Diagnostics and Sensor FMEA

When the instruments that watch the plasma fail, the control stack can be blinded - so sensors get their own failure analysis.

The blindness problem

Every control and protection loop depends on diagnostics: magnetic probes, interferometers, bolometers, thermocouples, neutron detectors. A sensor failure is doubly dangerous because it can be silent and because it can make a fault elsewhere invisible. Diagnostics therefore get their own FMEA, focused on detectability of the sensor fault itself.

• Dropout: sensor stops reporting - relatively easy to detect (missing heartbeat)
• Bias / drift: sensor reports plausibly wrong values - hard to detect
• Saturation: sensor pinned at range limit during a transient
• Latency spike: data arrives too late for its loop deadline
• Common-mode: shared power or fabric fails many sensors at once

Drift is the worst

A slowly drifting sensor is the highest-detection-difficulty mode: values stay in-range and plausible while diverging from truth. The defense is redundancy and cross-checking - comparing a measurement against an independent sensor and against the twin's prediction. Disagreement beyond tolerance flags the sensor, not the plant.

def sensor_trust(meas, redundant, twin_pred, tol_r, tol_m):
    disagree_r = abs(meas - redundant) > tol_r
    disagree_m = abs(meas - twin_pred) > tol_m
    if disagree_r and disagree_m:
        return 'suspect'     # this sensor likely wrong
    if disagree_r ^ disagree_m:
        return 'watch'
    return 'trusted'

Graceful blindness

When a sensor is declared suspect, the twin supplies a virtual measurement so control degrades gracefully rather than tripping. This is the core of sensor fusion and graceful degradation. Common-mode failures of the sensing fabric are treated as a plant fault, not a sensor fault, and route to failover.