實體 AI 系統設計：幹擾模型讀取前，先驗證每筆管線紀錄

This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://codeatoms.ai/dc-interference-gas-pipelines-pakistan/. The operator is described by class, never by name.

A gas pipeline operator in Pakistan has two buried lines within a kilometre of a high voltage direct current electrode station. When the HVDC link runs in monopolar mode, up to 1.3 kA returns through the ground, and some of it rides the operator's steel. The question the operator cannot answer today: along which sections does that current push pipe to soil potential past the cathodic protection criterion of minus 0.85 V against a copper sulfate electrode, and what mitigation, with what bill of quantities, restores it?

The records that should answer it are scanned survey sheets, coating reports, layouts and soil investigations with no provenance on any value, and the tender quotes a single backfill resistivity for ground the same records describe as layered and variable. The contract makes every data error the contractor's cost and pays only after the final report. That shapes the whole design.

1. The register is the product, not the model

The first deliverable is a validation register: fifteen typed objects (the two lines and their insulating joints, the anode beds and the generator unit, the electrode station, the HVDC system with its operating states, the test points, the soil report, the assessment and each mitigation measure), with every attribute labelled measured, inherited, assumed or unknown. Nothing enters it without a label. A safe distance computed from an assumed resistivity cannot be defended; a safe distance whose inputs trace to a dated field reading can.

2. One parser, two keyers, one engineer

The only neural workload is PaddleOCR-VL 1.6, about 0.9 billion parameters under Apache 2.0, digitising the scanned package. It runs as released, never fine tuned on operator data, so the weights handed over are the released weights and no training data obligation exists. Every extracted value is captured by two independent keyers; a disagreement becomes a logged discrepancy, and every discrepancy routes to the operator's corrosion control engineer before any modelling starts. No open weight model ever touches a safety calculation.

3. The physics stays in validated software

The interference model is built in the commercial electromagnetic and grounding software the governing clauses require (CDEGS or COMSOL class). The design calibrates it against bipolar baseline field readings, because the monopolar returns that drive the worst case are rare and short, and models the monopolar and fault cases as a conservative envelope with the validation basis and its limits written into the report. Layered soil enters the model as separate regions, never as one bulk value.

4. What the stack leaves out

No streaming backbone, no historian, no video ingest, no orchestrator, no edge compute, no language model. The study consumes a furnished document package, nothing moves, nothing is tracked, and the deliverable is an engineering report authored in the mandated software. One server class host of the 48 GB PCIe inference class inside the operator's estate carries the parser and the solver runs; parser weights take under 2 GB of the card and the rest is solver memory. Nothing crosses the boundary in either direction, and the re-runnable model is handed over on the operator's own hardware with no consultant side copy surviving.

5. Gates spend the data risk before the clock does

Three phases carry fifteen items. Phase one exits only when the register is complete with provenance on every attribute, every discrepancy is closed by the named engineer and the corridor within 1000 m of the station is field verified. Phase two exits on a calibrated model and an accepted safe distance assessment. Phase three exits on an accepted mitigation strategy with its bill of quantities and the model handed over. A data problem found after the final report has no schedule or payment recourse at all, which is why the gates are dated and front loaded.

The cost line

Owning the one host costs about 19,500 US dollars over three years, inside 18,700 to 20,200 with support and power. Renting one L40S card from the nearest AWS region would cost 22,500 to 60,000 dollars, so ownership is about four fifths of the deepest three year commitment, and the rental could not keep the data in Pakistan in any case. The sourced arithmetic is in Appendix A of the paper.

This design is listed with every other published design among the sovereign AI reference architectures at CodeNinja Atoms.

Designed on CodeNinja Praxis, the CodeNinja Atoms platform for designing physical AI systems. The object model imports into Hyper Ontology. DOI: 10.5281/zenodo.23308093.