Counter-Example Guided Synthesis of Explainable Reservoir Dispatch Rules: Fusing LLM Template Exploration, SMT Verification and Physics Simulation

iamsamyiok · October 2026 · Code: github.com/iamsamyiok/cegis-loop

Abstract

Dispatch rules for mid-sized reservoirs are still designed by manual trial-and-error against design floods: coupled parameters (pre-release trigger depth, release depth, conservation floor) resist manual enumeration, safety relies on after-the-fact checking, and the trade-off between flood control and water-supply revenue under forecast uncertainty has no principled mechanism. Deep RL produces high-performance but unexplainable policies that cannot pass dam-safety audits. We present a Counter-Example Guided Inductive Synthesis (CEGIS) framework fusing four components: a LangGraph-orchestrated loop in which an LLM parses natural-language dispatch requirements, explores rule templates and proposes counterexample-driven repairs; a Z3 SMT verifier proving structural safety properties (unsat = safe) and emitting concrete counterexamples; a Drake continuous simulator scoring multi-scenario flood dynamics in parallel via Ray; and an economic expectation objective with explicit water pricing. On a real mid-sized reservoir (catchment 8.36 km², spillway crest 51.3 m, culvert max 6.8 m³/s), the verifier automatically rejects a legacy flood-priority rule violating the 46 m supply floor; the synthesized rule passes all properties and keeps the worst-case (420 mm/24h) peak at 52.36 m — 4.34 m below the dam crest — with zero supply deficit.

1. Introduction

Dispatch rules for mid-sized reservoirs are designed by a manual paradigm: engineers fix flood-limit water levels from codes, then verify against historical floods. Three structural defects follow: coupled rule parameters resist manual enumeration; safety relies on after-the-fact checking without any "this rule cannot exceed the line" proof; and the pre-release vs. conservation trade-off under forecast uncertainty lacks a quantitative mechanism.

Two existing routes each fall short. Deep RL yields performant but unexplainable policies that cannot pass dam-safety audits. Classical operations research (LP/DP) is explainable but rests on linearized assumptions and likewise lacks proofs about the rule structure itself. Counter-Example Guided Inductive Synthesis (CEGIS) [1][2] offers a third route: a synthesizer proposes candidates, a verifier checks them against a specification and returns concrete counterexamples, and counterexamples steer the synthesizer away from entire classes of wrong candidates — until the verifier can find none, which constitutes a proof of correctness over the specification.

We fuse CEGIS with LLM-driven template exploration and physics-based performance evaluation. Contributions: (1) a layered architecture where an LLM parses natural-language dispatch requirements, explores rule templates, and proposes repairs from counterexamples, with a deterministic template-repair fallback guarding against hallucination; (2) a two-stage verifier (Z3 structural proofs + numeric scenario sweep emitting first-violation counterexamples); (3) a real-reservoir case study with a cross-generational audit finding: the verifier automatically rejects a legacy rule that violates the supply floor.

2. Method

2.1 Rule family and physics

Candidates are parameterized if-then rules over genes θ = (rain_th, h_pre, h_lo, ff, k):

IF   h ≤ h_lo                        THEN u := 0                          // conserve
ELIF ΣP(24h) > rain_th AND h > h_pre THEN u := 1                          // pre-release
ELIF h > h_weir                      THEN u := clip(ff + k·(h−h_weir), 0, 1)
ELSE                                 THEN u := ff                          // base flow

The physics is a three-source water balance over a level–storage curve:

dV/dt = α·P(t)·A − u·μA·√(2g·(h−h_culvert)) − Cw·B·max(0, h−h_weir)^1.5 − Q_loss

The defining difficulty: normal storage level equals the spillway crest (51.3 m), so the reservoir is always full and the only active control is a 1.0 m culvert capped at 6.8 m³/s — pre-release before the storm is the sole flood lever.

2.2 Two-stage verifier

Stage 1 (Z3). Structural properties are proven by SMT: level ordering (h_pre ≥ supply floor ≥ 40.5 m), valve bounds over the full level domain (clip semantics as nested If), gain sign (a reversed gain is a death spiral: the emptier the reservoir, the less you order/release), and pre-release feasibility (24 h full-open release lower-bounded + storage lower-bounded ≥ the rule's own trigger-scenario inflow). unsat = safe; sat = violation with a model.

