Plasma Copilot: Breeder Disruption-Avoidance Advising

The copilot watches the twin's disruption precursors and margins, explains why risk is rising, and proposes avoidance moves — while fast mitigation stays in hardware.

Advising, not triggering

Disruption mitigation on the breeder (Hyperion) — massive gas or shattered-pellet injection, current quench management — is a microsecond-to-millisecond hardware function owned by L1 and the autonomous failsafe. The Plasma Copilot works one tier up on the seconds timescale: it interprets the anomaly ensemble's precursor flags, explains the physics of the rising risk, and advises the operator on avoidance moves before the fast layer must act.

What the copilot reasons over

It ingests the L3 anomaly-ensemble disruptivity estimate, locked-mode and n=1 amplitudes from Mirnov coils, radiated-power fraction, density-limit proximity (Greenwald fraction), and vertical-stability growth rate, all as forecasts from the twin's predictive shadow. It correlates the current trajectory against retrieved prior disruptions with similar signatures.

advise(state):
  d_hat = anomaly_ensemble.disruptivity(state)      # 0..1, with UQ
  drivers = attribute(d_hat)   # e.g. {locked_mode, n_G proximity, li}
  if d_hat > warn_thresh:
     options = retrieve_avoidance_moves(drivers)    # RAG over shot db
     rank options by twin.simulate(move -> margin_gain)
     return explain(d_hat, drivers, options)        # human decides
  # fast mitigation path is NOT here - it lives in L1 hardware

Typical avoidance advice

• Reduce density toward a safer Greenwald fraction via fueling adjustment
• Apply resonant-magnetic-perturbation or ECCD to suppress a growing locked mode
• Soften the current ramp or lower betaN toward the certified-stable band
• Recommend a controlled ramp-down when margin cannot be recovered inside the envelope

Every piece of advice is accompanied by the twin-predicted margin gain and its uncertainty, and by the precursor evidence that motivated it. The operator, not the copilot, chooses; if the situation crosses the hardware thresholds first, the failsafe acts regardless of the copilot. This separation is deliberate — see refusal and escalation and human oversight. Because the breeder is unbuilt, the advisor is validated against the twin's disruption simulations.