Control & operations

Access control governs who can read or change data; anonymization removes identifying detail so data can be shared more openly.

Access-control models decide whether a principal may perform an action on a resource, from coarse role grants to fine-grained attribute rules.

The control room must work for every operator on every shift: redundant encodings, sufficient contrast, and legibility that does not depend on color vision.

Every candidate action passes a fixed, ordered sequence of independent checks; any stage can reject, and rejection is the default.

Both machines have more actuators than control objectives; Kronos's MPC allocates effort across coils, heating, fueling and DEC to meet goals with margin.

When multiple controllers request the same actuator, L1 arbitrates by fixed priority so protection always outranks optimization.

Before an actuator can be trusted in a loop, its real response, limits, and quirks must be measured and modeled.

Actuators turn control commands into physical action; the interface must convert, amplify, and safely drive them while confirming what actually happened.

Mapping many competing control demands onto a limited set of shared, constrained actuators without violating hardware limits.

Every actuator has limits; managing saturation keeps a loop stable and honest when it runs out of authority.

Many control goals compete for the same limited actuators; allocation decides who gets them, when, and how much.

Many control goals compete for the same limited actuators, so an arbitration layer allocates them by priority and respects hard limits.

Adaptive controllers adjust their own parameters online as the plant changes, maintaining performance without a fixed model.

The adjoint (dagger) is the conjugate transpose; Hermitian operators equal their adjoint, unitary operators have adjoint as inverse.

The Kronos AI-native control architecture — eight layers (L0-L7), a four-phase build with Phase 1 complete, an owned GPU HPC fleet, a 50-100ms predictive shadow, and a hardware-enfor

The safety and control core is air-gapped from routable networks; the rare crossing to update a model or policy is a deliberate, two-person, fully logged event.

During an upset one root cause can trigger hundreds of correlated alarms; suppression logic collapses them so the operator sees the cause, not the cascade.

Applying established alarm-management principles so every alarm is meaningful, prioritized, and actionable — never a wall of noise an operator learns to ignore.

Turning anomaly detections, precursors, and interlock events into a ranked, deduplicated, actionable stream an operator can work top-down under pressure.

The electrostatic potential profile confines the burner's central cell; L1 regulates the ambipolar potential through plug conditions to hold axial confinement.

Shared, persistent annotations let the crew point at the same thing, capture judgment, and hand off context across shifts and between control room and mobile.

A shared timeline that shows precursors emerging, growing, and resolving — turning the anomaly ensembles' outputs into a story an operator can read.

Catching the fault you did not enumerate - unsupervised detection of behavior the plant has never shown before.

Unsupervised models learn normal behavior of machine subsystems and flag deviations that may signal faults before they cause failures.

No single detector is reliable enough for safety-relevant precursors, so Kronos combines reconstruction, density, and forecasting detectors into a calibrated ensemble.

Anti-windup schemes prevent an integrator from accumulating error while the actuator is saturated, avoiding large overshoot and sluggish recovery.

The invariants every design decision must respect — separation of latency classes, physical safety floor, bounded intelligence, and traceable data.

The field of building systems that perform tasks normally requiring human intelligence, from perception to reasoning and control.

A structured claims-to-evidence safety argument, and a tamper-evident record of every decision.

Every operator action, alert, override, and model version is recorded in an attributable, tamper-evident timeline that supports regulators, reviews, and trust.

When a consumer cannot keep up, the system slows producers or sheds non-critical load instead of dropping safety-relevant events.

The fabric manages telemetry flow so a burst never drops safety-critical data, prioritizing channels and applying backpressure to the rest.

Backstepping builds a stabilizing nonlinear controller recursively, treating intermediate states as virtual controls step by step.

Beyond the reactor core, a fusion plant needs cooling, power distribution, and auxiliaries, all coordinated by a plant-wide control system.

Cutting or notching neutral-beam power within microseconds removes drive from an evolving instability, a fast reversible protection actuation on both machines.

Embedding a non-unitary operator as a sub-block of a larger unitary, the interface that modern simulation algorithms are built on.

Breakdown is the moment the gas becomes a plasma; control must reliably initiate and grow the discharge from nothing.

The operator surface tuned to the spherical tokamak's hard problems: equilibrium reconstruction, the ELM-free negative-triangularity shape, and disruption avoidance.

For Hyperion, the spherical-tokamak challenges are equilibrium, holding the negative-triangularity ELM-free shape, and disruption avoidance.

When a disruption becomes unavoidable, the breeder reflex converts it from an uncontrolled event into a mitigated shutdown within the plasma's own timescale.

For Hyperion, each control objective is a chain from a diagnostic set to a physical actuator, with the twin and MPC in between.

One tokamak shot from arming to post-shot analysis, and the control decisions the stack makes in each window.

A buffer passes its input to its output unchanged, restoring signal strength and adding controlled drive or delay.

For the tandem mirror, the challenges are end-plug density, the ambipolar potential, and steering charged particles into the direct-energy-conversion train.

