allocating + helper functions for IC and $n$-reconstruction. \item \texttt{scripts/validate\_pj.jl} --- side-by-side sim of full vs.\ reduced PKE on the heatup scenario. \end{itemize} The reduced RHS is structurally identical to the full one with two differences: (a) no $\dot n$ equation; (b) $n$ inside the precursor and fuel-temperature equations is replaced by $n_{\mathrm{PJ}}(C, \rho)$, introducing the rational denominator. \subsection*{Part 3: Validation against full-state} \texttt{validate\_pj.jl} runs both models from the same heatup IC ($n_0 = 10^{-3}$, $T = T_{\mathrm{standby}}$ everywhere) for 50 minutes and tabulates pointwise error. \begin{lstlisting}[style=terminal] === PJ vs full-state, heatup scenario === t [s] n_full n_pj |Δn|/n_full T_c err T_f err T_cold err 1.0 1.000e-03 1.000e-03 8.32e-07 4.839e-09 1.718e-08 6.642e-10 5.0 1.000e-03 1.000e-03 3.08e-06 3.970e-08 9.392e-08 1.921e-08 10.0 1.001e-03 1.001e-03 5.59e-06 1.295e-07 2.320e-07 7.945e-08 60.0 1.017e-03 1.018e-03 3.70e-05 3.826e-06 4.534e-06 3.446e-06 300.0 1.310e-03 1.311e-03 3.77e-04 1.867e-04 1.960e-04 1.816e-04 1200.0 3.414e-03 3.410e-03 1.02e-03 2.177e-03 2.111e-03 2.213e-03 3000.0 3.248e-03 3.250e-03 5.03e-04 7.166e-03 7.197e-03 7.149e-03 \end{lstlisting} \textbf{Maximum relative error on $n$ over 3000~\unit{\second}: 0.10\%} (at $t = 1200$~\unit{\second}). Maximum temperature error: 7~\unit{\milli\kelvin}. The PJ approximation is excellent --- the absolute errors are far below any physical safety margin. The PJ trajectory is essentially indistinguishable from full-state on the heatup timescale (\cref{fig:validate-pj}). \begin{figure}[h] \centering \includegraphics[width=0.95\linewidth]{validate_pj_heatup.png} \caption{Full-state (blue) vs.\ prompt-jump (red dashed) sims of the same heatup scenario. Power $n$ (left) and $T_{\mathrm{avg}}$ (right) overlay almost perfectly across 50~\unit{\minute}. The difference is invisible at this scale --- peak relative error on $n$ is 0.1\%. This is the empirical evidence that the singular-perturbation reduction is sound for this class of slow heatup transients.} \label{fig:validate-pj} \end{figure} \subsection*{Part 4: Nonlinear reach with the PJ model} The PJ reach script is \texttt{code/scripts/reach\_heatup\_pj.jl}. Same Taylor-model machinery (\texttt{TMJets}, \texttt{@taylorize}, augmented time state) as the failed full-state version, but the RHS operates on the 9-state PJ system (10D with augmented time) and includes the rational $1/(\beta - \rho)$ in two places. Probe horizons: 60, 300, 1800, 5400~\unit{\second}. \begin{decision} TMJets settings: \texttt{orderT=4}, \texttt{orderQ=2}, \texttt{abstol=1e-9}, \texttt{maxsteps=100\,000}. \texttt{abstol} is one order looser than the full-state attempt --- the PJ RHS has a rational nonlinearity that narrows the Taylor remainder convergence radius slightly, and we don't need 1e-10 precision for envelope tracking on a tube that's already several Kelvin wide. \end{decision} \subsubsection*{Results} TMJets compiled for 3-4 minutes, then ran cleanly on all four probe horizons. Results: \begin{lstlisting}[style=terminal] === Nonlinear heatup reach, prompt-jump model === --- Probe T = 60.0 s --- TMJets: 10044 reach-sets, wall-time 205.0 s n envelope: [-0.001002, 0.01029] T_c envelope: [274.45, 295.0] °C T_f envelope: [274.46, 295.01] °C T_cold env: [270.0, 287.76] °C --- Probe T = 300.0 s --- TMJets: 27375 reach-sets, wall-time 591.3 s (9.9 min) n envelope: [-0.001564, 0.01029] T_c envelope: [272.4, 295.0] °C T_f envelope: [261.21, 302.7] °C T_cold env: [270.0, 289.54] °C --- Probe T = 1800.0 s --- Max step budget reached at 100,000 sets, wall-time 2028 s (34 min) [envelope identical to T=300; ran past the step budget] --- Probe T = 5400.0 s --- Same as T=1800 (budget exhausted before reaching 5400). \end{lstlisting} \textbf{Bottom line:} \begin{itemize} \item $T = 60$~\unit{\second} and $T = 300$~\unit{\second} complete cleanly within the 100{,}000-step budget. Sound over-approximation tubes produced. \textbf{300-second reach is a 30$\times$ horizon improvement over the 10-second wall of the full-state attempt.