Editorial pass: three-level review (tactical/operational/strategic)

Tactical (sentence-level):
- Applied Gopen's Sense of Structure principles
- Broke long sentences into shorter, clearer statements
- Improved topic-stress positioning
- Strengthened verb choice and reduced weak constructions

Operational (paragraph/section):
- Enhanced transitions between paragraphs and subsections
- Added connective tissue referencing previous sections
- Improved flow and coherence within sections

Strategic (document-level):
- Verified Heilmeier question alignment across all sections
- Strengthened section summaries and transitions
- Ensured each section properly sets up the next
- Maintained consistent narrative arc from gap → solution → impact

1-goals-and-outcomes/research_statement_v1.tex

@@ -2,20 +2,20 @@
 This research develops autonomous control systems that provide mathematical guarantees of safe and correct behavior.
 
 % INTRODUCTORY PARAGRAPH Hook
-Human operators control nuclear reactors today by following detailed written procedures and switching between control objectives as plant conditions change.
+Human operators control nuclear reactors today. They follow detailed written procedures and switch between control objectives as plant conditions change.
 % Gap
-Small modular reactors face a fundamental economic challenge: their per-megawatt staffing costs far exceed those of conventional plants, threatening their economic viability. Autonomous control offers a solution—managing complex operational sequences without constant supervision—but only if it provides safety assurance equal to or exceeding that of human operators.
+Small modular reactors face a fundamental economic challenge. Their per-megawatt staffing costs far exceed those of conventional plants, threatening economic viability. Autonomous control could manage complex operational sequences without constant supervision—but only if it provides safety assurance equal to or exceeding that of human operators.
 
 % APPROACH PARAGRAPH Solution
-This research unifies formal methods from computer science with control theory to produce hybrid control systems correct by construction.
+This research unifies formal methods with control theory. The result: hybrid control systems correct by construction.
 % Rationale
-Human operators already work this way: they use discrete logic to switch between continuous control modes. Formal methods generate provably correct switching logic but cannot verify continuous dynamics. Control theory verifies continuous behavior but cannot prove discrete logic correctness. Both are required for end-to-end correctness.
+Human operators already work this way—they use discrete logic to switch between continuous control modes. Formal methods generate provably correct switching logic but cannot verify continuous dynamics. Control theory verifies continuous behavior but cannot prove discrete logic correctness. End-to-end correctness requires both.
 % Hypothesis and Technical Approach
-Three stages bridge this gap. First, NASA's Formal Requirements Elicitation Tool (FRET) translates written operating procedures into temporal logic specifications, structuring requirements by scope, condition, component, timing, and response. Realizability checking exposes conflicts and ambiguities before implementation begins. Second, reactive synthesis generates deterministic automata provably correct by construction. Third, reachability analysis verifies that continuous controllers—designed by engineers using standard control theory—satisfy each discrete mode's requirements.
+Three stages bridge this gap. First, NASA's Formal Requirements Elicitation Tool (FRET) translates written operating procedures into temporal logic specifications. FRET structures requirements by scope, condition, component, timing, and response. Realizability checking exposes conflicts and ambiguities before implementation begins. Second, reactive synthesis generates deterministic automata provably correct by construction. Third, reachability analysis verifies that continuous controllers satisfy each discrete mode's requirements. Engineers design these controllers using standard control theory.
 
-Continuous modes classify by control objective into three types. Transitory modes drive the plant between conditions. Stabilizing modes maintain operation within regions. Expulsory modes ensure safety under failures. Barrier certificates and assume-guarantee contracts prove mode transitions are safe, enabling local verification without global trajectory analysis. The methodology demonstrates on an Emerson Ovation control system—the industrial platform nuclear power plants already use.
+Continuous modes classify by control objective. Transitory modes drive the plant between conditions. Stabilizing modes maintain operation within regions. Expulsory modes ensure safety under failures. Barrier certificates and assume-guarantee contracts prove mode transitions are safe. This enables local verification without global trajectory analysis. The methodology demonstrates on an Emerson Ovation control system—the industrial platform nuclear power plants already use.
 % Pay-off
-This approach manages complex nuclear power operations autonomously while maintaining safety guarantees. It directly addresses the economic constraints that threaten small modular reactor viability.
+This approach manages complex nuclear power operations autonomously while maintaining safety guarantees. It addresses the economic constraints threatening small modular reactor viability.
 
 % OUTCOMES PARAGRAPHS
 This research, if successful, produces three concrete outcomes:

1-goals-and-outcomes/v1.tex

@@ -6,21 +6,21 @@ This research develops autonomous hybrid control systems that provide mathematic
 % INTRODUCTORY PARAGRAPH Hook
 Nuclear power plants demand the highest levels of control system reliability. Control system failures risk economic losses, service interruptions, or radiological release.
 % Known information
-Extensively trained human operators control nuclear plants today by following detailed written procedures and strict regulatory requirements. They switch between control modes based on plant conditions and procedural guidance.
+Extensively trained human operators control nuclear plants today. They follow detailed written procedures and strict regulatory requirements. They switch between control modes based on plant conditions and procedural guidance.
 % Gap
-This reliance on human operators prevents autonomous control and creates a fundamental economic challenge for next-generation reactor designs. Small modular reactors face per-megawatt staffing costs far exceeding those of conventional plants, threatening their economic viability. Autonomous control offers a solution—managing complex operational sequences without constant supervision—but only if it provides safety assurance equal to or exceeding that of human operators.
+This reliance on human operators prevents autonomous control. It creates a fundamental economic challenge for next-generation reactor designs. Small modular reactors face per-megawatt staffing costs far exceeding those of conventional plants. This threatens economic viability. Autonomous control could manage complex operational sequences without constant supervision—but only if it provides safety assurance equal to or exceeding that of human operators.
 
