Applications

Control-System Verification

Proving that control and protection software behaves correctly across all conditions, including the rare ones that matter most.

Why verification is hard

A control system must do the right thing not just in normal operation but in every corner case: sensor failures, unexpected sequences, timing edge cases. Testing can only cover the cases you think to try, and the dangerous ones are often the ones nobody imagined. Verification aims for stronger assurance than testing alone, especially for the protection functions that must never fail.

Levels of assurance

Kronos motion — reaching conditions

Testing: run chosen scenarios and check outputs; necessary but incomplete
Simulation-based testing: run against a plant model, including fault injection
Model checking: exhaustively explore all states of a finite model
Formal verification: mathematically prove properties hold for all inputs

The gap testing leaves

Testing shows the presence of correct behavior on the cases tried, never its absence on the cases skipped. For safety-critical protection, that gap matters. Formal methods close part of it by proving properties, for example 'the interlock always trips within the required time when the limit is exceeded', over all possible inputs rather than a sample. The cost is that formal methods are demanding and apply best to well-bounded logic.

python

def check_invariant(model, invariant):
    # exhaustively explore reachable states of a finite model
    seen, frontier = set(), [model.initial()]
    while frontier:
        s = frontier.pop()
        if not invariant(s):
            return ('violated', s)     # counterexample
        for s2 in model.successors(s):
            if s2 not in seen:
                seen.add(s2); frontier.append(s2)
    return ('holds', None)

The layered principle

Consistent with control-room design, safety-critical protection is kept simple enough to verify and separate from complex optimization software. A small, verifiable interlock beneath a sophisticated but non-safety controller is easier to trust than a single complex system doing both.

Kronos framing

For the Hyperion breeder, control and protection logic is verified against the digital twin and, where the logic is bounded, with formal methods, before operation. Construction begins in the second quarter of 2027, so this verification runs during design when it is cheapest to fix what it finds.