Confidence Scoring Across the Twin
Every quantity the twin reports carries a confidence score, and control behavior is tied to that score so the machine is driven cautiously when the twin is unsure.
Confidence as a first-class output
The twin never reports a value without a confidence. That confidence integrates several sources: the state estimator's uncertainty, the surrogates' predictive uncertainty, the observability given how many channels were imputed, the physics-residual health of the reconstruction, and the model's drift status. The result is a per-quantity, calibrated confidence that travels with the twin state vector.
- Estimator uncertainty: ensemble spread on the estimated state
- Surrogate UQ: epistemic + aleatoric from the twin models
- Observability: how much depended on GNN-imputed vs measured signals
- Residual health: equilibrium and coupling residuals as self-diagnostics
- Drift status: how recently the model was validated in this regime
Wired into control
Confidence is not a display feature; it changes behavior. Low confidence shrinks the MPC safe-operating envelope, inflates the estimator's process noise, scales the anomaly ensemble's residual tests, and can gate whether a maneuver is permitted at all. The machine is driven more conservatively exactly when the twin knows less, which is the central safety property Kronos designs the twin around.
This ties the whole L3 stack together: GNN imputation honesty, PINN residual self-diagnosis, surrogate UQ, estimator spread, and drift monitoring all feed one number that governs how much the controller is allowed to lean on the twin. An over-confident score would defeat every other safeguard, so confidence calibration is a gated V&V criterion.
Beneath all of it, the L1 hardware failsafe is independent of confidence, it protects the machine regardless. Confidence scoring governs how boldly L3 pursues performance; it never governs whether the machine is safe, that floor is guaranteed in hardware.