 % APPROACH PARAGRAPH Solution
-This research unifies formal methods with control theory to produce hybrid control systems correct by construction.
+This research unifies formal methods with control theory. The result: hybrid control systems correct by construction.
 % Rationale
-Human operators already work this way: they use discrete logic to switch between continuous control modes. Formal methods generate provably correct switching logic from written requirements but cannot verify continuous dynamics. Control theory verifies continuous behavior but cannot prove discrete switching correctness. Both are required for end-to-end correctness.
+Human operators already work this way—they use discrete logic to switch between continuous control modes. Formal methods generate provably correct switching logic from written requirements but cannot verify continuous dynamics. Control theory verifies continuous behavior but cannot prove discrete switching correctness. End-to-end correctness requires both.
 % Hypothesis
-Two steps close this gap. First, reactive synthesis generates discrete mode transitions directly from written operating procedures. Second, reachability analysis verifies continuous behavior against discrete requirements. Together, these steps transform operating procedures into logical specifications constraining continuous dynamics, producing autonomous controllers provably free from design defects. 
+Two steps close this gap. First, reactive synthesis generates discrete mode transitions directly from written operating procedures. Second, reachability analysis verifies continuous behavior against discrete requirements. These steps transform operating procedures into logical specifications constraining continuous dynamics. The result: autonomous controllers provably free from design defects. 
 
-The University of Pittsburgh Cyber Energy Center provides access to industry collaboration and Emerson control hardware, ensuring solutions align with practical implementation requirements.
+The University of Pittsburgh Cyber Energy Center provides access to industry collaboration and Emerson control hardware. This ensures solutions align with practical implementation requirements.
 
 % OUTCOMES PARAGRAPHS
-If successful, this approach produces three concrete outcomes:
+Three concrete outcomes define success for this approach:
 
 \begin{enumerate}
 
@@ -28,13 +28,13 @@ If successful, this approach produces three concrete outcomes:
   \item \textbf{Translate written procedures into verified control logic.}
     % Strategy
     The methodology converts written operating procedures into formal
-    specifications. Reactive synthesis tools then automatically generate
+    specifications. Reactive synthesis tools then generate
-    discrete control logic from these specifications. Structured intermediate
+    discrete control logic from these specifications automatically. Structured intermediate
     representations bridge natural language procedures and mathematical logic.
     % Outcome
-    Control engineers can generate verified mode-switching controllers
+    Control engineers generate verified mode-switching controllers
-    directly from regulatory procedures without formal methods expertise,
+    directly from regulatory procedures. Formal methods expertise becomes unnecessary.
-    lowering the barrier to high-assurance control systems.
+    This lowers the barrier to high-assurance control systems.
 
     % OUTCOME 2 Title
   \item \textbf{Verify continuous control behavior across mode transitions.}
@@ -62,10 +62,10 @@ If successful, this approach produces three concrete outcomes:
 \end{enumerate}
 
 % IMPACT PARAGRAPH Innovation
-\textbf{What makes this research new?} No existing methodology achieves end-to-end correctness guarantees for hybrid systems. Section 2 shows that prior work verified discrete logic or continuous dynamics—never both compositionally. This work unifies discrete synthesis with continuous verification through a key innovation: discrete specifications become contracts that continuous controllers must satisfy. Each layer verifies independently while guaranteeing correct composition. Together, these three outcomes—procedure translation, continuous verification, and hardware demonstration—establish a complete methodology spanning from regulatory documents to deployed systems.
+\textbf{What makes this research new?} No existing methodology achieves end-to-end correctness guarantees for hybrid systems. Section 2 shows that prior work verified discrete logic or continuous dynamics—never both compositionally. This work unifies discrete synthesis with continuous verification through a key innovation: discrete specifications become contracts that continuous controllers must satisfy. Each layer verifies independently while guaranteeing correct composition. These three outcomes—procedure translation, continuous verification, and hardware demonstration—establish a complete methodology. It spans from regulatory documents to deployed systems.
 
