GNN Imputation of Dropped and Degraded Signals

When a diagnostic channel drops out or saturates, the sensor-topology GNN reconstructs it from physically neighboring sensors so control never runs blind.

The failure mode L3 must survive

In a high-field, high-neutron-flux environment, analog channels degrade: a cryo-rated vacuum feedthrough develops noise, an ECE channel saturates during a transient, a Mirnov coil clips, or an interferometer loses fringe count. If control treated each channel as independent, a single dropout would blind a state estimator. Kronos instead treats reconstruction as a graph inference problem: the GNN is trained to predict any node's true value from its neighbors.

Training objective

During training, random nodes are masked (dropout, additive noise, saturation are all simulated) and the network is penalized on reconstruction error at the masked nodes plus a physics-consistency term. The masked-autoencoder objective forces the embedding to carry enough neighborhood physics to regenerate a channel from context.

# masked node reconstruction with physics consistency
L = 0
for v in masked_nodes:
    L += (x_hat[v] - x_true[v])**2            # data fit at masked node
L += lam_phys * residual_flux_surface(x_hat)   # e.g. chord/Thomson agreement
L += lam_smooth * graph_laplacian(x_hat)       # spatial smoothness on E

At inference, a validity flag from L2 tells the GNN which nodes are trustworthy; untrusted nodes are treated as masked and imputed. The imputed value ships with an uncertainty estimate derived from the local edge weights and neighbor agreement, so downstream MPC can widen its safety margins when it is operating on reconstructed rather than measured data.

Why it is safe

Imputation is advisory, never authoritative for protection. The L1 autonomous hardware failsafe that dumps a quench does not depend on GNN output; it reads raw hardware signals. The GNN keeps the twin and MPC coherent through transient dropouts, but if too many neighbors of a node are invalid, the imputation confidence collapses and L3 flags a degraded-observability condition rather than fabricating a plausible-looking value. This honesty about observability is a design requirement, not a nicety.