ops-drill-01 · sci-rad-01 · sci-rad-02/03/04 · hab-tunnel-01 · hab-lift-01 · hab-village-01

The Solar Proton Event Drill

The alarm bus was wired months ago — the weather station's shared sign, the radiation station's 3×/30× rule, the three-depth sentinel network — but nobody had ever run it as one event. This is the first time: a RAD-measured storm as the input, the warning chain's four clocks re-derived, every surface person's path to shielding simulated minute by minute, and the honest result that the run is not the hard part.

Surface cleared

40.9min · N=21, roster pending

Ground's own lead

0min · an identity

Input event dose

418µGy (Si) · RAD, Sept 2017

Dose before shelter

0.3µGy · last person in

What it is

Five accounts, pre-registered before any number was computed, then a JSON timeline the engine can play.

The input is not invented. It is the largest solar energetic particle event that the Radiation Assessment Detector on Curiosity has measured on the Martian surface: onset 10 September 2017 at 19:50 UT, peak fluxes the next morning, a plateau of about ten hours, an event-integrated absorbed dose of 418 µGy in silicon, and a peak dose rate two to three times the galactic background (Zeitlin, Ehresmann and Hassler, 2018). The hourly dose-rate table is not in hand, so the curve's shape is a declared parameter and the two literature integrals are the gates.

The five accounts are the event curve, the warning clocks, the evacuation capacity, the shelter dose per position, and the drill timeline itself. Expectations and gates for all five were written and committed before the first script ran; where a result missed the expectation the miss is printed and the conclusion changed, not the expectation. Thirty-one gates, all green; four pre-registered expectations missed.

The deliverable to the engine is drill.json: for 27 units, the alarm level and the people counts at each minute from the injected red alert to the last person in; for each of the 21 surface people, a contiguous path from post to shelter. A small console unit on the surface, next to the radiation station, is the reference implementation of the response hook every unit is asked to declare.

The SEP drill console close up: three-colour mast on red, siren horn, the board with six location-count bars, twenty minutes into the drill — THE CONSOLE, 20 MIN INTO THE DRILL — MAST RED, BOARD BARS = LOCATION COUNTS; 1006 TRIANGLES BESIDE THE RADIATION STATION

Stacked area chart of where every surface person is, minute by minute, during the drill — WHERE EVERYONE IS, MINUTE BY MINUTE — 21 PEOPLE, SURFACE CLEARED AT 40.9 MIN; THE DOTTED LINE IS THE 26.7 MIN A 1972-CLASS EVENT ALLOWS

How it works

Four clocks, one identity, and a queue that never forms.

The clocks. Protons released at the Sun arrive in order of energy along a 2.04 AU Parker spiral. Re-deriving the radiation station's account from the kinematics: multi-GeV first arrivals at 17.0 min, the 166 MeV atmospheric cutoff complete at 32.2 min, the orbital detector's 100 MeV front at 39.6 min, its 10 MeV population at 117.1 min. The Jezero atmosphere, 20.7 g/cm², is a high-pass filter at 166 MeV, so the surface sees the earliest particles and never has a lead over its own dose: the particles that trip the alarm are the particles that start the dose. The orbital tier's 100 MeV trigger therefore runs 7 to 23 minutes behind the surface dose onset, depending on which arrival you call the onset. The only positive lead anywhere in the chain is the L4 coronagraph's one-to-three-day structural forecast.

First arrival

17.0 min

245 MeV bulk

27.8 min

166 MeV full band

32.2 min

EPS 100 MeV front

39.6 min

EPS 10 MeV

117.1 min

Sentinel 5σ, 2017-class

35–188 s

The alarm. The surface station counts penetrating particles in a one-minute sliding window; yellow at three times quiet, red above thirty. The 2017 event raised protons above 135 MeV by a factor of four at most, so its count peak sits between two and four: red is excluded, yellow cannot be established without the near-cutoff spectrum. The drill's red at t = 0 is therefore an exercise injection, and the event curve is aligned to it — the most conservative alignment, since the ground has no lead.

The evacuation. A deterministic discrete-event simulation moves every surface person: suit-up (declared 15 min), walk at 1 m/s to the nearest shielded entrance, queue, a 6 m³ airlock cycle of 3 min carrying two suited people, and at the lift station a 12-person cab down 30 m to the foyer. The village's thirty residents shelter in place under two metres of cover; their vestibule closes. The last one in comes from the launch pad, 1.36 km away: 15 min suiting up, 22.6 walking, no wait, 3 in the lock. The pre-registration bet that the airlock's serial queue would be the bottleneck. It came third: thirteen posts arrive staggered and the locks sit idle most of the time. The cab, rated for twelve, never fills — the vestibule meters people two at a time.

The dose. Integrating the event curve to each person's sheltering time, the last one in receives 0.2 to 0.3 µGy more than someone already underground — a thousandth of the event. Ninety percent of the 418 µGy arrives 32 to 82 hours after onset. For a RAD-class event the run does not change the dose; the stay does. For a 1972-class event, at the radiation station's cited 44.9 mSv/h, the same 41 minutes on the surface is 30.6 mSv, past the occupational annual limit — and nobody from the far posts reaches the tunnel inside the 26.7 minutes that event allows.