 % Outcome Impact
-If successful, control engineers will create autonomous controllers from existing procedures with mathematical proofs of correct behavior. This makes high-assurance autonomous control practical for safety-critical applications. Such capability is essential for the economic viability of next-generation nuclear power. Small modular reactors offer a promising solution to growing energy demands. Their success depends on reducing per-megawatt operating costs through increased autonomy. This research provides the tools to achieve that autonomy while maintaining the exceptional safety record the nuclear industry requires. 
+If successful, control engineers will create autonomous controllers from existing procedures with mathematical proofs of correct behavior. This makes high-assurance autonomous control practical for safety-critical applications. Such capability is essential for the economic viability of next-generation nuclear power. Small modular reactors offer a promising solution to growing energy demands. Their success depends on reducing per-megawatt operating costs through increased autonomy. This research provides the tools to achieve that autonomy. It maintains the exceptional safety record the nuclear industry requires. 
 
 This proposal follows the Heilmeier Catechism. Each section explicitly answers its assigned questions:
 \begin{itemize}

2-state-of-the-art/v2.tex

@@ -2,37 +2,38 @@
 
 \textbf{Heilmeier Questions: What has been done? What are the limits of current practice?} 
 
-No current approach provides end-to-end correctness guarantees for autonomous control. Human-centered operation cannot eliminate reliability limits. Formal methods verify either discrete or continuous behavior—never both. 
+No current approach provides end-to-end correctness guarantees for autonomous control. Human-centered operation cannot eliminate reliability limits. Formal methods verify either discrete or continuous behavior—never both simultaneously. 
 
-Three subsections structure this analysis. The first examines reactor operators and their operating procedures. The second addresses fundamental limitations of human-based operation. The third analyzes formal methods approaches that verify discrete logic or continuous dynamics but not both together.
+Three subsections structure this analysis. The first examines reactor operators and their operating procedures. The second addresses fundamental limitations of human-based operation. The third analyzes formal methods approaches that verify discrete logic or continuous dynamics—but not both together.
 
-Section 3 addresses the verification gap these limits establish.
+Section 3 addresses the verification gap these limits create.
 
 \subsection{Current Reactor Procedures and Operation}
 
-Current practice rests on two critical components: procedures and operators. Procedures define what must be done; operators execute those procedures. This subsection examines procedures: their hierarchy, development process, and role in defining operational modes. The next subsection examines operators: their reliability limits and contribution to accidents.
+Current practice rests on two critical components: procedures and operators. Procedures define what must be done. Operators execute those procedures. This subsection examines procedures—their hierarchy, development process, and role in defining operational modes. The next subsection examines operators—their reliability limits and contribution to accidents.
 
 Nuclear plant procedures form a strict hierarchy. Normal operating procedures govern routine operations. Abnormal operating procedures handle off-normal conditions. Emergency Operating Procedures (EOPs) manage design-basis accidents. Severe Accident Management Guidelines (SAMGs) address beyond-design-basis events, while Extensive Damage Mitigation Guidelines (EDMGs) cover catastrophic damage. All procedures must comply with 10 CFR 50.34(b)(6)(ii); NUREG-0899 provides development guidance~\cite{NUREG-0899, 10CFR50.34}. 
 
-Procedure development rests on expert judgment and simulator validation—not formal verification. Regulations mandate rigorous assessment: 10 CFR 55.59~\cite{10CFR55.59} requires technical evaluation, simulator validation testing, and biennial review. Yet key safety properties escape formal verification. No mathematical proof confirms procedures cover all possible plant states, required actions complete within available time, or transitions between procedure sets maintain safety invariants.
+Procedure development rests on expert judgment and simulator validation—not formal verification. Regulations mandate rigorous assessment. 10 CFR 55.59~\cite{10CFR55.59} requires technical evaluation, simulator validation testing, and biennial review. Yet key safety properties escape formal verification. No mathematical proof confirms that procedures cover all possible plant states. No proof confirms that required actions complete within available time. No proof guarantees that transitions between procedure sets maintain safety invariants.
 
 \textbf{LIMITATION:} \textit{Procedures lack formal verification of correctness
 and completeness.} No proof exists that procedures cover all
 possible plant states. No proof confirms that required actions complete within available
 timeframes. No proof guarantees that transitions between procedure sets maintain safety
-invariants. Paper-based procedures cannot ensure correct application. Even
+invariants. Paper-based procedures cannot ensure correct application. Computer-based procedure systems similarly lack the formal guarantees that automated reasoning
-computer-based procedure systems lack the formal guarantees that automated reasoning
 could provide.
 
 Nuclear plants operate with multiple control modes. Automatic control maintains target parameters through continuous reactivity adjustment. Manual control allows operators to directly manipulate the reactor. Various intermediate modes bridge these extremes. In typical pressurized water reactor operation, the reactor control system automatically maintains a floating average temperature, compensating for power demand changes through reactivity feedback loops alone. 
 