Stage 2 (numeric sweep). Scenario-level properties (supply floor minimum, flood ceiling maximum, end-of-horizon refill) are checked by a fast analytic integrator over a discretized scenario set S = {0 (false alarm), 100, 200, 300, 420} mm/24h. The first violation is returned as a concrete counterexample (scenario, time, depth).

2.3 CEGIS loop with LLM repair

The LangGraph state machine runs: parse → propose → verify → (repair ↺ verify) → evaluate (Ray, Drake, economic expectation) → done/repair. On a counterexample the repair node produces branching candidates: two physically opposite directions (reduce economic release vs. stronger pre-release) plus an LLM proposal given the rule text, the counterexample, the loss decomposition (flood/release/deficit costs) and the counterexample history. Deterministic template repair is the fallback whenever the LLM is unavailable or its output is out of bounds — hallucination protection.

The economic objective prices each term: flood inundation 8.3 万CNY per (万m²·h) above the spillway crest, a disaster term above the dam crest, water released below the crest at 1 CNY/m³ (supply use), supply deficit at 10 CNY/m³ super-linear below 46 m, and valve-switching friction. The rule score is the probability-weighted expectation over scenarios (p = 0.4/0.3/0.2/0.1), with the worst scenario reported alongside. The Z3 floor guarantees the expectation can never trade away the 46 m line.

3. Case study: Youyuwan reservoir

Parameters come from a calibrated deployment (catchment 8.36 km²; spillway crest 51.3 m × 20 m broad-crested; dam crest 56.7 m homogeneous earthfill; culvert φ1.0 m max 6.8 m³/s at centre 36.5 m; dead level 40 m; 16-point level–storage table; runoff coefficient 0.55). The verified extreme scenario (210 mm/h × 2 h with valve shut) reproduces the crest-touching response recorded by the previous physics engine.

4. Experiments

E1 — NL parsing. Three dispatch requirement texts (supply-priority, flood-priority, balanced) were parsed by the LLM into spec JSON: 3/3 correct, including mapping "flood level must not exceed 52.5 m" to the flood ceiling and setting priority=flood.

E2 — CEGIS convergence. All three runs verified within one counterexample round (structural Z3 proofs + 5-scenario sweep), each emitting 1 counterexample (pre-release feasibility / supply-floor class).

E3 — Cross-generational audit (key result).

The verifier automatically rejects the legacy rule: its pre-release target (44.67 m) sits below the 46 m supply floor, and the counterexample proves the violation on the rule structure itself. In the traditional paradigm this defect would surface only during a real event.

E4 — Ablation. With the LLM repairer disabled, deterministic template repair also verifies within one round — the fallback is complete; the LLM's marginal value lies in cross-template exploration when rule families grow beyond two skeletons.

5. Limitations

(1) Stage-2 completeness is bounded by the scenario set and discretization; continuous-time completeness needs interval arithmetic or quantitative CEGIS. (2) The LLM can hallucinate; deterministic fallback and output clamping are mandatory. (3) Specifications A1–A4 are human-authored — omissions (ecological flow, sediment) are not covered. (4) Level–storage linear interpolation truncates near the crest. (5) The rule family (if-chain with 5 genes) bounds expressible strategies; convergence at round 0 means the family limit was reached, not global optimality.

6. Conclusion

Fusing CEGIS with LLM template exploration and physics simulation yields reservoir dispatch rules that are simultaneously explainable, formally checked against safety floors, and economically optimized under forecast uncertainty. The verifier's rejection of a legacy rule — with a machine-checkable counterexample — demonstrates a capability beyond both manual design and RL. Future work: interval-propagation for continuous-time completeness, cascade with evolutionary performance tuning (verify first, then optimize), and multi-reservoir systems.

References

1. Solar-Lezama, L. et al. Combinatorial sketching for finite programs. ASPLOS 2006.
2. Jha, S., Gulwani, S., Seshia, S. A., Tiwari, A. Oracle-guided component-based program synthesis. ICSE 2010.
3. de Moura, L., Bjørner, N. Z3: An efficient SMT solver. TACAS 2008.
4. Moritz, P. et al. Ray: A distributed framework for emerging AI applications. OSDI 2018.
5. Tedrake, R. and the Drake Development Team. Drake: Model-based design and verification for robotics. 2019.
6. LangGraph. LangChain Inc. https://github.com/langchain-ai/langgraph
7. Li, J. et al. ModelScope: Towards a unified and modelhub-oriented platform. NeurIPS D&B 2022.
8. Open-Meteo. Free weather forecast API. https://open-meteo.com