Surface absorbed dose rate versus hours after onset for the September 2017 event, two peak-factor cases — THE INPUT — 2017-09-10/11 AT THE SURFACE, LITERATURE SHAPE, INTEGRAL-CONSTRAINED TO 418 µGy

Clearance time versus number of people on the surface, with the 26.7 minute line and the rover lever — CLEARANCE TIME VS POPULATION — THE FAR WALK, NOT THE AIRLOCK, SETS IT; ROVERS AT THE FAR POSTS ARE THE LEVER

The ledger

Every number above, and which run produced it. Status: literature · cited card · account · cross-implementation · declared parameter · bound only · declared gap.

Claim	Value	Produced by	Status
Event-integrated absorbed dose, RAD-B	418 µGy (Si)	Ehresmann 2018 GRL 45:5305; Zeitlin 2018 GRL 45:5845; Hassler 2018 Sp. Weather	literature
Onset / peak / plateau	19:50 UT 10 Sep · next morning · ~10 h	Ehresmann 2018 (abstract)	literature
Peak dose rate over background; proton flux >135 MeV	2–3× · ×4	Zeitlin 2018; Ehresmann 2018	literature
Quiet surface rate used as baseline	0.21 mGy/day = 8.75 µGy/h	sci-rad-01 card, account 1 (RAD)	cited card
Decay constant after a 12 h rise + 10 h plateau (peak 2× / 3×)	31.8 / 7.9 h	mars-drill/ledger/01_event.py	account, shape declared
Event in quiet-sol equivalents	1.94 sol	ledger/01_event.py	account
Count peak factor at the surface station; red (30×) excluded	2–4×	ledger/01_event.py	asymmetric
Arrival clocks 17.0 / 32.2 / 39.6 / 117.1 min; window 77.5	<1% of sci-rad-01 account 5	ledger/02_warning.py	cross-implementation
EPS 100 MeV front vs surface dose onset	−22.7 / −11.8 / −7.4 min	ledger/02_warning.py	account
Ground yellow after first arrival, 4× event, hard→soft spectrum	12.5–13.8 min	ledger/02_warning.py	account
Sentinel 5σ confirmation, F=2 / 10	188 / 8.5 s	ledger/02_warning.py (reproduces sci-rad-02)	cross-implementation
Personnel airlock / lift throughput	40 / 698 persons·h⁻¹	ledger/03_evacuation.py	p=2 declared
Surface cleared, base case	40.9 min (N=21)	ledger/03_evacuation.py	placement declared, roster pending
Last person's clock (launch pad → tunnel lock)	15 + 22.6 + 0 + 3 + 0.3 min	ledger/03_evacuation.py	account
Bottleneck ranking (pre-registered: queue first)	walk 22.6 > suit 15 > wait 2.5	ledger/03_evacuation.py	prereg miss
Against the 26.7 min of a 1972-class event	fails from N=7; suit 0 → 25.9; rovers → 31.7/22.3/17.3	ledger/03_evacuation.py; rate cited from sci-rad-01 account 5	asymmetric
Vehicle gate with 0 / 4 / 8 seats	40.9 / 39.4 / 39.4 min	ledger/03_evacuation.py	ablation
Full 12-person lift loads	0 of 5 trips	ledger/03_evacuation.py	account
Roster brackets: all duty at pwr-grid-01 / at the launch pad	30.7 / 49.9 min	ledger/03_evacuation.py	bounds
Roster-proportional placement (66 surface billets → 16)	41.2 min	ledger/03_evacuation.py; ops-roster-01 roster.json (r1)	cited × declared peak
Last person's extra dose, literature shape / 2 h-rise shape	0.2–0.3 / 1.0–2.0 µGy	ledger/04_shelter_dose.py	account, both shapes
90% of the event delivered after	82 / 32 h	ledger/04_shelter_dose.py	account
Same 41 min on the surface at F=10³ / 10⁴	3.1 / 30.6 mSv	ledger/04_shelter_dose.py; rates from sci-rad-01 account 5	cited × account
Village bunk SEP dose per event (from the Run B 27.0 mSv/yr floor, which since 2026-09-21 carries the qualifier model void under the floor: glass addendum A, village card v2)	≤ 48 µGy	ledger/04_shelter_dose.py	bound only · qualified
Undercity (30 m rock) / deep lab SEP increment	≤ 4 µGy / 0	sci-rad-03 / sci-rad-04 cards	cited card
Known answer: 0.66 ÷ (0.21 × 1.0275)	3.06 vs ⟨Q⟩ 3.05	ledger/04_shelter_dose.py G4.4	gate
drill.json: units with keyframes / minutes / paths / gates	27 / 47 / 21 / 31 green	ledger/05_drill.py; ledger/run_all.py	account
Console unit: triangles / bbox / static and full-cycle minY	1006 / 3.25×4.37×2.10 m / 0	validate_unit.mjs; mars-drill/tools/measure.mjs	measured
Undercity bed count · duty-room wall density · crew-vehicle seats · cover vs an SEP spectrum · the roster	—	ops-roster-01 · surface holders · veh-ground-01 · res-glass-01	declared gap

What broke

What the drill exposed, and what the ledger got wrong about itself.