-Safety systems already employ extensive automation. Reactor Protection Systems trip automatically on safety signals with millisecond response times. Engineered safety features actuate automatically on accident signals—no operator action required. This division between automated and human-controlled functions reveals the fundamental challenge of hybrid control. Highly automated systems already handle reactor protection—automatic trips on safety parameters, emergency core cooling actuation, containment isolation, and basic process control~\cite{WRPS.Description, gentillon_westinghouse_1999}. Human operators retain control of strategic decision-making: power level changes, startup/shutdown sequences, mode transitions, and procedure implementation. This hybrid structure—discrete human decisions combined with continuous automated control—forms the basis for autonomous hybrid control systems.
+Safety systems already employ extensive automation. Reactor Protection Systems trip automatically on safety signals with millisecond response times. Engineered safety features actuate automatically on accident signals—no operator action required. This division between automated and human-controlled functions reveals the fundamental challenge of hybrid control. 
+
+Highly automated systems already handle reactor protection: automatic trips on safety parameters, emergency core cooling actuation, containment isolation, and basic process control~\cite{WRPS.Description, gentillon_westinghouse_1999}. Human operators retain control of strategic decision-making—power level changes, startup/shutdown sequences, mode transitions, and procedure implementation. This hybrid structure forms the basis for autonomous hybrid control systems. It combines discrete human decisions with continuous automated control.
 
 \subsection{Human Factors in Nuclear Accidents}
 
-Procedures lack formal verification despite rigorous development. This represents only half the reliability challenge. Even perfect procedures cannot guarantee safe operation when executed imperfectly.
+The previous subsection established that procedures lack formal verification despite rigorous development. This represents only half the reliability challenge. Even perfect procedures cannot guarantee safe operation when executed imperfectly.
 
-Human operators—the second pillar of current practice—introduce reliability limitations independent of procedure quality. Procedures define what to do; operators determine when and how to act. This discretion introduces persistent failure modes that training cannot eliminate.
+Human operators—the second pillar of current practice—introduce reliability limitations independent of procedure quality. Procedures define what to do. Operators determine when and how to act. This discretion introduces persistent failure modes that training cannot eliminate.
 
 Current-generation nuclear power plants employ over 3,600 active NRC-licensed
 reactor operators in the United States~\cite{operator_statistics}. These
@@ -62,11 +63,11 @@ limitations are fundamental to human-driven control, not remediable defects.
 
 \subsection{Formal Methods}
 
-The previous subsections established two fundamental limitations: procedures lack formal verification, and human operators introduce persistent reliability issues that training cannot eliminate. Both represent fundamental constraints—not remediable defects.
+The previous subsections established two fundamental limitations. First, procedures lack formal verification. Second, human operators introduce persistent reliability issues that training cannot eliminate. Both represent fundamental constraints—not remediable defects.
 
 Formal methods could eliminate these limitations by providing mathematical guarantees of correctness. Yet even the most advanced formal methods applications in nuclear control leave a critical verification gap.
 
-This subsection examines two approaches illustrating this gap. HARDENS verified discrete logic without continuous dynamics. Differential dynamic logic handles hybrid verification only post-hoc. Each demonstrates the current state of formal methods while revealing the verification gap this research addresses.
+This subsection examines two approaches illustrating this gap. HARDENS verified discrete logic without continuous dynamics. Differential dynamic logic handles hybrid verification only post-hoc. Each demonstrates the current state of formal methods. Each reveals the verification gap this research addresses.
 
 \subsubsection{HARDENS: Formal Methods in Nuclear Control}
 
@@ -74,7 +75,7 @@ The High Assurance Rigorous Digital Engineering for Nuclear Safety (HARDENS)
 project represents the most advanced application of formal methods to nuclear
 reactor control systems to date~\cite{Kiniry2024}.
 
-HARDENS addressed a fundamental dilemma: existing U.S. nuclear control rooms rely on analog technologies from the 1950s--60s. These technologies incur significant risk and cost compared to modern control systems. The NRC contracted Galois, a formal methods firm, to demonstrate that Model-Based Systems Engineering and formal methods could design, verify, and implement a complex protection system meeting regulatory criteria at a fraction of typical cost. The project delivered a Reactor Trip System (RTS) implementation with full traceability from NRC Request for Proposals and IEEE standards through formal architecture specifications to verified software.
+HARDENS addressed a fundamental dilemma: existing U.S. nuclear control rooms rely on analog technologies from the 1950s--60s. These technologies incur significant risk and cost compared to modern control systems. The NRC contracted Galois, a formal methods firm, to demonstrate that Model-Based Systems Engineering and formal methods could design, verify, and implement a complex protection system meeting regulatory criteria at a fraction of typical cost. The project delivered a Reactor Trip System (RTS) implementation with full traceability. This traceability spans from NRC Request for Proposals and IEEE standards through formal architecture specifications to verified software.
 
 HARDENS employed formal methods tools and techniques across the verification
 hierarchy. High-level specifications used Lando, SysMLv2, and FRET (NASA Formal
@@ -163,6 +164,6 @@ This section addressed two Heilmeier questions: What has been done? What are the
 
 \textbf{What are the limits of current practice?} A clear verification gap emerges. No existing methodology synthesizes provably correct hybrid controllers from operational procedures with verification integrated into design. Current approaches verify discrete logic or continuous dynamics—never both compositionally. Training improvements cannot overcome human reliability limits. Post-hoc verification cannot scale to system design.
 
-The verification gap is clear: no existing methodology synthesizes provably correct hybrid controllers from operational procedures. Economic pressures demand autonomous control. Technical maturity now enables it. 
+The verification gap is clear. No existing methodology synthesizes provably correct hybrid controllers from operational procedures. Economic pressures demand autonomous control. Technical maturity now enables it. 
 
