Breeder Disruption Mitigation Reflex

When a disruption becomes unavoidable, the breeder reflex converts it from an uncontrolled event into a mitigated shutdown within the plasma's own timescale.

Avoid, then mitigate

On the breeder (Hyperion), a D-T spherical tokamak at 9.66 MA plasma current and 85.0 MW fusion power, a disruption is the loss of plasma control that dumps thermal and magnetic energy into the vessel and coils. The control strategy is two-stage: the supervisory tier avoids approaches to instability, and when avoidance fails, the reflex tier mitigates — it deliberately terminates the plasma in a controlled way rather than letting it disrupt uncontrolled.

The mitigation trigger

Mitigation fires on a small set of fast, robust precursors combined so that any one strong indicator, or several weak ones together, arms the injectors. The decision is intentionally simple and biased toward acting: a mitigated shutdown is recoverable; an unmitigated disruption at full current is not.

def arm_mitigation(locked_mode_amp, n1_growth, vde_flag, thresholds):
    strong = (locked_mode_amp > thresholds['locked'] or vde_flag)
    weak_sum = (n1_growth > thresholds['n1'])
    # bias to act: any strong precursor, or accumulating weak ones
    return strong or weak_sum

def mitigation_deadline(current_quench_time_s, safety_factor=3):
    # injection must complete well inside the natural quench time
    return current_quench_time_s / safety_factor

The whole precursor-to-injection chain must fit inside the physical time the disruption gives — see precursor-to-actuation latency. The injectors themselves and their timing are covered in massive gas / pellet injection timing.

The trigger logic is deliberately biased toward acting, because the two outcomes are asymmetric: a mitigated shutdown sacrifices a pulse and requires a recovery sequence, while an unmitigated disruption at 9.66 MA can load the vessel and coils near their structural limits. Kronos therefore accepts a rate of precautionary mitigations that terminate healthy-looking pulses, treating those false positives as a small, accepted penalty that guarantees the true positives are always caught in time.

Mitigation trades a lost pulse for a protected machine. It also feeds the halo and eddy current limits and runaway electron suppression paths, since a well-mitigated shutdown is what keeps those secondary hazards inside their envelopes. This is a design-and-simulation capability being validated ahead of first plasma.