Counterfactual Safe Thermal Control

Status: research direction derived from CFLight, not an implemented thermal-control system.

Core intuition: rare unsafe thermal episodes are most valuable as branch points. Rewind a calibrated digital twin to the warning state, replay alternative control-input plans under the same disturbances, reject unsafe or uncertain branches, and optimize efficiency only inside the remaining safe set.

Recoverability extension: Counterfactual PoNR Auditing suggests labeling the last snapshot from which an admissible emergency protocol can still preserve constraints. This separates current thermal safety from remaining recovery options and turns the feasible-but-irrecoverable interval into a direct target for offline audit and online monitor distillation.

Collaboration

If this direction resonates with you, I would be happy to discuss it, collaborate on research, or work on practical use cases.

Ideas are not the bottleneck. Hands are. Time-series modeling should be moving at least as fast as vision, audio, and robotics.

• Email: [email protected]
• X: @chemeris
• Telegram: @alexanderchemeris

Why This Is Useful

Unsafe thermal events are rare, delayed, and expensive to explore on physical equipment. Ordinary logs are dominated by normal operation; simply oversampling the violation timestamp misses the earlier control decisions and accumulated heat that caused it. CFLight suggests a better data-generation protocol: treat the violation as a trigger, return to a pre-event state, and compare alternative actions under shared context.

The research target is broad:

• HVAC and multi-zone building climate;
• heat pumps, boilers, furnaces, ovens, and industrial heaters;
• reactors and thermal-process control;
• batteries, electronics, GPUs, and data-center thermal management;
• district heating, thermal storage, and coupled energy networks;
• manufacturing processes where temperature profile affects product quality.

Canonical Mapping

Traffic-signal control	Thermal control
state before collision	multivariate thermal history and estimated latent heat state before violation
phase action	heater level, valve position, flow, compressor/fan/pump command, supply temperature, duty cycle, or setpoint plan
collision-risk outcome	temperature, pressure, ramp-rate, gradient, comfort, quality, or hardware-limit risk
delay / throughput	energy, price, peak power, time-to-target, comfort, process throughput, quality, and wear
exogenous noise	ambient conditions, occupancy, workload, feedstock, weather, demand, and uncertain parameters
alternative traffic transition	replayed/simulated thermal trajectory under an alternative control-input plan

Proposed Loop

flowchart LR
  O["sensors + event stream + context"] --> B["belief / latent thermal state"]
  V["violation or near-violation"] --> W["rewind to warning state"]
  B --> W
  W --> C["candidate control-input plans"]
  C --> T["calibrated digital twin / world model"]
  T --> Y["multi-horizon outcome distributions"]
  Y --> U["uncertainty and support gate"]
  U --> S["hard safety filter"]
  S --> P["Pareto set: energy, comfort, throughput, cost, wear"]
  P --> A["execute first control input"]
  A --> O

At time $t$, use history

$$h_t=(x_{t-L:t},u_{t-L:t-1},d_{t-L:t})$$

where $x$ is multivariate thermal/process state, $u$ is the control-input history, and $d$ is exogenous context. For a candidate plan $U_{t:t+H}$, predict a distribution over the future trajectory and outcomes:

$$p_{\theta }\left(x_{t+1:t+H},Y_{t+1:t+H}\mid h_t,U_{t:t+H},c_t\right).$$

The horizon $H$ must cover the relevant thermal delay. A one-step branch is insufficient when stored heat, transport delay, sensor lag, or phase change determines later risk.

Safety Before Optimization

Hard feasibility should be separate from preference optimization. Example chance constraints include

$$\mathrm{Pr}\left(\underset{1\le \tau \le H}{\max }{T}_{t+\tau }\le T_{max}\mid h_t,U_{t:t+H}\right)\ge 1-\delta .$$

Depending on the system, the safe set may also constrain:

• lower and upper temperature;
• pressure and flow;
• $|dT/dt|$ and spatial thermal gradients;
• cumulative time above a critical temperature;
• actuator saturation, dwell time, and switching frequency;
• emergency shutdown reachability;
• comfort, product-quality, or material-integrity bounds.

Only feasible plans should enter the Pareto ranking over energy, price, peak demand, time-to-target, comfort, throughput, quality, and equipment wear. This avoids hiding a hard safety violation inside one scalar reward weight.

Data Contract For Branches

Measured, simulator-generated, and learned branches must not be silently mixed. Each branch group should record:

branch_group_id
snapshot_id
decision_timestamp
warning_horizon
factual_control_plan
counterfactual_control_plan
shared_disturbance_seed
initial_belief_state
ambient_and_process_context
branch_source: measured | physical_simulator | learned_model
simulator_version
world_model_version
support_score
prediction_uncertainty
hard_constraints
multi_horizon_outcomes

All branches from one snapshot must remain in one dataset split. Otherwise nearly identical histories leak across train and test.

