The internal model principle in forestry and wildfire

The internal model principle in forestry and wildfire

At 14:40 on a ridge above a fuel break, an incident commander re-tasks two engines from the eastern flank to reinforce a structure defence line on the west. The call is reasonable on the map: the west line has homes behind it, the east flank has been quiet for two hours, and the fuel-moisture sensors on that side read 11%, comfortably above the threshold anyone worries about. At 15:05 the wind vane at the nearest remote automated weather station swings from 220 to 290 degrees and gusts to 34 mph. At 15:19 a satellite thermal pass — not the last one, the next one, forty minutes after the last — shows a new hot pixel cluster on the east flank, in exactly the drainage the engines just left. The ignition is detected after the wind shifted, not before. Crews are recalled, but the fire has already crossed the fuel break the sensors said was safe two hours earlier.

Nobody was negligent. The moisture sensors were accurate for the moment they reported. The satellite pass ran on schedule. The wind model, run at 15:00, correctly forecast a frontal passage — at 15:00, an hour after the commander needed to know it. Every instrument told the truth about its own slice of time. The failure sat in the gaps between slices, and specifically in the gap between the wind's actual behaviour and the commander's working copy of that behaviour.

What actually went wrong

Strip away the specifics and the pattern is this: the incident command system was rejecting a disturbance — the wind's effect on fire spread — using information that lagged the disturbance's own dynamics. Moisture readings updated hourly. The thermal pass updated every forty minutes, sometimes less often under cloud. The wind model ran on a fixed cadence, refreshed on the hour, and its forecast skill degraded fastest exactly when a frontal passage was imminent, which is precisely when it mattered most. Crew positions were logged by hand over radio, so the map the commander held in his head was itself a snapshot, not a feed.

None of these lags is a scandal by the standards of the equipment available. Weather models cannot be rerun every thirty seconds; satellites pass when they pass. But stacked together, the lags mean the command system's picture of the fire's true driver — wind direction and speed acting on receptive fuels — was always a stale copy of a process that was still moving. The commander was not failing to react. He was reacting to a wind that no longer existed.

The concept that names the failure

Control theory has a name for what the command system lacked, and it is exact rather than metaphorical. The internal model principle, formalised by Bruce Francis and W. Murray Wonham in the mid-1970s, states that a feedback controller can drive its error to zero against a persistent disturbance only if the controller's own dynamics contain a copy of whatever generates that disturbance. An integrator rejects a constant offset because it contains, structurally, the generator of a constant. A resonant filter rejects a fixed-frequency hum because it contains that frequency's poles. Without the matching internal copy, you get partial suppression at best — you can throw resources at the fire, but you cannot converge on zero surprise, because your regulator has no representation of the process actually producing the surprise.

Applied to the ridge: the wind, at that hour, was the exosystem. Its generator was a frontal passage with its own dynamics — pressure gradient tightening, a wind shift propagating downslope over minutes. The command system's internal copy of that generator was an hourly forecast snapshot. The mismatch between the exosystem's actual timescale and the controller's internal copy's timescale is not a matter of trying harder. It is a structural gap, and it will reproduce the same failure on the next incident with a similarly volatile wind event, however skilled the next commander is.

Where the copy comes from

This is where the three generations of large model earn their place, because they are three different answers to a single question: how does the internal copy of the exosystem get built, and how long does it stay valid?

A Large Language Model's copies come from a corpus fixed at a training cutoff. Applied to fire behaviour, such a system could hold excellent internal models of fuel types, historical fire-weather patterns, and canonical blow-up scenarios described in the literature it was trained on. What it structurally cannot hold is a copy of this front, on this ridge, this afternoon, because that front did not exist when the corpus closed. Its steady-state error against a wind event that postdates its training is nonzero by construction — not because it lacks fluency about wind shifts in general, but because fluency about the class is not the same object as an identified copy of the instance.

A Large World Model does better, because it builds its copy from what it senses in front of it: the remote weather station, the moisture grid, the thermal pass, read live and fused into a scene. It can identify that this front is accelerating and that this drainage is drying, while the episode lasts. That is a real gain over a frozen corpus, and it is why bounded-scene systems already outperform static ones on shift detection. But the identification is scoped to the incident. When the scene closes — the fire is contained, the deployment ends — the copy dies with it. The next incident, on the next ridge, restarts from nothing, even if the same drainage produces the same katabatic wind pattern every August.

A Large Universe Model is the position where identification never closes. The fuel-moisture streams, the successive thermal passes, the wind model's own drift as fronts move through, the crew telemetry — all stay open, continuously re-estimated, and each estimate is held with provenance: when it was last confirmed, by which sensor, against which prior belief it revised. The August katabatic pattern on that drainage is not relearned from scratch each fire season; it is carried forward as a belief with a decay rate, checked against fresh readings, and revised rather than silently overwritten when this year's pattern differs. That is not a bigger model. It is intake that never has a cutoff and never has a scene boundary — which is exactly what the internal model principle demands, because the wind's generator does not respect corpora or incident boundaries either.

Objections worth taking seriously

The first objection: a rich enough model, even a frozen one, might generalise. Fire behaviour recombines familiar elements — slope, aspect, fuel load, wind — and a sufficiently broad training corpus could span the space of plausible combinations, rejecting wind events it never specifically saw, the way a wide harmonic basis rejects waveforms it was never fitted to. This is true within the span. A model trained on decades of fire-weather cases probably does span most recombinations of familiar drivers. The structural failure appears at the edge of the span: a wind shift driven by a mesoscale interaction the training data under-represents, or a fuel condition altered by a beetle-kill die-off that changed the landscape's flammability after the cutoff. The span was fixed when someone decided what counted as representative; the ridge does not consult that decision.

The second objection carries real weight: incident command does not need asymptotic zero error, it needs bounded, timely suppression, and existing practice already achieves that through high-gain response — pre-positioning engines, running conservative moisture margins, treating every red-flag day as though the worst forecast wind will arrive. This is a fair account of how command actually works, and it works often. But the margin is a cost, paid whether or not the wind shifts, in crew fatigue, in resources withheld from other incidents, in credibility spent on false alarms. And the margin has a ceiling: no amount of conservative buffering converts partial suppression into the kind of anticipatory certainty that lets you move crews before the shift rather than after it. High gain buys time. It does not buy the copy.

The consequence, not the finish line

None of this claims that continuous intake makes ignitions predictable. Weather remains chaotic past a horizon no sensor network erases, and the first strike of a genuinely new wind pattern is absorbed at cost by any system, however continuous its intake. What changes is what happens afterwards: a command structure whose fuel, thermal, wind and crew streams are held as live, provenanced, decaying beliefs converges toward the fire's actual driver rather than its hourly ghost. That is the terminal rung on this particular axis — not because forestry problems are solved, but because there is no evidence class beyond every relevant stream, held open, continuously.