-Section 3 addresses the next two Heilmeier questions: what is new and why it will succeed. It presents the technical approach that closes this gap.
+Section 3 addresses the next two Heilmeier questions. What is new? Why will it succeed? It presents the technical approach that closes this gap.

3-research-approach/v3.tex

@@ -4,9 +4,9 @@
 
 This section presents the complete technical approach for synthesizing provably correct hybrid controllers from operating procedures. 
 
-\textbf{What is new:} Three innovations enable compositional verification bridging discrete synthesis with continuous control: contract-based decomposition, mode classification, and procedure-driven structure. 
+\textbf{What is new:} Three innovations enable compositional verification. They bridge discrete synthesis with continuous control: contract-based decomposition, mode classification, and procedure-driven structure. 
 
-\textbf{Why it will succeed:} The approach leverages existing procedural structure, bounds computational complexity through mode-level verification, and validates against real industrial hardware through Emerson collaboration.
+\textbf{Why it will succeed:} The approach leverages existing procedural structure. It bounds computational complexity through mode-level verification. It validates against real industrial hardware through Emerson collaboration.
 
 % ============================================================================
 % STRUCTURE (maps to Thesis.RA tasks):
@@ -25,7 +25,7 @@ This section presents the complete technical approach for synthesizing provably
 % ----------------------------------------------------------------------------
 Previous approaches verified either discrete switching logic or continuous control behavior—never both simultaneously. Engineers validate continuous controllers through extensive simulation trials. They test discrete switching logic through simulated control room testing and human factors research. Neither method provides rigorous guarantees. Both consume enormous resources.
 
-This approach bridges that gap. It composes formal methods from computer science with control-theoretic verification, formalizing reactor operations as hybrid automata.
+This approach bridges that gap. It composes formal methods with control-theoretic verification. It formalizes reactor operations as hybrid automata.
 
 Hybrid system verification faces a fundamental challenge: discrete transitions change the governing vector field, creating discontinuities that traditional verification techniques cannot handle directly.
 
@@ -63,18 +63,18 @@ A HAHACS requires this tuple together with proof artifacts demonstrating that th
 Three innovations enable compositional verification:
 
 \begin{enumerate}
-\item \textbf{Contract-based decomposition:} Discrete synthesis defines entry/exit/safety contracts that bound continuous verification, transforming an intractable global problem into tractable local problems. This replaces traditional global hybrid system verification.
+\item \textbf{Contract-based decomposition:} Discrete synthesis defines entry/exit/safety contracts that bound continuous verification. This transforms an intractable global problem into tractable local problems. It replaces traditional global hybrid system verification.
-\item \textbf{Mode classification:} Continuous modes classify by control objective—transitory, stabilizing, or expulsory. This classification matches appropriate verification tools to each mode type, enabling mode-local analysis with provable composition guarantees.
+\item \textbf{Mode classification:} Continuous modes classify by control objective—transitory, stabilizing, or expulsory. This classification matches appropriate verification tools to each mode type. It enables mode-local analysis with provable composition guarantees.
-\item \textbf{Procedure-driven structure:} Nuclear procedures already decompose operations into discrete phases with explicit transition criteria. This existing structure avoids artificial abstractions, making the approach tractable for complex systems like nuclear reactor startup.
+\item \textbf{Procedure-driven structure:} Nuclear procedures already decompose operations into discrete phases with explicit transition criteria. This existing structure avoids artificial abstractions. It makes the approach tractable for complex systems like nuclear reactor startup.
 \end{enumerate}
 
 \textbf{Why will it succeed?} Three factors ensure practical feasibility.
 
-First, \textit{existing structure}: Nuclear procedures already decompose operations into discrete phases with explicit transition criteria. The approach formalizes this existing structure without imposing artificial abstractions. Domain experts can adopt the methodology without formal methods training.
+First, \textit{existing structure}: Nuclear procedures already decompose operations into discrete phases with explicit transition criteria. The approach formalizes this existing structure. It avoids imposing artificial abstractions. Domain experts can adopt the methodology without formal methods training.
 
-Second, \textit{bounded complexity}: Mode-level verification checks each mode against local contracts, avoiding global hybrid system analysis. This decomposition bounds computational complexity. It transforms an intractable global problem into tractable local verifications.
+Second, \textit{bounded complexity}: Mode-level verification checks each mode against local contracts. This avoids global hybrid system analysis. The decomposition bounds computational complexity. It transforms an intractable global problem into tractable local verifications.
 
-Third, \textit{industrial validation}: The Emerson collaboration provides domain expertise to validate procedure formalization. It provides industrial hardware to demonstrate implementation feasibility. This ensures solutions address real deployment constraints, not just theoretical correctness.
+Third, \textit{industrial validation}: The Emerson collaboration provides domain expertise to validate procedure formalization. It provides industrial hardware to demonstrate implementation feasibility. This ensures solutions address real deployment constraints—not just theoretical correctness.
 
