Deterministic environmental digital twin: where AI helps and where the calculation decides

Anyone who works with contaminated sites, dispersion plumes or monitoring series knows the problem: data is scarce, series are noisy, and contaminant transport in soil and groundwater depends on equations that do not forgive shortcuts. This is exactly where many people have been trying out language models.

The risk is well known. A language model can make up an attenuation rate, a permeability coefficient or a flow path that does not exist, and write it all with the same fluency it uses for what is true. The text is convincing, and nobody can say where the number came from.

What formal verification teaches

On October 26, 2026, OpenAI announced that internal models had produced a proposed refutation of the Exponential Time Hypothesis, a conjecture from the late 1990s about the 3-SAT logic problem, with the proof formalized in Lean, a mathematical proof assistant. Independent expert review is still under way, and the announced gain is theoretical, with no immediate practical effect.

What matters here is the method, which holds whether or not that result is confirmed. Lean is not impressed by a well-written sentence: a machine checks every step of the proof, and a step that does not close is rejected. The AI proposes, and the verifier accepts or rejects. Even so, Lean only confirms the statement that was written for it, and people still have to check that this statement says what was meant to be proved.

An environmental digital twin needs the same discipline. Concentration, mass balance and comparison with reference values cannot be guessed by a piece of text. They have to come from identified data and from calculations that always give the same result for the same input.

How ecbyts separates the roles

ecbyts works as a world model of the site: a single model in which every element, whether a monitoring point, a plume, an area or a contract, has data and an origin. 3D is one of the views, alongside map, table, chart, timeline and report.

Data comes in as observations with parameter, unit, date, campaign and the monitoring point where it was measured. No AI takes part in this step.

The calculation is deterministic. Interpolation, comparison with the set of reference values chosen for the model, costs and indicators are functions of the app itself: the same input produces the same result, today and a year from now. The AI does not do the math in place of the engine.

The AI comes in as a translator. In the command bar you write what you want in natural language, such as adding a monitoring point or showing the benzene observations, and the assistant picks from the actions the app already has. It does not create new actions or write directly into the model. The default is to ask: only a short list of actions considered safe runs without confirmation. For all others, the confirmation card shows what will actually be saved, with the element, parameter and value resolved in the open model, and warns when the AI's text quotes a number that does not appear in what will be saved. Before anything is sent to the AI provider, the names and identifiers of the points are replaced with generic descriptions.

A trail remains. Every change made by the AI is recorded with the model used, the action and a verifiable summary of the parameters, in an append-only audit trail. When you export the model's .ecbt key, the app issues the ECBYTS Seal, a self-declaration by whoever is responsible for the model, with a verification link. Whoever receives the key can check they are looking at the same model that was declared.

What we do not do yet

ecbyts does not prove theorems about your model. Compliance rules are tested calculations, not formal proofs in Lean, and technical responsibility stays with the people who review and sign. Formal verification points in a direction that seems right to us: the more critical rules can be written so that a machine checks them, the less room there is for a number without an origin.

What changes in practice

For environmental and geotechnical engineering, the path suggests moving from static spreadsheets and closed reports to a model that keeps the origin of every number and shows when something changed, who changed it and with which tool.

For those who build monitoring software, the rule is simple to state and hard to follow: AI is there to understand the request and orchestrate what already exists, and the core that calculates has to remain deterministic, auditable and tied to measured data.

To see the command bar in use, open the Natural Language Commands tour. The other AI tours are in AI assistant and neural networks.