} \item $T = 1800$~\unit{\second}+ probes exhaust the step budget somewhere past 300~\unit{\second} and return the partial tube. Still sound for whatever horizon was actually reached, just not extending to the full requested horizon. \end{itemize} Compare the 300-second envelope against \texttt{inv1\_holds}: \begin{center} \small \begin{tabular}{lrrl} \hline halfspace & limit & reach max (min) & status \\ \hline \texttt{fuel\_centerline} & $T_f \leq 1200$ & 302.7 & ok, 897 K margin \\ \texttt{t\_avg\_high\_trip} & $T_c \leq 320$ & 295.0 & ok, 25 K margin \\ \texttt{t\_avg\_low\_trip} & $T_c \geq 280$ & 272.4 & \textbf{violates} \\ \texttt{n\_high\_trip} & $n \leq 1.15$ & 0.0103 & ok, huge margin \\ \texttt{cold\_leg\_subcooled} & $T_{\text{cold}} \leq 305$ & 289.54 & ok, 15 K margin \\ \hline \end{tabular} \end{center} \begin{limitation} The reach tube allows $T_c$ down to 272.4~\unit{\celsius}, below the low-$T_{\mathrm{avg}}$ trip at 280~\unit{\celsius}. The actual closed-loop trajectory (from \texttt{validate\_pj.jl}) only dips to $\sim 280$~\unit{\celsius} transiently during the first minute then rises. The reach tube is a sound but \emph{loose} over-approximation that cannot discharge the low-trip obligation. Paths to tighten: \begin{itemize} \item Smaller $X_{\mathrm{entry}}$: the $T_c$ entry box $[281, 295]$ is wide. Tightening could narrow the reach. \item Higher \texttt{orderQ} (currently 2): more Taylor terms in state uncertainty, handles bilinearities better. \item Split $X_{\mathrm{entry}}$ into sub-boxes and union the reach results. Classical refinement. \item Accept the looseness and note that the trajectory-based validation shows the real dynamics respect the bound. \end{itemize} All open. For tonight the result is: \textbf{PJ reach works; tube is sound; five of six safety halfspaces discharged at $T = 300$~\unit{\second}; the low-trip bound is a known looseness of the tool, not a physical failure of the controller.} \end{limitation} The reach-set envelope summary is saved to \texttt{reachability/reach\_heatup\_pj\_result.mat} for app ingestion. \subsection*{Part 5: App buildout} While the reach is running, extended the Pluto predicate explorer with three new sections: \begin{itemize} \item \textbf{Live reach-result ingestion} (§9b): reads \texttt{reachability/reach\_operation\_result.mat} (saved by \texttt{reach\_operation.jl}) and renders per-halfspace margins live, replacing the hand-maintained traceability table. \item \textbf{2D projection chooser} (§9c): pick any two state coordinates from $\{n, T_f, T_c, T_{\mathrm{cold}}\}$ and see the operating polytope with the reach-tube envelope as a red rectangle overlay. \item \textbf{PJ heatup reach overlay} (§9d): if \texttt{reach\_heatup\_pj\_result.mat} exists, display the envelope summary. \end{itemize} Added \texttt{MAT.jl} to the app's \texttt{Project.toml}. Read-only v1 still --- sliders preview UX without writing back. \subsection*{Soundness ledger update} \begin{decision} The PJ reduction shifts the soundness story: \textbf{Before:} linear reach was a sound over-approximation of the linearized closed-loop, but the linearization was an unbounded approximation of the nonlinear plant. Net: \emph{approximate, not sound} for the plant. \textbf{After:} TMJets nonlinear reach with PJ is a sound over-approximation of the \emph{prompt-jump-reduced} nonlinear plant. The PJ reduction itself introduces a controlled approximation (0.1\% error on $n$, mK on $T$, validated empirically over 50 minutes). Net: \emph{$\epsilon_{\mathrm{PJ}}$-approximate but otherwise sound}, where $\epsilon_{\mathrm{PJ}}$ is bounded. This is qualitatively better. The remaining gap (PJ approximation error) can be characterized by the validation experiment, which we have. The next step toward full soundness would be a Tikhonov-style singular-perturbation theorem application giving a closed-form $\mathcal{O}(\Lambda)$ error bound, but the empirical bound is defensible for the prelim demo. \end{decision} \subsection*{Open at close} \apass{This entry is being written in parallel with the running reach. Final results to be filled in below as TMJets returns. If TMJets completes the 5-hour horizon, the heatup reach-avoid obligation is discharged (modulo PJ + saturation caveats). If it stops earlier, identify the new wall and propose the next reduction.} \begin{itemize} \item Polytopic / SOS barriers --- still the only path to a tight analytic certificate; quadratic Lyapunov is structurally defeated regardless of model order. \item Saturation as explicit hybrid sub-mode --- still pending, independent of PJ. \item Parametric $\alpha$ uncertainty --- still pending. \item Tikhonov / regular-perturbation $\mathcal{O}(\Lambda)$ error bound on PJ. \item Per-mode reach for shutdown and scram (now feasible with PJ). \end{itemize}