Uncertainty Quantification for Surrogates

A surrogate must know when it does not know; Kronos equips every twin surrogate with calibrated uncertainty so control stays cautious where the model is weak.

Why UQ is non-negotiable

A surrogate is an approximation, and a silent approximation is dangerous in a control loop. Kronos requires every twin surrogate to report calibrated predictive uncertainty, so downstream consumers, MPC, the estimator, the anomaly ensemble, can weight the prediction by how much to trust it. Uncertainty separates into two kinds Kronos tracks distinctly.

• Aleatoric: irreducible noise in the process/measurements, learned as a variance head
• Epistemic: model ignorance, high where training data was sparse or out-of-distribution
• Total: combined, propagated into the estimator and the MPC envelope

How Kronos estimates it

Epistemic uncertainty is estimated with ensembles of surrogates (disagreement grows away from training data) and, where cheaper, with evidential or dropout-based approximations. Aleatoric uncertainty is a learned variance output. The two combine into a total predictive uncertainty attached to every surrogate output and hence to every quantity in the twin state vector.

The consequence is concrete: when a surrogate is uncertain, the state estimator inflates the corresponding process noise, the MPC envelope tightens, and the anomaly ensemble scales its forecast-residual test. The controller becomes more conservative exactly where the physics model is least reliable, which is the correct behavior for a machine that must never be over-driven on a weak prediction.

Calibration is validated

Uncertainty is only useful if it is calibrated, if 90% intervals contain the truth 90% of the time. Kronos validates surrogate calibration on held-out data and recalibrates on drift. An over-confident surrogate is treated as a defect that fails the V&V gate, because over-confidence is precisely the failure that would let a wrong prediction drive an unsafe action.