Plasma Shot State Machine

The formal state machine behind a breeder shot, its guarded transitions, and the invariants each state must hold.

L4 · Orchestration — its place in the stack (left, click any layer) and its internal components (right). Telemetry rises; control descends.

Formalizing the shot

The breeder (Hyperion) shot is expressed as an explicit finite state machine whose transitions are guarded by measurable conditions and whose states each carry an invariant that must hold for the duration. Formalizing it this way makes the procedure analyzable, replayable, and testable against the twin before hardware exists.

States and invariants

state x invariant

100110111110100

Reading the matrix rows as PUMPDOWN, FIELD_RAMP, FLATTOP, RAMP_DOWN, RECOVERY against columns (vacuum-ok, field-armed, plasma-present): each state asserts its required invariants continuously, and violation triggers transition to SAFE_ABORT.

Guarded transitions

python

T = {
 ('PUMPDOWN','FIELD_RAMP'):  lambda s: s.base_pressure_ok,
 ('FIELD_RAMP','FLATTOP'):    lambda s: s.i_p_A >= 9.66e6*0.98 and s.delta <= -0.30,
 ('FLATTOP','RAMP_DOWN'):     lambda s: s.diag_window_done or s.plan_end,
 ('*','SAFE_ABORT'):          lambda s: s.fault or s.envelope_violated,
}

Invariants reference the design point

FLATTOP asserts plasma current near the 9.66 MA design value and shape at negative triangularity delta -0.30.
Field states assert on-axis field toward 8 T with peak conductor field within the 16.84 T rating.
Every state asserts the safety envelope holds; violation forces SAFE_ABORT.

Determinism

The state machine advances only on recorded events, so a shot is fully replayable. Faults route to the shared abort path, which coordinates with disruption mitigation and quench abort depending on the fault class.

Why formalize rather than script

Expressing the shot as an explicit guarded state machine, rather than an imperative script, makes three properties checkable by construction: no two states drive the same actuator, every state has a defined exit and a defined abort, and no transition can fire unless its guard evaluates true against measured state. A scripted sequence hides these properties in control flow; the state machine exposes them for review. The transition table and invariants are version-controlled and pass through the same replay regression gate as any other orchestration change, so a modified shot definition must reproduce approved past shots before it can run on the breeder.