SYSE.10:5 - Worked Case: Evidence for a Heat-Pump Controller Increment

A heat-pump project is deciding whether to integrate a first controller increment that coordinates compressor modulation with thermal storage. The claim is:

For the named controller, sensor, and plant configurations, the controller keeps supply-water temperature within the declared comfort envelope and avoids harmful compressor cycling in selected low-ambient and tariff-response situations inside the qualified compressor-map region.

The project uses several unlike results:

Method and Work	Result used	Supported and unsupported use
analytic control reasoning	Stability and sampling claims for a linearized plant region.	Supports local stability under the stated approximation; does not cover nonlinear storage behavior, sensor faults, or installed performance.
Modelica simulation	Plant and controller traces over selected weather, load, and tariff situations.	Rejects several storage-dispatch candidates and supports one timing range; does not provide observed physical performance or cover unmodeled installation effects.
software-in-the-loop checks	Repeatable results for controller logic, state transitions, and selected properties.	Supports correspondence for the tested software edition; does not establish hardware timing, sensor behavior, actuator response, or building benefit.
controller-in-the-loop trial	Measurements from controller hardware, sensor emulation, inverter interface, and selected fault injections.	Supports timing, I/O, fallback, and selected cycling claims for the bench configuration; does not establish installed hydraulic, acoustic, or occupant effects.
installed-plant trial	Calibrated temperature, power, state, and fault observations during a bounded low-ambient interval.	Supports the first increment inside the observed and modeled envelope; does not establish seasonal reliability, another compressor variant, or every tariff policy.
independent criticism	Compressor-map and maintenance-access checks by relevant specialists.	Exposes an out-of-envelope map region and an inaccessible recovery action; neither result alone decides release.

The simulation initially appears to support the timing claim, but the model assumes two sensor updates per second while the selected installed configuration supplies one update every two seconds after filtering. The project does not reuse that simulation for the installed timing claim. It updates the model account, changes the estimator, repeats the controller-in-the-loop trial, and narrows the first increment’s operating envelope.

An AI Agent produces fault scenarios and a trace summary. One scenario invents an interface state absent from the source configuration. The summary is useful for finding source traces, but the project relies only on claims connected to those traces, the actual configuration, and checking Work. The AI Agent’s confidence score is not validation, assurance, acceptance, or release.

The assessment supports integration inside the stated plant, sensor, compressor-map, charge-state, and environment envelope; rejects reliance on the old timing simulation; and leaves seasonal cycling, the high-storage-charge region, and another compressor variant unresolved. The architecture decision uses this assessment, while SYSE.4 separately determines the assurance result and any permission needed before commissioning. Later operating observations reopen only the claims and choices that relied on the changed envelope.