Safety Interlocks and Machine Protection
The independent protection system that guards the machine regardless of what the control system is trying to do.
Protection versus control
Control tries to make the plasma do something useful; protection makes sure the machine survives whatever the plasma or the control system does. These are separate concerns and, in a well-designed stack, separate systems. The protection system watches hard limits and acts to safeguard hardware even when - especially when - the control system is misbehaving.
Independence is the point
A protection system that depends on the same computers, sensors, or logic as the controller can fail with it. So interlocks are built independent: separate sensors on critical parameters, separate logic (often hard-wired or in dedicated FPGAs), and the authority to override control commands. Independence is what lets protection be trusted when control cannot be.
What interlocks protect
- Superconducting magnets against quench and overcurrent
- Power supplies against fault currents and voltages
- Plasma-facing components against excessive heat loads
- Vacuum, cooling, and cryogenic systems against limit violations
- The whole machine against a control system that has lost the plasma
Fail-safe design
Interlocks are designed to fail safe: on loss of signal, loss of power, or ambiguity, they take the protective action rather than assume all is well. A tripped interlock ending a discharge is a nuisance; an interlock that failed to trip can be a catastrophe. The asymmetry is deliberate and drives the design toward caution.
Relationship to the control layers
The reflex layer of the control stack and the machine-protection system overlap in spirit - both are fast, simple, and safety-first - but protection sits outside and beneath control, as an independent backstop. The control stack's job is to operate so well that the protection system rarely needs to act.