 These factors combine to demonstrate feasibility on production control systems with realistic reactor models—not merely in principle. Figure~\ref{fig:hybrid_automaton} illustrates the hybrid structure for a simplified reactor startup sequence.
 
@@ -142,9 +142,9 @@ These factors combine to demonstrate feasibility on production control systems w
 
 \subsection{System Requirements, Specifications, and Discrete Controllers}
 
-The previous subsection established the hybrid automaton formalism—a mathematical framework describing discrete modes, continuous dynamics, guards, and invariants. This formalism provides the mathematical structure for hybrid control. But a critical question remains: where do these formal descriptions originate?
+The previous subsection established the hybrid automaton formalism. This mathematical framework describes discrete modes, continuous dynamics, guards, and invariants. It provides the mathematical structure for hybrid control. But a critical question remains: where do these formal descriptions originate?
 
-The answer lies in existing practice. Nuclear operations already possess a natural hybrid structure that maps directly to this formalism through three control scopes: strategic, operational, and tactical. This approach constructs formal hybrid systems from existing operational knowledge. It leverages decades of domain expertise already encoded in operating procedures rather than imposing artificial abstractions.
+The answer lies in existing practice. Nuclear operations already possess a natural hybrid structure. This structure maps directly to the formalism through three control scopes: strategic, operational, and tactical. The approach constructs formal hybrid systems from existing operational knowledge. It leverages decades of domain expertise already encoded in operating procedures. It avoids imposing artificial abstractions.
 
 Human control of nuclear power divides into three scopes: strategic, operational, and tactical. Strategic control represents high-level, long-term decision making spanning months or years: managing labor needs and supply chains to optimize scheduled maintenance and downtime.
 
@@ -190,7 +190,7 @@ This structure reveals why the operational and tactical levels fundamentally for
 \end{figure}
 
 
-This operational control level explains why nuclear control requires human operators: the hybrid nature of this control system makes proving controller performance against strategic requirements difficult, and no unified infrastructure exists for building and verifying hybrid systems. Humans fill this layer because their general intelligence provides a safe way to manage the system's hybrid nature by following prescriptive operating manuals, where strict procedures govern what control to implement at any given time.
+This operational control level explains why nuclear control requires human operators. The hybrid nature makes proving controller performance against strategic requirements difficult. No unified infrastructure exists for building and verifying hybrid systems. Humans fill this layer because their general intelligence provides a safe way to manage the system's hybrid nature. They follow prescriptive operating manuals where strict procedures govern what control to implement at any given time.
 
 These procedures provide the key to HAHACS construction, which leverages two observations about current practice. First, operational scope control is effectively discrete control. Second, operating procedures describe implementation rules before construction begins, meaning a HAHACS's intended behavior can be completely specified before implementation. Requirements define the behavior of any control system: statements about what
 the system must do, must not do, and under what conditions. For nuclear systems,
@@ -260,14 +260,14 @@ FRET has been successfully applied to spacecraft control systems, autonomous veh
 
 \subsection{Discrete Controller Synthesis}
 
-The previous subsection demonstrated how operating procedures translate into temporal logic specifications using FRET. These specifications define what the system must do—but a critical gap remains: how do we implement those requirements?
+The previous subsection demonstrated how operating procedures translate into temporal logic specifications using FRET. These specifications define what the system must do. But a critical gap remains: how do we implement those requirements?
 
-Reactive synthesis bridges this gap by automatically constructing controllers guaranteed to satisfy temporal logic specifications. It automates the creation of reactive programs from temporal logic—programs that take input for a given state and produce output. The current discrete state and guard condition status form the input; the next discrete state forms the output.
+Reactive synthesis bridges this gap. It automatically constructs controllers guaranteed to satisfy temporal logic specifications. It automates the creation of reactive programs from temporal logic—programs that take input for a given state and produce output. The current discrete state and guard condition status form the input. The next discrete state forms the output.
 
 Reactive synthesis solves a fundamental problem: given an LTL formula $\varphi$ specifying desired system behavior, automatically construct a finite-state machine (strategy) that produces outputs in response to environment inputs such that all resulting execution traces satisfy $\varphi$. If such a strategy exists, the specification is \emph{realizable}. The synthesis algorithm either produces a correct-by-construction controller or reports that no such controller exists. Unrealizable specifications indicate conflicting or impossible requirements in
 the original procedures—this realizability check catches errors before implementation. 
 
-Reactive synthesis offers a decisive advantage: the discrete automaton is correct by construction and requires no human engineering of its implementation. This eliminates human error at the implementation stage entirely, allowing designers to focus on specifying system behavior rather than implementing switching logic.
+Reactive synthesis offers a decisive advantage. The discrete automaton is correct by construction. It requires no human engineering of its implementation. This eliminates human error at the implementation stage entirely. Designers focus on specifying system behavior rather than implementing switching logic.
 
 This shift carries two critical implications. First, complete traceability: the controller changes between modes for reasons that trace back through specifications to requirements. This establishes clear liability and justification for system behavior. Second, deterministic guarantees replace probabilistic human judgment. Human operators cannot eliminate error from discrete control decisions. Humans are intrinsically fallible. Temporal logics define system behavior. Deterministic algorithms synthesize the controller. Strategic decisions follow operating procedures exactly—no exceptions, no deviations, no human factors.
 
