DEV Community: Umar Bilal

System design for physical AI: live wildfire ignition risk for every distribution feeder, on the utility's own hardware

Umar Bilal — Sat, 03 Oct 2026 19:20:52 +0000

This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://muhammadumar89.github.io/codeninja-research/wildfire-risk-distribution-us/ (DOI 10.5281/zenodo.23119325). The operator is an illustrative scenario, not a customer.

A member-owned electric distribution cooperative in the United States runs more than 9,000 miles of overhead line across fire country. Vegetation contact and failing equipment are its leading ignition risks, and they build up between patrol visits. The question it cannot answer today is which feeder segments are most likely to ignite, and which will be exposed to fire weather in the next 48 hours.

The signals exist, spread across systems that never meet: SCADA, GIS, the AMI head end, the outage management system, pole inspection spreadsheets, work management, wildfire cameras, and weather and mesonet feeds. Here is how they turn into a system.

1. Join first, model second

Every source enters through a read-only adapter. The adapters write fourteen typed objects: substation, feeder, feeder segment, pole, recloser, meter, pole inspection record, outage event, feeder segment ignition risk score, red flag warning, wildfire camera station, field crew, work order and public safety power shutoff (PSPS) decision record.

The feeder segment is the focal object. Start from one pole with a defect and one traversal reaches its inspection photos, the segment that carries it, that segment's risk score and the signals behind it, the recloser protecting it and its fast-trip state, the meters and their last gasp history, the red flag warning over the area, the cameras that can see it, and the approved work order with its crew. A document store would need a hand-built join for every hop.

The object model ships as JSON (ontology/objects.json, format hyper-ontology/1) so you can load it instead of redrawing it.

2. Two tiers, placed by the link

Tier	Hardware	Runs	Why there
Edge	Fanless, sealed industrial boxes in NEMA 3R/4 enclosures at substations, on patrol trucks and at the yard	RF-DETR detection of smoke, downed or leaning poles, vegetation encroachment and hot spots	Cellular coverage drops in exactly the storm that matters, so detection cannot depend on the link
Central	One ruggedised server of eight 141 GB HBM-class GPUs at the operations center	The live distribution model, the risk store, GLM 5.2 under MIT for the work surface	The cooperative owns the weights and the record they reason over

3. Size the central node from the weights

weights = 753B parameters x 1 byte (FP8)       = 753 GB
need    = 753 GB x 1.2 (KV cache, activations)  = 904 GB
node    = 8 x 141 GB                            = 1,128 GB -> ~224 GB headroom

The published BF16 weights, about 1.5 TB, would need sixteen cards. FP8 halves that to one node. The time series store beside it is sized for 15-minute AMI intervals from every meter and every recloser, with store-and-forward buffering.

4. Keep a person on every de-energisation

Every PSPS and every fast-trip change is a decision record: a recommendation, a rationale, a named approving operator and the regulator notification reference. It moves through recommended, approved, declined, de-energised and re-energised under that person's hand. The design never opens or closes a recloser, and a work order reaches a crew only after approval in the system crews already use.

5. What it costs

Owning the stack for three years, including an allowance of 63 edge nodes, comes to about 841,000 US dollars with support and power at the Texas industrial price. Renting the same capacity around the clock costs 0.97 to 1.92 million dollars, so ownership is about four fifths of AWS's deepest three-year commitment. A closed frontier model by the token matches the owned stack at about 41 users. Every price is cited in the paper's Appendix A.

Full design, figures and the object model: the paper.

Designed on Praxis, CodeNinja's platform for designing physical AI systems. The object model imports into Hyper Ontology, which turns it into a living system. Load it yourself with the open hyper-ontology loader.

System design for physical AI: predicting container terminal truck turn time with edge vision and an open-weight model

Umar Bilal — Sat, 03 Oct 2026 10:06:24 +0000

This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://muhammadumar89.github.io/codeninja-research/truck-turn-container-terminal-us/. The operator is an illustrative scenario, not a customer.