For the event that matters, nobody reaches the tunnel. A 1972-class hard event allows 26.7 minutes to the annual limit (the radiation station's cited table). Under the declared 15-minute suit-up the surface fails to clear from seven people upward; with instant suit-up it just passes at 25.9 minutes, carried entirely by a 22.6-minute walk from the launch pad. Shelter-in-place is the only action that fits inside the window — and not one surface duty room has a wall areal density on its card, so its dose cannot be written. That is the largest gap this drill found, and it is dispatched.
The bottleneck was pre-registered in the wrong place. The expectation ranked the airlock's serial queue first. Measured: the longest wait at any lock is 2.5 minutes; the walk and the suit-up come first. The declared placement spreads sixteen people over thirteen posts, so arrivals stagger. The queue only dominates if everyone starts near the gate (30.7 minutes with all sixteen at the substation).
The measured event would not ring the bell. Under the city's own 30× rule the September 2017 storm never reaches red, and its 2–4× count peak straddles the 3× yellow line. The city had defined no "exercise" alarm state; the drill's red is an injection, and the radiation station is asked how an injected state should be displayed.
"Full lift" cannot happen. The brief asked for the lift running full. The vestibule in front of it is a 6 m³ airlock cycling two suited people every three minutes; the twelve-person cab makes five trips with two aboard each. Holding the cab for a minute or two changes nothing. The metering is upstream of the cab.
The event shape was declared before the abstract was read. The pre-registration declared a two-hour rise. Ehresmann's abstract gives a rise to the next morning and a ten-hour plateau. The base case uses the literature shape and keeps the two-hour case as the ablation; the first-hour sheltered dose is six times shape-sensitive, so both are printed and the verdict ("the run does not change the dose") is checked under both.
One pre-registered line used two baselines. The effective-duration expectation was written with 0.25 mGy/day while the neighbouring line used 0.21; the miss (47.8 h against an expected 20–40) is the ledger's own arithmetic, not the physics, and is left printed as a miss.
Ventilation switching has no radiological reason. A proton event does not travel with the air. The switch stays in the timeline as a domain-seal action after the doors close, labelled as such; the tunnel's holder is asked whether it should stay at all.
The sentinel's 188 s reproduces only one way. The card's 5σ times come from the variance of a background-subtracted difference; the background-only form gives 62 s. Registered so the next reader does not "correct" a correct card.
A card contradicts itself. The foyer card lists the personnel airlock at "~22 kWh / ~24 min" in its spec table while its own text and the tunnel card say 0.2 kWh / 3 min — a copy of the vehicle row. Reported to the holder; this ledger uses 3 min.
The roster arrived, and it has no surface. The personnel roster delivered the same day places all 85 undercity residents "awake underground" and the 30 villagers in the village: its location model has no surface-duty room, although the life-support card it is built from books 197 person-hours a sol there. Its billet table does say which surface facilities are staffed, so a roster-proportional placement was run: 41.2 min against 40.9 — same headline. The instantaneous surface head count therefore remains a declared number; the drill is flagged 'roster pending' until the roster carries a surface location.
The village floor this ledger cites now carries a qualifier. The glass plant found (addendum A, 2026-09-21) that since Run B its transport model has built the village hull as a whole cylinder, with a ~50 m³ air void under the floor instead of the declared native ground. The 27.0 mSv/yr bunk floor is unchanged and no substitute exists; every number derived from it here (the ≤ 48 µGy bound) is labelled, not re-derived, and the direction of the correction is not guessed.
More units carry keyframes than expected. Twenty-seven against a pre-registered 14–18, because each of thirteen surface duty units takes its own row. Printed as a miss.

Try it

The engine's player is wired (MODELS.md §4d); the console also runs the drill by itself when the player is idle.

Open the viewer with ?colony=1&inspect=ops-drill-01. The console stands beside the surface radiation station in the environment-warning cluster. Press V to look around and use the SEP drill button on the left edge of the screen (or the console's own start action): the mast turns red, the siren horn stirs, and the six bars on the board replay the city's per-minute location counts at sixty times real speed — one real minute per second, the ratio printed on the plaque rather than passed off as real time. After 47 seconds the last person is in and the mast returns to green.

Every unit in the timeline is asked to declare its own reaction to the alarm level through a userData.alarm hook; the spec and the dispatch to the thirteen unit classes are in the sources below. Since 2026-09-19 the engine's alarm bus and drill player are wired (?drill=1&colony=1, or the SEP drill button) and play the whole city: gate lamps, cycling airlocks, a sealed village vestibule, grounded aircraft, a frozen launch window, a cleared palace — and two sentinel screens thirty and three thousand metres underground that, correctly, do not change at all.