Verification and Validation of the Twin

Every L3 model passes a verification-and-validation gate, against reference solvers and real data, before it is allowed to inform control.

Verification vs validation

Kronos separates two questions. Verification asks whether the model solves the equations it claims to, checked against reference numerical solvers and analytic cases. Validation asks whether those equations represent the real machine, checked against experimental and (post-FOAK) plant data. A model must pass both; a beautifully verified PINN of the wrong physics is still wrong, and a model tuned to data without solving the physics will not generalize.

The V&V gate

• Verify: residuals and derived quantities vs FEM/Monte Carlo/eigenvalue references
• Validate: agreement with legacy-device data and, from ~2030, FOAK telemetry
• Calibrate: predictive uncertainty checked and adjusted to be honest
• Extrapolate: graceful degradation and confidence drop outside the training envelope
• Version: lineage recorded; only gated models reach the control path

The gate is a hard boundary in the architecture: no surrogate, PINN, GNN, anomaly detector, or MPC model reaches the control-relevant twin state without passing it, and any retrained version must re-pass. This is what lets Kronos treat L3 outputs as evidence rather than suggestions, and it is the same discipline that governs the L2 lineage the twin state inherits.

Independence and traceability

Validation references are independent of the surrogate being tested, offline first-principles solvers and archived measurements, so a model cannot be validated against itself. Every gated model carries a lineage tag to its training data, reference set, and metrics, so any control decision can be traced back through the twin to the evidence that qualified the models behind it.

Pre-FOAK, validation leans on simulation and legacy data by necessity; the machines are design/simulation studies and no hardware net-gain is claimed. The V&V framework is explicitly built to strengthen as real data arrives, tightening the validation half of the gate once FOAK operates, rather than assuming today's simulation-based confidence is final.