Controlled Shutdown and Safe States

The always-available path to a defined low-energy configuration - the floor beneath every other resiliency behavior.

A defined place to fall

Every resilient plant needs a safe state: a defined, low-energy configuration the machine can always reach, from any mode, within a bounded time, regardless of what failed. Degradation and failover try to keep serving; safing gives up service to protect the machine and people. It is the priority edge in the state machine.

What safe means per machine

• Breeder: terminate the plasma in a controlled ramp-down or, if necessary, a mitigated shutdown that limits disruption loads on the 16.84 T coils and structure
• Breeder magnets: protective discharge that dumps stored energy into external resistors rather than the cold mass
• Burner: collapse the plug regime and drain field on the stressed 26.49 T coil in a controlled sequence
• Both: place fueling, heating, and current-drive actuators in their fail-safe positions

Controlled vs emergency

A controlled shutdown is planned and gentle; an emergency safing is fast and accepts higher component wear to protect against a worse outcome. The stack always prefers controlled but guarantees emergency is reachable even if the supervisory layer is lost - the fast protection hardware can force it independently.

def safe(state, cause):
    if fast_protection_required(cause):
        emergency_discharge()           # hardware-level, supervisor-independent
        return 'FAULT'
    controlled_rampdown(state)          # gentle, preferred
    park_actuators_failsafe()
    return 'SAFING'

Independence is the point

The safe path must not depend on the same resources that might have failed. Quench protection, for example, is wired to act without waiting on the supervisory network. Reaching and holding a safe state is the acceptance criterion for every fault-injection drill; see Verification and Drills and Quench Protection.