@@ -289,9 +289,9 @@ Reactive synthesis produces discrete mode-switching logic from procedures. This
 
 \subsection{Continuous Control Modes}
 
-Reactive synthesis produces a provably correct discrete controller that determines when to switch between modes. However, hybrid control requires more than correct mode switching—the continuous dynamics executing within each discrete mode must also verify against requirements.
+Reactive synthesis produces a provably correct discrete controller. This controller determines when to switch between modes. However, hybrid control requires more than correct mode switching. The continuous dynamics executing within each discrete mode must also verify against requirements.
 
-Control objectives determine the verification approach. Modes classify into three types—transitory, stabilizing, and expulsory—each requiring different verification tools matched to its distinct purpose. This subsection describes each type and its verification method. 
+Control objectives determine the verification approach. Modes classify into three types—transitory, stabilizing, and expulsory. Each requires different verification tools matched to its distinct purpose. This subsection describes each type and its verification method. 
 
 This methodology's scope requires clarification. This work verifies continuous controllers but does not synthesize them. The distinction parallels model checking in software verification. Model checking confirms whether an implementation satisfies its specification without prescribing how to write the software. Engineers design continuous controllers using standard control theory techniques. This work assumes that capability exists. The contribution lies in the verification framework. It confirms that candidate controllers compose correctly with the discrete layer to produce a safe hybrid system.
 
@@ -525,7 +525,7 @@ outcomes can best align with customer needs.
 
 This section addressed two critical Heilmeier questions: What is new? Why will it succeed?
 
-\textbf{What is new?} Three innovations enable compositional verification by integrating reactive synthesis, reachability analysis, and barrier certificates. 
+\textbf{What is new?} Three innovations enable compositional verification. They integrate reactive synthesis, reachability analysis, and barrier certificates. 
 
 First, \textit{contract-based decomposition} inverts traditional global analysis. Discrete synthesis defines verification contracts that bound continuous verification. 
 
@@ -547,7 +547,7 @@ The complete technical methodology is now established.
 
 Sections 2 and 3 addressed the first four Heilmeier questions. Section 2 established what has been done and what limits current practice. Section 3 explained what is new and why it will succeed. 
 
-Three questions remain. How will success be measured? What could prevent success? Who cares, and what difference will this work make? 
+Three questions remain. How will success be measured? What could prevent success? Who cares? What difference will this work make? 
 
 Section 4 addresses metrics for success. Section 5 identifies what could prevent success. Section 6 explains who cares and what difference this work will make.
 

4-metrics-of-success/v1.tex

@@ -95,8 +95,8 @@ TRL 4 demonstrates system-level integration in simulation. Components compose co
 
 TRL 5 validates hardware implementation in a relevant environment. The complete system operates on industrial control hardware.
 
-Achieving TRL 5 proves the methodology produces verified controllers implementable with current technology. The result is not merely theoretically sound but practically deployable.
+Achieving TRL 5 proves the methodology produces verified controllers implementable with current technology. The result is not merely theoretically sound—it is practically deployable.
 
 Sections 2 through 4 addressed five Heilmeier questions. Section 2 established what has been done and what limits current practice. Section 3 explained what is new and why it will succeed. This section defined how to measure success.
 
-Success assumes critical technical challenges can be overcome. Section 5 addresses what could prevent success. It explains how to respond when assumptions fail.
+But success assumes critical technical challenges can be overcome. Section 5 addresses what could prevent success. It explains how to respond when assumptions fail.

5-risks-and-contingencies/v1.tex

@@ -135,14 +135,14 @@ This section answered the Heilmeier question: What could prevent success?
 
 \textbf{Answer:} Three primary risks threaten TRL 5 achievement: computational tractability of synthesis and verification, complexity of the discrete-continuous interface, and completeness of procedure formalization.
 
-Each risk has identifiable early warning indicators enabling detection before failure becomes inevitable. Each has viable mitigation strategies preserving research value even when core assumptions fail.
+Each risk has identifiable early warning indicators. These enable detection before failure becomes inevitable. Each has viable mitigation strategies preserving research value even when core assumptions fail.
 
-The staged project structure ensures partial success yields publishable results identifying remaining deployment barriers. This design maintains contribution regardless of which technical obstacles prove insurmountable. Even failure advances the field by documenting precisely which barriers remain.
+The staged project structure ensures partial success yields publishable results. These results identify remaining deployment barriers. This design maintains contribution regardless of which technical obstacles prove insurmountable. Even failure advances the field by documenting precisely which barriers remain.
 
 Sections 2 through 5 established the complete technical research plan. 
 
-Section 2 addressed what has been done and what limits current practice, establishing the verification gap. Section 3 explained what is new and why it will succeed, presenting three innovations that enable compositional verification. Section 4 defined how to measure success through TRL advancement. This section identified what could prevent success and how to respond when assumptions fail.
+Section 2 addressed what has been done and what limits current practice. It established the verification gap. Section 3 explained what is new and why it will succeed. It presented three innovations enabling compositional verification. Section 4 defined how to measure success through TRL advancement. This section identified what could prevent success. It explained how to respond when assumptions fail.
 
