Terminal Sets and Recursive Feasibility

The theory that lets Kronos trust MPC over a finite horizon to keep the machine safe indefinitely: a terminal safe set and a terminal cost.

The finite-horizon gap

MPC plans only N steps ahead, yet the machine runs indefinitely. Without care, a plan that looks fine over the horizon could steer the machine into a corner from which no safe continuation exists. The standard remedy, adopted by Kronos, is a terminal constraint: require the horizon to end in a terminal safe set X_terminal from which a known safe policy can keep the machine safe forever.

Why it guarantees safety

If every MPC plan ends inside X_terminal, and inside X_terminal a fallback controller is known to keep the state safe, then the receding-horizon scheme is recursively feasible: a safe plan existing this cycle guarantees a safe plan exists next cycle (shift the plan and append the fallback move). The terminal cost P approximates the cost-to-go of that fallback policy, so optimizing over the finite horizon behaves like optimizing over the infinite one. This is what converts a horizon-limited optimizer into a controller with an indefinite safety guarantee.

# terminal ingredients
#   X_terminal : invariant safe set (fallback policy keeps state inside)
#   P          : terminal cost ~ cost-to-go of fallback policy
# recursive feasibility: feasible now => feasible next cycle
#   plan_next = shift(plan_now) + fallback_move   # always feasible

For the breeder, X_terminal corresponds to a stable, well inside the envelope, low-stress equilibrium the machine can be held in; for the burner, a plug-density and potential state with comfortable confinement and mirror-stability margins. The fallback policy is a simple, certified controller, not another learned model, so the safety guarantee does not rest on a neural network behaving well.

This layering, learned surrogates and optimization for performance, a certified fallback and terminal set for the safety floor, is the same philosophy as the L1 hardware failsafe: performance may lean on AI, but the safety guarantee never depends on it alone.