Cryogenic and Vacuum Safety Interlocks
Cryogenics and vacuum are preconditions for high-field, high-confinement operation; their interlocks gate energization and default closed on any doubt.
Preconditions, not afterthoughts
Both machines require deep cryogenics for their superconducting magnets and high vacuum for their plasmas. These are not merely operating conveniences; losing either while energized is a hazard. The cryogenic and vacuum interlocks are permissives in the hardwired interlock matrix: coils cannot be energized and plasma cannot be sustained unless cryo and vacuum read good, and any doubt reads as not-good.
Vacuum permissive
| Pump running | Pressure in band | Isolation valve pos known | High-vac permit |
|---|---|---|---|
| 1 | 1 | 1 | 1 |
| 0 | 1 | 1 | 0 |
| 1 | 0 | 1 | 0 |
| 1 | 1 | 0 | 0 |
def cryo_permit(temp_K, target_K, flow_ok, tol_K=0.5):
# margin band around the operating temperature, flow present
return abs(temp_K - target_K) <= tol_K and flow_ok
def energize_gate(cryo_ok, vac_ok):
# both preconditions AND-ed into the energization permissive
return cryo_ok and vac_okFail-closed on ambiguity
- A stale or lost cryo/vacuum sensor reads as not-permissive, closing the interlock.
- A warming magnet or rising pressure trips toward de-energization before limits are reached.
- Recovery is deliberate: interlocks re-open only when good conditions are re-established and confirmed.
The two systems sit on different timescales and are guarded accordingly. A cryogenic excursion usually develops slowly enough for a supervisory response that ramps the machine down in an orderly way, so its interlock is backed by trend monitoring that acts before a hard limit is reached. A vacuum breach can be fast, so its permissive lives in the reflex tier and trips immediately. Both, however, share the same fail-closed rule: absence of a good reading is treated as a bad reading. Recovery from either interlock is deliberate rather than automatic — permissives re-open only when good conditions are re-established and confirmed — so a machine is never brought back up on the assumption that a transient has passed without evidence that it has.
Cryo loss is often slow enough for a supervisory response, but a rapid vacuum breach is fast, so the vacuum interlock sits in the reflex tier. Both feed the energization gate that also depends on quench status and dump-armed status, making energization conditional on the full safety context, not any single check.