 One critical question remains: Who cares? Why now? What difference will it make?
 
-Section 6 connects this technical methodology to urgent economic and societal challenges, demonstrating why this work matters now.
+Section 6 connects this technical methodology to urgent economic and societal challenges. It demonstrates why this work matters now.

6-broader-impacts/v1.tex

@@ -8,7 +8,7 @@ This section addresses the remaining Heilmeier questions. It connects technical
 
 \textbf{Who cares?} Three stakeholder groups face the same economic constraint: high operating costs driven by staffing requirements. The nuclear industry faces uncompetitive per-megawatt costs for small modular reactors. Datacenter operators need hundreds of megawatts of continuous clean power for AI infrastructure. Clean energy advocates need nuclear power to compete economically with fossil alternatives. All three require autonomous control with safety guarantees.
 
-\textbf{What difference will it make?} This research directly addresses a \$21--28 billion annual cost barrier. It enables economically viable small modular reactors for datacenter power. It establishes a generalizable framework for safety-critical autonomous systems across critical infrastructure.
+\textbf{What difference will it make?} This research addresses a \$21--28 billion annual cost barrier. It enables economically viable small modular reactors for datacenter power. It establishes a generalizable framework for safety-critical autonomous systems across critical infrastructure.
 
 \textbf{Why now?} Exponentially growing AI infrastructure demands have transformed this longstanding challenge into an immediate crisis. A market now demands solutions that did not exist before.
 
@@ -63,16 +63,16 @@ adoption across critical infrastructure.
 
 This section answered three critical Heilmeier questions:
 
-\textbf{Who cares?} Three stakeholder groups face the same constraint: the nuclear industry faces an economic crisis for small modular reactors due to per-megawatt staffing costs; datacenter operators need hundreds of megawatts of continuous clean power for AI infrastructure; clean energy advocates need nuclear power to be economically competitive. All three require autonomous control with safety guarantees.
+\textbf{Who cares?} Three stakeholder groups face the same constraint. The nuclear industry faces an economic crisis for small modular reactors due to per-megawatt staffing costs. Datacenter operators need hundreds of megawatts of continuous clean power for AI infrastructure. Clean energy advocates need nuclear power to be economically competitive. All three require autonomous control with safety guarantees.
 
-\textbf{Why now?} Two forces converge to create urgency. \textit{First: exponentially growing demand.} AI infrastructure creates immediate need for economical nuclear power at datacenter scale. Projections show datacenter electricity demand reaching 1,050 terawatt-hours annually by 2030. \textit{Second: technical maturity.} Formal methods tools have matured sufficiently to make compositional hybrid verification computationally achievable. What was theoretically possible but practically intractable a decade ago is now feasible. The problem is urgent and the tools exist.
+\textbf{Why now?} Two forces converge to create urgency. \textit{First: exponentially growing demand.} AI infrastructure creates immediate need for economical nuclear power at datacenter scale. Projections show datacenter electricity demand reaching 1,050 terawatt-hours annually by 2030. \textit{Second: technical maturity.} Formal methods tools have matured sufficiently to make compositional hybrid verification computationally achievable. What was theoretically possible but practically intractable a decade ago is now feasible. The problem is urgent. The tools exist.
 
-\textbf{What difference will it make?} This research addresses a \$21--28 billion annual cost barrier and enables autonomous control with mathematical safety guarantees. Beyond immediate economic impact, the methodology establishes a generalizable framework for safety-critical autonomous systems across critical infrastructure, extending beyond nuclear power to any safety-critical system requiring provable correctness.
+\textbf{What difference will it make?} This research addresses a \$21--28 billion annual cost barrier. It enables autonomous control with mathematical safety guarantees. Beyond immediate economic impact, the methodology establishes a generalizable framework for safety-critical autonomous systems across critical infrastructure. It extends beyond nuclear power to any safety-critical system requiring provable correctness.
 
 Sections 2 through 6 addressed all but one of the Heilmeier questions. 
 
-Section 2 established what has been done and what limits current practice, identifying the verification gap. Section 3 explained what is new and why it will succeed, presenting three innovations enabling compositional verification. Section 4 defined how to measure success through TRL advancement from 3 to 5. Section 5 identified what could prevent success and provided contingencies. This section connected technical methodology to economic and societal impact.
+Section 2 established what has been done and what limits current practice. It identified the verification gap. Section 3 explained what is new and why it will succeed. It presented three innovations enabling compositional verification. Section 4 defined how to measure success through TRL advancement from 3 to 5. Section 5 identified what could prevent success and provided contingencies. This section connected technical methodology to economic and societal impact.
 
 One final Heilmeier question remains: How long will it take? 
 
-Section 8 provides the answer, presenting a detailed schedule with milestones and deliverables.
+Section 8 provides the answer. It presents a detailed schedule with milestones and deliverables.