Commissioning-calibrated GP-HOCBF safety filtering for ultra-supercritical boiler-turbine control under model mismatch

Ultra-supercritical boiler–turbine control requires coordinated pressure, separator-enthalpy, and power regulation under process dynamics. Model mismatch can make an upstream controller's proposed command inconsistent with operating constraints. This study develops RoCBF-SF, a Gaussian-process high-order control barrier function (GP-HOCBF) filter that projects proposed commands through a one-step quadratic program while retaining the upstream controller. Three residual GPs correct the model drift, and a chain-based uncertainty-weighted margin defines a tunable family of constraint tightenings. The analysis gives continuous-time forward invariance conditional on an independently valid total HOCBF-error bound and feasible full-row control. In a seven-state actuator-augmented benchmark with an exact input matrix, HOCBF without GP correction records 65,134/150,000 samples exceeding native-unit constraint tolerances across six drift-mismatch scenarios. A tune/test rule selects the GP-mean-only setting, ϵ κ = 0 . This setting, linear MPC, and GP-augmented nonlinear MPC each record 0/175,000 counted violations across nominal and mismatch conditions. The nonlinear reference reevaluates state-dependent residuals throughout its prediction horizon. Seeds held out from margin selection record zero counted violations and zero rejected QP candidates over 50,000 samples. Each seed uses a fitted, frozen GP; initial states and proposed-input sequences partially overlap with the main sweep. Applying the full implemented margin, ϵ κ = 1 , rejects 149,800/150,000 mismatch-scenario QP candidates under the deviation-input bounds. All benchmark filters share a bounded upstream proposal; MPC optimizes its own command sequence. Plant observations from a 660 MW unit comprise a 512-pair historian cohort, an illustrative matched pair of native 5 s windows, and 4320 controller-export records. The cohort's median pressure-residual standard deviation decreases by 3.93%, with a 95% post-day cluster-bootstrap interval of [-12.99,14.65]%. These observational comparisons include concurrent outage maintenance. Controller exports span 480.7–629.7 MW and document a fixed field configuration, ϵ κ = 0.1 . The GP remains frozen. All exported records have positive direct process margins; 43 records report guarded reduced-QP recovery. Maximum total task time is 28.665 ms against a 1000 ms deadline. The results identify GP mean correction as the effective benchmark component and characterize the operating range, recovery behavior, and execution time observed in the plant records.