Measuring and Controlling the Burn

Abstract

A burning plasma is only partially observable. Diagnostics view line-integrated light, magnetic fields, neutrons, escaping particles, surface temperature, pressure, and other consequences of an evolving three-dimensional state. Neutrons, heat, limited ports, coating, and maintenance gradually degrade those views. I develop a layered control architecture that separates measurement, calibrated inference, routine control, supervisory recovery, and independent machine protection. Models and machine learning can compress data and predict instabilities, but their uncertainty and domain of validity remain visible. Fast magnetic control, heating, fueling, impurity seeding, exhaust, and mitigation systems receive explicit response budgets. The objective is a plasma that can be entered, held, perturbed, recovered, and terminated while the plant knows why each action was taken.

The plasma is reconstructed from consequences

No instrument can place an ordinary probe in the hundred-million-degree core and remain there. Diagnostics infer the state from radiation, fields, particles, and interactions. Each method observes a projection.

Magnetic coils measure changing fields and help reconstruct plasma position, shape, current, and stored energy. Interferometry estimates line-integrated electron density. Thomson scattering measures local electron temperature and density at sampled points. Spectroscopy reveals temperature, flow, isotope, and impurity information. Neutron detectors estimate fusion rate and spatial behavior. Bolometers measure radiated power. Infrared cameras observe plasma-facing temperature. Reflectometry probes density layers. Motional Stark effect and related methods constrain internal magnetic structure.

The challenge is not a shortage of signals. It is converting signals with different spatial coverage, latency, calibration, uncertainty, and lifetime into a coherent state quickly enough to act.

Observability must survive a nuclear environment

ITER anticipates a large diagnostic suite because no single technique covers all required quantities. A power plant has less port space and a harsher lifetime environment. Neutrons alter detector materials and electronics. Windows darken. Mirrors erode or acquire deposits. Cables and insulation age. Mechanical alignment changes during bakeout and electromagnetic events.

I assign each safety-significant state variable at least two independent evidence paths where practicable. Diversity matters. Two identical optical channels can fail together when a common mirror coats over.

State	Fast evidence	Independent or slower evidence
Plasma position and shape	Magnetic sensors	Imaging, reflectometry, equilibrium consistency
Density	Interferometry	Reflectometry, spectroscopy, particle balance
Fusion power	Neutron flux	Fuel burn balance, gamma and charged-particle diagnostics
Divertor heat load	Infrared thermography	Embedded thermometry, cooling calorimetry
Current profile	Magnetic and polarimetric inference	Model constrained by actuator and kinetic data
Impurity radiation	Bolometry	Spectroscopy and core-temperature response

Estimation makes uncertainty operational

I represent the plant and plasma by

$$\dot{\mathbf{x}}=f(\mathbf{x},\mathbf{u},\mathbf{d})+\mathbf{w}, \qquad \mathbf{y}=h(\mathbf{x})+\mathbf{v},$$

where $\mathbf{x}$ is the state, $\mathbf{u}$ the commanded actuators, $\mathbf{d}$ disturbances, $\mathbf{y}$ measurements, and $\mathbf{w}$ and $\mathbf{v}$ process and measurement uncertainty.

A state estimator combines the model and measurements. Its output includes a covariance or other confidence measure. If several diagnostics disappear, the estimate may remain numerically smooth while its uncertainty grows. Control limits should tighten as confidence falls.

Sensor plausibility checks use conservation laws and cross-domain evidence. A reported cooling-flow increase should agree with valve position, pump behavior, temperature response, and power balance. A neutron-rate change should correspond with fuel, temperature, and stored-energy changes. Residuals reveal failed instruments and incomplete models.

Control operates on several clocks

Vertical instability can require action within milliseconds. Magnetohydrodynamic modes may evolve over milliseconds to seconds. Density, temperature, current profile, wall inventory, and component temperatures evolve over longer periods. Maintenance trends span months or years.

