Ambipolar Potential Safety Envelope

Tandem-mirror confinement lives or dies on the end-plug ambipolar potential; the safety envelope bounds it against a rapid confinement-loss transient.

The potential that holds the plasma

In the burner's tandem-mirror configuration, the end plugs establish an ambipolar electrostatic potential that confines the central-cell ions. Confinement quality is a steep function of that potential. The safety concern is not steady operation but the transient: a rapid collapse of the plug potential releases the central-cell plasma quickly, a fast fault the reflex tier must bound.

def confinement_margin(phi_plug, phi_min, phi_max):
    # normalized distance inside the confining-potential band
    if phi_plug < phi_min:
        return -1.0                # below floor: confinement collapsing
    span = phi_max - phi_min
    return (phi_plug - phi_min) / span

def envelope_action(margin, dphi_dt, rate_limit):
    if margin <= 0 or dphi_dt < -rate_limit:
        return 'TRIP -> controlled ride-down'
    return 'permit'

Rate matters as much as level

The envelope watches both the potential level and its rate of change. A slow drift toward the floor is handled by supervisory control raising plug heating; a fast negative rate — the signature of an incipient collapse — is a reflex-tier trip, because by the time a slow loop reacted, confinement would already be lost. This mirrors the two-timescale split used throughout the reflex tier.

• Level guard: keep the plug potential above the confining floor with margin.
• Rate guard: trip on a fast negative excursion before collapse completes.
• Diagnostic loss guard: an unmeasured potential is treated as out-of-envelope.

The envelope is also written to degrade its own trust as diagnostics degrade. If the potential measurement becomes noisy or a redundant channel drops, the confining floor is raised and the rate limit tightened, so the supervisor errs toward an early, benign ride-down rather than risking a fast collapse it can no longer see clearly. Given how far the plug regime sits beyond any built device, this bias toward conservatism under uncertainty is a stated design choice, not a tuning afterthought.

Because the plug regime is 166–830× beyond any built device, the envelope is set conservatively and widened for model uncertainty, exactly as in the plug-stability supervisor. A collapse trip drives the burner toward its defined safe state along a path chosen to avoid a violent confinement-loss transient.