a20d2a05e9
Previously conflated two different kinds of constraint:
- operational deadbands (|T_c - T_c0| <= 5 F) used by the DRC for mode
transitions. Symmetric bands around setpoint. Violating these is an
operator/operational issue, not a safety issue.
- safety limits (T_f <= 1200 C, T_c <= 320 C, n <= 1.15, etc.) are
hard one-sided halfspaces corresponding to physical damage mechanisms
or reactor-trip setpoints. THESE are what a safety barrier/reach must
discharge.
predicates.json now has three groups:
- operational_deadbands (t_avg_above_min, t_avg_in_range, p_above_crit)
- safety_limits (fuel_centerline, t_avg_high_trip, t_avg_low_trip,
n_high_trip, n_low_operation, cold_leg_subcooled)
- mode_invariants (inv1_holds, inv2_holds as conjunctions of safety_limits)
reach_operation.m and barrier_lyapunov.m both now report halfspace-by-
halfspace margins against inv2_holds. Attributable failure analysis:
we can see WHICH limit is tightest.
Reach tube (under +/-15% Q_sg load): passes all 6 safety halfspaces.
Tightest margin is n_high_trip at +0.138 (12% from trip). Temperature
directions have 10-870 K margin.
Lyapunov barrier (same): fails all 6. Worst is n_high_trip with -2365
margin — the ellipsoid says n could deviate by +/-2364, which is
physically meaningless. Anisotropy cost made visible per-direction.
Motivates SOS / polytopic barriers for the thesis chapter.
load_predicates.m now returns .operational_deadbands, .safety_limits,
and .mode_invariants. Existing callers that only used .constants or
.t_avg_in_range still work because those live under the old keys.
Hacker-Split: user caught that the barrier was checking the wrong
invariant; safety limits != operating deadband. Restructured so the
proof target matches the physical claim.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
pwr-hybrid-3-demo
Preliminary example for the HAHACS thesis — a verified hybrid controller for a small modular PWR startup. Composes three layers into one demonstrable pipeline:
- Discrete layer (
fret-pipeline/): FRET natural-language requirements → LTL → synthesized AIGER controller → state-machine diagram. - Continuous layer (
plant-model/): 10-state point kinetic equation + thermal-hydraulics PWR model with bounded steam-generator heat removal as the disturbance input. - Research context (
thesis/): the HAHACS PhD proposal that motivates and formalizes the methodology.
Layout
pwr-hybrid-3-demo/
CLAUDE.md AI-facing context and architecture map
docs/
architecture.md How the discrete and continuous layers compose
figures/ Shared figures for thesis + talks
fret-pipeline/ FRET → ltlsynt → AIGER → state machine
plant-model/ PWR point kinetics + thermal-hydraulics
reachability/ Continuous-mode verification (linear-model tube + Lyapunov barrier attempt; see README)
julia-port/ Parallel plant-model port + ReachabilityAnalysis.jl scaffold
hardware/ Ovation HIL artifacts (TBD)
claude_memory/ Session notes by AI agents (distilled up into CLAUDE.md over time)
thesis/ [submodule] PhD proposal
presentations/
2026DICE/ [submodule] DICE 2026 abstract
Quickstart
Clone with submodules:
git clone --recurse-submodules <url>
cd pwr-hybrid-3-demo
Run the controller synthesis pipeline:
cd fret-pipeline
python3 scripts/fret_to_synth.py pwr_hybrid_3.json specs/synthesis_config_v3.json
bash scripts/synthesize.sh specs/synthesis_config_v3.json circuits
python3 scripts/trace_aiger.py circuits/PWR_HYBRID_3_DRC.aag diagrams
dot -Tpng diagrams/PWR_HYBRID_3_DRC_states.dot -o diagrams/PWR_HYBRID_3_DRC_states.png
Run the plant model (MATLAB in plant-model/ — Octave compatibility not tested since the LQR pieces landed):
main % original single-scenario demo (null vs operation)
main_mode_sweep % all five DRC modes back-to-back, writes to ../docs/figures/
test_linearize % Jacobian sanity check, saves linearization for reach
Run the reach artifacts (reachability/):
reach_operation % linear reach tube for operation-mode LQR
barrier_lyapunov % Lyapunov-ellipsoid barrier cert attempt (sweeps weights)
Soundness note: the current reach tube is the LINEAR model's tube;
it is not yet a sound over-approximation of the nonlinear plant. See
reachability/README.md § Soundness status.
Prerequisites
- Python 3.10+
- Spot for
ltlsynt(brew install spot) - Graphviz for
dot(brew install graphviz) - MATLAB or GNU Octave for the plant model
- LaTeX (via
latexmk) for the thesis submodule
Further reading
CLAUDE.md— orientation for AI agents working in this repodocs/architecture.md— how the layers composethesis/CLAUDE.md— the thesis project structurefret-pipeline/README.md— FRET naming conventions and pipeline detailsplant-model/README.md— scenario setup and model equations