TPT-FoundryOS

Autonomous ISRU chemical plant control: a safety-critical, fault-tolerant process control system for lunar regolith/ice-processing refineries.

FoundryOS replaces traditional SCADA with a Safety-by-Design architecture split into two domains:

• Safety Domain (no_std, formally-verified): hardware-level override authority. Runs on physically separate PLC hardware from the control domain and communicates only over EtherCAT frames.
• Control Domain (std): yield optimization, feed-forward thermal control, and a permanent digital-twin physics engine.

See ARCHITECTURE.md for the dependency graph and domain boundaries, and SAFETY.md for the proven-vs-tested-vs-assumed invariant summary.

Quickstart

Prerequisites

• Rust 1.81+ (MSRV). Install via rustup.
• Target (for no_std crates): rustup target add thumbv7em-none-eabihf
• Optional: cargo-deny, cargo-audit, cargo-semver-checks, cargo-fuzz for development tooling (see CONTRIBUTING.md for install steps).

Build and test

cargo build --workspace
cargo test  --workspace

Run the in-process supervisor (simulated hardware backend) end-to-end:

cargo run -p foundryos-supervisor

Or use the CLI with a configuration file:

cargo run -p foundryos-cli -- --config examples/plant.toml run

Hello world (zero-dependency safety check)

cargo run --example hello_safety

This runs a single safety-core::evaluate() call with hardcoded sensor values — no IO traits, no sim-plant, no twin. The simplest possible integration test.

Examples

Each crate has runnable examples in its examples/ directory:

Example	Crate	Description
hello_safety	foundryos-safety-core	Zero-dep safety evaluation
run_plant	foundryos-sim-plant	Drive the simulated plant
veto	foundryos-arbiter	Safety veto blocks a command
predict	foundryos-digital-twin	Twin forecasts a trajectory
round_trip	foundryos-opcua	Secure-channel sign+verify
loopback	foundryos-ethercat	Software slave PDO exchange

Crate layout

Crate	Domain	Purpose
foundryos-units	Safety	SI unit newtypes with checked arithmetic
foundryos-types	Shared	TagId, Timestamp, DTOs
foundryos-safety-core	Safety	Formally-verifiable safety state machine
foundryos-safety-plc	Safety	Embedded runtime harness
foundryos-io-core	Shared	Transport-agnostic IO trait boundary
foundryos-physics	Control	Thermodynamics/reaction-kinetics model
foundryos-sim-plant	Control	Permanent simulated hardware backend
foundryos-digital-twin	Control	Forward-prediction physics engine
foundryos-control-core	Control	Command/telemetry vocabulary + scheduler
foundryos-control-feedforward	Control	Feed-forward controller
foundryos-arbiter	Bridge	control→safety→IO arbitration
foundryos-ethercat	Protocol	Native EtherCAT master
foundryos-opcua	Protocol	Native OPC-UA binary transport
foundryos-config	Tooling	TOML configuration for tags/limits/setpoints
foundryos-supervisor	Composition	Running process + OPC-UA server host
foundryos-cli	Tooling	Operator CLI for supervisor management

Maturity disclaimer

This is pre-1.0 research/engineering code. The simulated hardware backend is a permanent, first-class part of the architecture (no real lunar hardware exists), not demo scaffolding. Formal verification is limited to foundryos-safety-core via Creusot (see SAFETY.md). Do not deploy against real plant hardware without an independent safety case.

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.