Exception Handling in Control
How the stack detects off-normal conditions and branches to pre-validated recovery or termination rather than improvising in a crisis.
Planning for the unplanned
Real discharges deviate from plan: a sensor drops out, an actuator saturates, a mode appears, a diagnostic disagrees. Exception handling is the structured way the stack responds to these off-normal events. The principle is that responses are designed and validated in advance, so that in the moment the system selects a known branch rather than inventing one.
A hierarchy of responses
- Nuisance: log and continue (a noisy sensor, a brief dropout)
- Adapt: adjust the scenario to restore margin (soften a ramp, cut fueling)
- Recover: switch to an alternate branch that returns to a safe regime
- Terminate: execute a controlled ramp-down to end the discharge
- Protect: trigger mitigation or the reflex layer to safeguard the machine
Detection
Exceptions are detected by consistency checks and monitors distributed across layers: state-estimation confidence, actuator-headroom limits, disruption-predictor alarms, diagnostic cross-checks, and watchdogs on loop timing. Each monitor maps its condition to a defined severity, which selects the appropriate response tier.
Fail toward safety
When the stack cannot determine the right adaptive response, it escalates toward the safer, simpler action - a controlled termination - rather than continuing on a plan it can no longer trust. The design bias is that an unnecessary safe shutdown is a nuisance, but a missed one can damage the machine.
Every exception teaches
Handled exceptions are logged in full - trigger, state, chosen branch, outcome - and reviewed. Recurrent exceptions signal a scenario or model that needs revision. Exception handling is thus both a real-time safety mechanism and a feedback source for improving the stack between discharges.