A container terminal in the United States runs two berths, eight ship to shore cranes, twenty six rubber tyred gantry cranes (RTGs) over fourteen yard blocks, eleven truck gate lanes and an on dock rail ramp. Truck turn time averages 54 minutes and spikes above 90 on export peaks. Nobody can say why while it is happening, because the causes live in different systems: the terminal operating system, the gate system, two crane vendors' telemetry, reefer monitoring, rail switch lists, cameras, weather and tide.

Here is how that turns into a system.

1. Join first, model second

Every source enters through one of three adapter families (integration, EDI, and an edge node for cameras), never directly. The adapters write twelve typed objects: vessel call, container, yard block, RTG, ship to shore crane, truck visit, gate lane, rail cut, reefer plug, yard person, transfer zone and safety event.

The links carry verbs: a yard block assigns an RTG, a truck visit enters through a gate lane, a vessel call discharges to containers, a reefer plug powers a container. Start from one truck visit that ran long and one traversal reaches the gate exception that held it, the container's yard block, the RTG assigned there and its fault codes, the vessel call and its discharge order, and the rail cut the box may miss. A document store holds every record and answers none of that.

The object model ships as JSON (ontology/objects.json, format hyper-ontology/1) so you can load it instead of redrawing it.

2. Three tiers, three clocks

Tier	Hardware	Runs	Its clock
Edge	Fanless IP-rated enclosures at the yard blocks, gate and quay	RF-DETR detection, a Roboflow tracker on CPU	The camera frame: the transfer-zone conflict verdict never waits on a network
Site	One GPU node, L40S-class 48 GB or H100-class 80 GB	Chronos-2 turn time forecast, Qwen3-Embedding-0.6B retrieval	The operation: recomputed as crane cycles, gate reads and appointments arrive
Frontier	One node, eight 141 GB HBM cards	GLM 5.3 at FP8 for the planner work surface, served by vLLM or SGLang	The human: interactive sessions in front, batch reconciliation behind

3. Size each tier from the weights

edge      RF-DETR Nano to Large   ~61-68 MB at 16 bit   -> several streams per accelerator
site      Chronos-2 ~0.24 GB (16 bit) + embedder ~0.6 GB (8 bit) -> one card, room for 32K activations
frontier  753B x 1 byte (FP8) = 753 GB; x 1.2 = 904 GB; 8 x 141 GB = 1,128 GB -> one node, ~10 kW

Pin the edge serving runtime (ONNX Runtime, OpenVINO or Triton) after a bench measurement on the yard's own streams. A detector sized from a datasheet is the first way a vision system disappoints.

4. Keep the boundary closed

The model holds no outbound connection. Detection lives at the edge because no safety reflex should cross a network hop. Footage of longshore labour never leaves the site; the only things that cross tiers are detections, forecasts and the records a person acts on.

5. Keep a person on every action

Surfaces warn and propose. The named planner acts inside the terminal operating system, and the named safety supervisor acknowledges every safety event, with the disposition written to the record. Write-back into the terminal operating system is a second phase, gated on labour and IT sign-off.

6. What it costs

Owning the stack for three years comes to about 722,000 US dollars with support and power at the US industrial price. Renting the same GPUs around the clock costs 1.12 to 2.52 million dollars, so ownership is about two thirds of the cheapest three-year cloud commitment. A closed frontier model by the token matches the owned stack at about 35 users and costs more for every user after that. Every price is cited in the paper's Appendix A.

Full design, figures and the object model: the paper.

System design for physical AI: a fully air-gapped stack for an oil and gas operation in Pakistan

Umar Bilal — Sat, 03 Oct 2026 07:01:14 +0000

This is the engineering summary of a full reference architecture. The paper, its object model as JSON and the model register are open: https://muhammadumar89.github.io/codeninja-research/sovereign-hse-pakistan/.