Recommended Development Stages

1. Simulator-grounded branching

Start with a validated physical simulator or digital twin, not a learned SCM. Save restorable states, detect violations or near misses, rewind by a physically meaningful warning horizon, and execute alternative plans with the same initial state, disturbance profile, uncertain-parameter sample, and random seed.

This gives direct branch labels and a calibration target for later learned models.

2. Action-conditioned latent dynamics

Train a probabilistic state-space or recurrent latent model to predict temperature, pressure, flow, energy, constraint violations, and uncertainty. A physics-plus-residual model is preferable when trusted equations exist. Ensembles or Bayesian approximations should expose epistemic uncertainty.

The evaluation must include paired action effects:

$$\Delta Y(a_{cf},a_f)=Y(a_{cf})-Y(a_f),$$

not just unconditional forecast error. A model can have good average RMSE and still rank safety-critical actions incorrectly.

3. Conservative learned branching

Use learned branches only after testing:

• multi-horizon calibration;
• false-negative rate for every hard violation;
• agreement with direct simulator branches;
• out-of-distribution detection across ambient/process regimes;
• sensitivity to sensor delay, missingness, actuator error, and parameter drift;
• uncertainty-aware abstention and fallback behavior.

4. Receding-horizon control

Generate discrete plan templates for the MVP, then move to constrained MPC or trajectory optimization for continuous controls. Execute only the first control input, observe the new state, and replan. Keep an independent safety controller or emergency fallback outside the learned planner.

Domain-Specific Adaptations

Domain	State/context	Candidate controls	Critical outcomes
HVAC / heat pump	zone temperatures, humidity, occupancy, weather, storage state	setpoints, compressor power, valves, fan/pump speeds	comfort, energy, peak power, cycling, freeze/overheat risk
Furnace / oven	internal/surface temperature, material state, gas/air flow	burner power, ramps, flow, dwell schedule	overshoot, gradient, product quality, throughput, emissions
Reactor / process	temperatures, pressure, concentration, flow, feedstock	heating/cooling, valves, agitation, feed rate	runaway, pressure, conversion, selectivity, safe shutdown
Battery / electronics	cell/component temperatures, current, workload, cooling state	charge/current limit, cooling, DVFS, workload placement	hot spots, thermal runaway, throttling, lifetime, performance
District heating	supply/return temperatures, storage, network demand, weather	generation, pumps, valves, storage dispatch	comfort, pressure/temperature bounds, peak demand, fuel cost

What Transfers Directly From CFLight

• unsafe-event-triggered branch generation;
• a common pre-event state for factual and alternative actions;
• targeted replay around rare safety boundaries;
• modular separation between alternative-outcome generation and downstream controller training;
• explicit evaluation of the safety–efficiency frontier.

What Requires A Digital Twin

• physically feasible future trajectories after changing a control input;
• preservation of latent stored heat and delayed effects;
• counterfactual labels where the physical system cannot be safely rewound;
• systematic rare-failure exploration;
• paired action-effect calibration.

What Is Speculative

• that CFLight’s BiCoGAN is the right thermal architecture;
• that one-step monotonic SCM inversion is valid under thermal partial observability;
• that generated branches are causally identified from observational logs;
• that reward shaping alone can guarantee safety;
• that simulation gains transfer to equipment without system identification and prospective validation.

Evaluation Protocol

A credible benchmark should report:

1. state and outcome RMSE/NLL over multiple horizons;
2. paired action-effect error and action-ranking accuracy;
3. violation false-negative rate and calibrated risk coverage;
4. performance under ambient, occupancy, workload, and parameter shift;
5. degradation under missing sensors, delay, saturation, and hysteresis;
6. realized safety, energy, cost, comfort/quality, throughput, and wear in closed loop;
7. simulator-call budget and world-model speedup;
8. direct-simulator, learned-model, MPC, rule-controller, and no-branch ablations;
9. emergency fallback usage and unsafe-abstention rate;
10. group-safe splits by physical episode/snapshot.

Relation To Foundation TSFM Agenda

This is an idea page, so the verdicts describe the intended contribution if the system is implemented and validated.

Agenda slot	Verdict	Evidence	Missing pieces
Native multivariate encoding	partially closes	Proposes joint numeric sensor, actuator, event, and context histories with latent thermal state.	Implemented encoder and high-channel/multi-zone benchmarks.
Control and counterfactuals	closes	Proposes common-state alternative control-plan trajectories, uncertainty gating, and receding-horizon action selection.	Digital-twin implementation, paired branch corpus, baselines, and closed-loop tests.
Causal structure	partially closes	Preserves shared initial state/disturbances and distinguishes direct simulator branches from learned predictions.	Identification assumptions, controlled interventions, hidden-state analysis, and prospective validation.
Benchmarks	partially closes	Specifies safety, paired-action, uncertainty, shift, and Pareto evaluation.	Public benchmark implementation and reproducible thermal environments.

Related Pages

• Counterfactual PoNR Auditing
• CFLight
• CityLearn
• Tennessee Eastman Process Simulation Data
• Action-Conditioned Time-Series Datasets
• Causal Time Series
• Kubernetes OTEL Control Gym