TPT-FoundryOS

Autonomous ISRU chemical plant control: a safety-critical, fault-tolerant process control system for lunar regolith/ice-processing refineries.

FoundryOS replaces traditional SCADA with a Safety-by-Design architecture split into two domains:

• Safety Domain (no_std, formally-verified): hardware-level override authority. Runs on physically separate PLC hardware from the control domain and communicates only over EtherCAT frames.
• Control Domain (std): yield optimization, feed-forward thermal control, and a permanent digital-twin physics engine.

See ARCHITECTURE.md for the dependency graph and domain boundaries, and SAFETY.md for the proven-vs-tested-vs-assumed invariant summary.

Quickstart

cargo build --workspace
cargo test  --workspace

Run the in-process supervisor (simulated hardware backend) end-to-end:

cargo run -p foundryos-supervisor

Crate layout

Crate	Domain	Purpose
foundryos-units	Safety	SI unit newtypes with checked arithmetic
foundryos-types	Shared	TagId, Timestamp, DTOs
foundryos-safety-core	Safety	Formally-verifiable safety state machine
foundryos-safety-plc	Safety	Embedded runtime harness
foundryos-io-core	Shared	Transport-agnostic IO trait boundary
foundryos-physics	Control	Thermodynamics/reaction-kinetics model
foundryos-sim-plant	Control	Permanent simulated hardware backend
foundryos-digital-twin	Control	Forward-prediction physics engine
foundryos-control-core	Control	Command/telemetry vocabulary + scheduler
foundryos-control-feedforward	Control	Feed-forward controller
foundryos-arbiter	Bridge	control→safety→IO arbitration
foundryos-ethercat	Protocol	Native EtherCAT master
foundryos-opcua	Protocol	Native OPC-UA binary transport
foundryos-supervisor	Composition	Running process + OPC-UA server host

Maturity disclaimer

This is pre-1.0 research/engineering code. The simulated hardware backend is a permanent, first-class part of the architecture (no real lunar hardware exists), not demo scaffolding. Formal verification is limited to foundryos-safety-core via Creusot (see SAFETY.md). Do not deploy against real plant hardware without an independent safety case.

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.