Escalation and On-Call Workflows
How an unattended or ambiguous condition finds the right human fast — and how the interface makes escalation the easy, recorded default.
Getting the right human, quickly
Not every condition needs the whole control room, and not every condition can wait for the next scheduled review. Escalation workflows route a condition to the appropriate responder — plasma physicist, magnet engineer, tritium specialist — based on what the anomaly touches, with a clear, time-bounded path if the first responder does not engage. The design bias is that escalating should be easier than not escalating.
Escalation triggers
- A high-priority alert unacknowledged past its response window
- A model going out of distribution on a safety-relevant loop
- An override that touches the safe operating envelope
- A degraded-diagnostic condition that thins a critical estimate's provenance
- Operator-initiated: any crew member can escalate with one action
Routing is by domain. A REBCO quench-margin excursion at the breeder's 16.84 T peak field pages the magnet engineer; a burner ambipolar-potential anomaly pages the mirror-confinement physicist; a tritium-accountancy flag pages the tritium specialist. The on-call schedule is part of the system, so the interface knows who to reach and shows the operator that contact is in progress rather than leaving them wondering.
Acknowledgement and dead-man behavior
Escalations carry acknowledgement deadlines. If the primary on-call does not acknowledge within the window, the escalation automatically widens to the secondary and then the session leader — a dead-man pattern so a single unreachable person never strands a condition. All of this is recorded: who was paged, when, when they acknowledged, and what they did. The control room always sees the live escalation state on the shared picture.
Escalation is deliberately consistent with the trust hierarchy: it brings more human judgment to bear, never less. It feeds from the ranked triage stream, reaches responders through mobile access, and is preserved in the audit record.