PWR-HYBRID-3/claude_memory/2026-04-27-scram-X_exit-shutdown-margin.md

2026-04-27 — Scram X_exit redefinition: shutdown-margin halfspace

What changed

Replaced the scram-mode X_exit predicate from n <= 1e-4 AND T_f <= T_f0 + 50 C to a single linear halfspace shutdown_margin:

alpha_f * T_f + alpha_c * T_c <= -rho_SDM - U_SCRAM + alpha_f*T_f0 + alpha_c*T_c0
                              ≈ 0.002972

with rho_SDM = 0.01 (1% Δk/k tech-spec floor).

Files touched:

• reachability/predicates.json — added shutdown_margin under safety_limits; updated mode_definitions.q_scram.X_exit_predicate and X_safe_predicate; left a _X_exit_history field for forensics.
• code/scripts/reach/reach_scram_pj.jl — added RHO_SDM, SDM_RHS constants; reach loop now reports ρ-bounds and the halfspace LHS sup per probe horizon; .mat output gets sdm_lhs_hi, rho_max, sdm_ok per horizon plus a global sdm_rhs, rho_sdm.

Why

1. Power threshold was nonlinear in PJ state. In the prompt-jump reduction, n = Λ * sum(λ_i*C_i) / (β - ρ) — ρ depends on T_f, T_c. So n ≤ 1e-4 is not a halfspace in the reach state. We were reconstructing it post-hoc on every probe, which works for a diagnostic check but doesn't compose with halfspace-based discharge.
2. T_f ≤ T_f0 + 50 was infeasible-by-construction at 60 s. Decay heat (Q_sg = 3% P0) plus a fuel time constant M_f*C_f / hA ≈ 0.3 s means T_f rapidly equilibrates with T_c, but the system loses only ~5 °C in 60 s under constant decay — nowhere near the threshold, and never going back up either. The bound was dressing, not work.
3. Shutdown margin is the actual NRC criterion. Tech specs phrase scram success in Δk/k, not in flux. And ρ is linear in (T_f, T_c) post-scram (constant u = U_SCRAM), so it's a clean single-row halfspace.

Result

reach_scram_pj.jl discharges shutdown_margin at all three probe horizons (10, 30, 60 s), with massive margin:

T (s)	reach-sets	wall (s)	ρ at horizon	discharged
10	6919	98.6	[-0.0507, -0.0504]	✓
30	9900	130.5	[-0.0506, -0.0503]	✓
60	12340	164.2	[-0.0503, -0.0500]	✓

Required: ρ ≤ -0.01. Actual: |ρ| ≈ 5%. The Doppler/moderator contributions vary by ~3% of U_SCRAM, so the margin is dominated by rod worth — exactly what physical intuition predicts.

.mat output: results/reach_scram_pj_result.mat.

Subtlety I tripped on

Hand-derived SDM_RHS = 0.00402 using rounded T_F0=320, T_C0=300. Actual values from pke_params: T_C0 = 308.35, T_F0 = 328.35 (because DT_CORE = P0/(W_M*C_C) = 36.7 °C, not 20). The script computes SDM_RHS from constants so the run was correct (0.002972), but the predicate JSON had the stale 0.00402. Fixed by switching the rhs_expr to a symbolic form. Rule for next time: if a constant in predicates.json is derivable from pke_params, write it as a symbolic expression, not a baked number — that's what T_cold0, T_c0, T_standby are for.

What's still open

• X_safe_predicate still says "fuel_centerline AND cold_leg_subcooled" but the reach script doesn't actually discharge those over the trajectory — only at the probe horizons. Not a problem for the demo (T_f and T_cold are monotone after scram), but the formal obligation is reach-AVOID, not just reach. Worth a follow-up: discharge the invariant halfspaces over the full flowpipe, not the endpoint.
• prompt_critical_margin_heatup is the controller-specific PJ-validity predicate. Scram has its own analogous concern (PJ valid only when β - ρ > 0 with margin). Trivially satisfied here (ρ ≈ -0.05, far from β = 0.0065), but worth a parallel prompt_critical_margin_scram predicate for completeness — would document the assumption rather than leave it implicit.

Graduation candidates

• The "rhs_expr should be symbolic when derivable" rule probably belongs in code/CLAUDE.md near the predicate-loading section. Hold for now — one occurrence isn't a pattern yet.