Exception Handling and Graceful Degradation
A robust control system degrades gracefully, falling back to simpler safe behavior when a sensor, actuator, or computation fails.
Faults are expected
Over many discharges, sensors drift, actuators trip, and computations occasionally overrun. A control system that assumes perfect components will fail hard the first time reality departs from the assumption. Robust design treats faults as expected inputs and defines what the system does for each.
Graceful degradation
Graceful degradation means losing capability in proportion to the fault rather than all at once. If one magnetic sensor fails, the state estimator drops it and continues with the rest. If a whole diagnostic is lost, the affected controller switches to a simpler model-based estimate. Performance falls, but control is retained rather than lost.
Watchdogs and fallbacks
Watchdog timers detect a controller that stops responding and switch to a pre-defined safe output or a simpler backup controller. The backup is intentionally less capable but more trustworthy: it might just hold position and ramp the plasma down. The goal is always to reach a safe state, not to keep performing.
Designing the fallback ladder
- Full performance with all systems healthy
- Reduced performance with a degraded actuator or sensor
- Safe holding mode with core stabilization only
- Controlled termination
- Protective shutdown as the final rung
In the Kronos program
For the Hyperion breeder, the fallback ladder always keeps vertical stabilization alive as long as possible, because losing it is the fastest path to a disruption. Each rung is designed so the transition to it is smooth and its behavior is fully analyzable. The ladder is exercised against injected faults in the flight simulator.