An oil and gas operator in Pakistan wants one thing from AI in its health, safety and environment department: a warning before the next incident, not a report after it. The data to do that already exists, spread across SAP EHS, SCADA and fire-and-gas historians, camera feeds and scanned investigation files. The constraint is just as clear. None of it may leave the operator's own infrastructure, and no third-party AI API may sit in the serving path.

Here is how that constraint turns into hardware, models and money.

1. Pick models by licence first

On an air-gapped platform you cannot call a hosted model, so every model must be self-hosted, and the licence decides whether the operator owns what it runs. Every pick lets the operator hold, run and fine-tune the weights inside its own boundary:

Role	Model	Licence
Reasoning, cited answers, agents	GLM 5.3 open weights, 753B mixture-of-experts at FP8	bespoke; purely internal use is exempt from its managed-service review
Time-series anomaly and early warning	amazon/chronos-2	Apache-2.0
Vision detection baseline	Roboflow/rf-detr-large (Nano to Large only)	Apache-2.0
Tracking across frames	Roboflow trackers	Apache-2.0
Multilingual retrieval (English, Urdu, Roman Urdu)	BAAI/bge-m3	MIT
OCR of scanned permits and reports	PaddlePaddle/PaddleOCR-VL-1.6	Apache-2.0

RF-DETR's larger checkpoints ship under a different platform licence, so the design stops at Large.

2. Size the central tier from the weights, not the brochure

Take the largest filed parameter count, multiply by bytes per parameter at the serving precision, then add a planning factor for the KV cache and activations so long incident histories fit:

weights   = parameters x bytes per parameter
need      = weights x 1.2 planning factor
nodes     = ceil(need / (cards per node x memory per card))

GLM 5.3 is filed at 753B parameters. At FP8 that is 753 GB of weights and 904 GB with headroom, so one node of eight 141 GB cards (1,128 GB) holds it, leaving 375 GB beside the weights for KV cache: long incident histories and concurrent users.

3. Keep fast things at the edge

Detection and forecasting must keep up with cameras and sensors even if the link to the central tier drops. Detection runs on edge nodes inside the plant network, reusing the operator's NPU compute where it exists. Forecasting, OCR and embeddings run on a site inference server beside the historian: Chronos-2, PaddleOCR-VL 1.6 and BGE-M3 together weigh under 4 GB. Edge and site compute are sized by stream and decode load, not by model count.

4. One clock, one backbone, read-only adapters

Every source enters through an adapter that only reads, tags provenance, maps to the object model once, is replayable and degrades honestly.
Apache Kafka on KRaft orders events per equipment key, so a developing event is read in the order it happened.
Chrony with a GNSS grandmaster gives sensors, cameras and servers one clock. Correlating SCADA with camera detections is meaningless if the timestamps drift.

5. What it costs, against the cloud

Three years, public prices, electricity at Pakistan's B3 industrial tariff:

Option	Three-year cost (USD)
Own the hardware, with support and power	about 670,000
Rent the same GPUs, AWS UAE region, deepest three-year plan (EC2 Instance Savings Plan, paid up front)	1.14 million
Rent the same GPUs, AWS UAE region, on demand	2.82 million
Buy a closed frontier model by the token, 50 users	1.04 to 2.95 million

No hyperscaler runs a region inside Pakistan, so every rented option also moves the data abroad. The full workings and sources are in Appendix A of the paper (version 2, 3 October 2026: the three-year row now uses AWS's deepest plan; version 1 used a 26 percent plan and showed 1.85 million).

6. The one hard dependency

141 GB HBM-class accelerators need a US export licence for Pakistan (Country Group D:4). Approved channels have delivered thousands of GPUs to Pakistani operators, and the design's first phase confirms the installed inventory before anything is bought, with a fallback to a mid-size model on existing hardware.

Reuse it

The object model ships as JSON in the repository in a format meant for import into an ontology platform, with every object's anchor system, properties, status vocabulary and links. Take it, change it, cite it.

Umar Bilal, Cofounder of CodeNinja. CodeNinja is a Middle Eastern American artificial intelligence lab that puts autonomy in physical operations.