Model-Predictive Control: The Optimization

Kronos's MPC agents plan actuation by solving a constrained optimization over the twin's predicted trajectory at every control cycle.

The receding-horizon problem

Model-predictive control chooses actuation by looking ahead. At each cycle it uses the twin's predictive model to forecast how the plant will respond to a candidate sequence of actuator moves over a horizon N, scores that forecast against objectives and constraints, applies only the first move, then re-plans next cycle. The core optimization is:

# MPC optimal control problem, solved every control cycle
minimize over u_0..u_{N-1}:
    J = sum_{k=0}^{N-1} [ (x_k - x_ref)^T Q (x_k - x_ref)
                          + u_k^T R u_k
                          + du_k^T S du_k ]          # move suppression
        + (x_N - x_ref)^T P (x_N - x_ref)             # terminal cost
subject to:
    x_{k+1} = f_twin(x_k, u_k)         # twin dynamics (surrogate)
    x_k in X_safe                        # state constraints (envelope)
    u_k in U,  du_k in dU               # actuator limits and slew rates
    x_N in X_terminal                    # terminal safe set

Q, R, S and P weight state error, actuator effort, move rate and terminal error. The dynamics f_twin come from KRONOS-CTRL's surrogates, so the forecast is physics-grounded but fast enough to solve inside the cycle. The state constraint set X_safe is the certified safe operating envelope, and it is what makes MPC the natural controller for a machine that must never leave that envelope.

Why MPC over simple feedback

MPC handles multi-input multi-output coupling and hard constraints natively. The breeder's shape depends on many coils at once; the burner's confinement couples plug fueling, heating and DEC potential. A PID loop cannot respect a stability-margin constraint the way MPC can encode X_safe directly. And because MPC plans over a horizon, it acts before a constraint is violated rather than reacting after.

MPC is advisory to L1: it produces actuation intents that L1 executes deterministically, and it operates in the millisecond regime above the microsecond hard-real-time path and the hardware failsafe.