Graceful Degradation

When full service is impossible, deliver reduced service safely instead of tripping - the primary lever against the availability gate.

Partial beats off

A trip converts any fault into full downtime; graceful degradation converts many faults into reduced-but-continued service. Because the burner faces a 0.86-0.995 availability envelope against a 0.99982 Tier III target, degradation is the single most important resiliency lever: every fault kept out of the trip column protects the number. The principle is to shed capability in a defined order while staying inside every safety limit.

Degradation ladder

Each rung is a defined operating point with its own control law and limits, not an ad-hoc reaction. The controller descends one rung at a time when a trigger fires and climbs back when the twin confirms the condition cleared.

LADDER = ['nominal','derate1','derate2','derate3','hold','safe']
def degrade(cur, twin):
    i = LADDER.index(cur)
    if twin.limit_reached():   return 'safe'
    if twin.limit_near():      return 'hold'
    tgt = twin.recommended_rung()          # 0..len-1
    step = 1 if tgt > i else (-1 if tgt < i and twin.recovered() else 0)
    return LADDER[max(0, min(len(LADDER)-1, i+step))]

Machine-specific ladders

The breeder can often drop to a lower-current, lower-power shot rather than aborting a campaign. The burner, holding a continuous regime near the stressed 26.49 T plug, degrades by backing off toward a lower-confidence conservative hold rather than pushing the coil. Degradation ties directly to degraded-mode power scheduling and never overrides safe-state logic.