The architecture separates loops by timescale:

1. Local equipment loops regulate current, voltage, flow, pressure, and source power.
2. Fast plasma loops control position, shape, selected modes, and actuator protection.
3. Scenario control manages density, temperature, current profile, radiation, and exhaust.
4. Supervision predicts limit approach and selects recovery or controlled termination.
5. Machine protection acts independently when predefined safety thresholds are crossed.

These layers exchange status but retain bounded authority. A high-level optimizer cannot inhibit a hard protection trip merely because its model predicts recovery.

Control authority is a finite budget

For a linearized operating region,

$$\Delta\dot{\mathbf{x}}=A\Delta\mathbf{x}+B\Delta\mathbf{u}.$$

The matrix $B$ describes how actuators influence the state near that point. Saturation, delay, rate limits, and failed channels shrink the reachable region. A stable operating point with every actuator near its limit is fragile.

I track control reserve: remaining coil voltage, heating range, pellet rate, impurity flow, pumping capacity, and mitigation readiness. Alarms refer to the time until reserve vanishes, not only the current deviation.

For example, vertical control needs voltage to change coil current quickly. A coil at current limit may still be physically healthy yet unable to counter the next disturbance. State and capability belong in the same display.

Machine learning needs an assurance envelope

Learning systems can detect patterns in high-dimensional diagnostic data, build fast surrogates for slow physics models, forecast disruptions, and optimize scenarios. Their usefulness is greatest where deterministic calculation cannot finish within the control interval.

I separate advisory, supervisory, and protection roles. An advisory model ranks risk and recommends action. A supervisory model can command bounded actuators within a verified envelope. Independent protection remains deterministic, diverse, and simple enough to validate.

Every model has a version, training record, input-quality requirements, uncertainty behavior, and monitored domain. Operation outside its supported domain causes graceful reversion rather than confident extrapolation. Counterfactual testing asks whether the model relies on a physical precursor or a facility-specific artifact.

Recovery is a designed trajectory

When the state approaches a limit, the plant needs more options than continue or terminate. It can reduce density, lower auxiliary power, adjust shape, move strike points, increase radiation, suppress an island, alter torque, or transition to a lower-performance scenario.

Model-predictive control can choose a sequence by minimizing

$$J=\sum_{k=0}^{N}\left[(\mathbf{x}_k-\mathbf{x}^*)^TQ(\mathbf{x}_k-\mathbf{x}^*)+\mathbf{u}_k^TR\mathbf{u}_k\right]$$

subject to state and actuator constraints. In practice, the constraints are the heart of the problem. The controller must keep heat flux, density, current, wall temperature, magnet voltage, and fuel inventory within bounds while returning to a known state.

SenseAcquire diverse physical evidence

Preserve calibration, timing, quality, and raw data for every channel.

InferEstimate state and uncertainty

Fuse diagnostics with models while exposing lost observability.

ControlUse bounded actuator authority

Regulate the operating point and recover before limits are crossed.

ProtectTerminate independently when required

Retain simple, diverse, validated paths outside optimization software.

The control room preserves causality

Operators need an event timeline that connects measurement, estimate, decision, command, equipment response, and plasma response. Every timestamp shares a qualified time base. Automated actions display their reason and limiting condition. Replay tools can reproduce a discharge with the exact model and configuration versions used at the time.

Commissioning begins with simulated signals and hardware-in-the-loop plants. Controllers then operate low-energy plasmas, deuterium campaigns, and progressively higher fusion performance. Fault injection removes sensors, delays networks, biases calibrations, saturates actuators, and creates inconsistent data.

ObserveAcquire and qualify signals EstimateReconstruct state with uncertainty DecideOptimize inside verified constraints VerifyConfirm response and update models

Even perfect control cannot erase contact between plasma and matter. Particles, photons, and heat eventually reach the first wall and divertor. Those surfaces define the practical boundary between a successful discharge and a maintainable plant.