The burner's control problems live in the end plugs — density and ambipolar potential — and this telemetry set is where the fabric watches them.

The burner's end-plug confinement rests on operating conditions far beyond any built device; the reflex supervisor treats every plug excursion as a hard limit, not a setpoint to ch

For the burner (Aegis / MetroVolt), the control chains center on the end plugs, the ambipolar potential, and the direct-energy-conversion train.

The three- and four-control NOT gates, the small fixed cases of the multi-controlled X most often synthesized directly.

The calculus of variations finds functions that minimize integral cost functionals, the mathematical foundation of optimal control.

A canary policy gains narrow, bounded authority — small setpoint deltas inside tight envelopes — that widens only as monitored performance holds, with instant revert on breach.

A carry-save adder sums three numbers into two without propagating carries, deferring the single slow carry step until the very end.

Cascade control nests a fast inner loop inside a slower outer loop so the inner loop rejects disturbances before they reach the primary variable.

Checkpointing periodically saves a job's state so that after a failure it can restart from the last save rather than from the beginning.

How long-running Kronos simulations and training runs survive node failures without losing days of compute.

Why disruptions and other rare plasma events break naive accuracy, and how to train and evaluate honestly around them.

Closing a design point means every physics, engineering, and safety constraint is satisfied by one consistent set of parameters at the same time.

HPC runs both on dedicated on-premises clusters and in the cloud; each fits different needs for scale, latency, cost predictability, and control.

A second reader catches faults that authors are blind to, and turns private correctness into shared, defensible correctness.

Fast switching supplies drive the coil currents both machines depend on; L1 controls their switching deterministically to deliver clean, bounded current.

One disciplined, colorblind-safe color system across every operator surface so a color always means the same thing and alerts are never lost.

Every command carries a scoped, short-lived, single-writer token; actuators reject anything unsigned or out of scope.

Before a safety layer guards a real plasma it is proven by fault injection in hardware-in-the-loop, so the failsafe is validated against faults, not assumed to work.

Producing the traceable, reproducible analyses a regulator needs to evaluate a plant's safety case.

Modeling what happens when a superconducting magnet loses superconductivity, so the stored energy is dumped safely.

Modeling what could go wrong, how likely it is, and what the consequences would be, to show the plant is safe by design.

Regulators require evidence, not assertion; computation produces the traceable analyses and records that a licensing case is built on.

The ratio of largest to smallest curvature controls how fast first-order methods converge and why ill-conditioned problems crawl.

A confounder is a hidden common cause that fakes a relationship; controls are the methods that strip its influence away.

A context switch saves one task's processor state and restores another's; its cost and predictability directly affect real-time timing budgets.

Real-valued action spaces demand methods that output continuous commands rather than choosing from a discrete menu.

The hardware the control stack can command - coils, power supplies, heating, current drive, and fueling - and each one's character.

Control allocation distributes a commanded virtual control among redundant actuators, respecting their limits and secondary objectives.

The mathematics of distributing control demands across redundant, constrained actuators - pseudo-inverses, weighting, and optimization.

Kronos's safety architecture is layered defense: bounded reflex, hardwired interlocks, an ML-independent failsafe, and human oversight, each able to hold the line alone.

Racks of fast digital-to-analog and analog-to-digital hardware generate qubit pulses and digitize readout, synchronized to picosecond precision.

The latency budget accounts for every microsecond between a measurement and the resulting actuator response, and must fit inside the loop period.

The feedback basics - error, gain, stability, and bandwidth - that underlie every plasma control loop.

Decomposing the real-time path into sense, transport, infer, decide, actuate - and the fallback taken when any stage overruns.

Human factors design shapes displays, alarms, and procedures so operators make good decisions under time pressure and complexity.

Kronos grades each control function by the consequence of its failure and matches architecture, redundancy, and independence to that grade.

A feedback loop is stable only if it does not build up oscillations; phase and gain margins quantify how much delay or gain error it can survive.

A control system measures a plant, compares it to a target, and adjusts actuators to drive the difference toward zero.

A control system drives a physical process toward desired behavior by shaping its inputs based on goals and measurements.

The mathematics of steering dynamic systems toward desired behavior using feedback.

The control unit decodes instructions and generates the signals that steer the datapath through each step of execution.

Control variates reduce Monte Carlo variance by subtracting a correlated quantity whose expectation is known and adding it back.

A control loop must sense, compute, and actuate within its period every cycle; the choice of period couples timing engineering to control theory.

Loop period is not chosen by convenience; it is derived from the closed-loop bandwidth required to stabilize the fastest mode the loop must control.

Control-oriented models capture just enough physics to predict the input-output response controllers need, fast enough to run in real time.

The safety-critical control plane is isolated from general networks; only validated, one-directional interfaces cross into it, protecting deterministic operation.

Software that helps operators understand plant state and choose actions, without taking safety-critical control away from hard interlocks.

The physical arrangement of the video wall, operator consoles, and roles — designed so information reaches the right eyes at the right distance.

Proving that control and protection software behaves correctly across all conditions, including the rare ones that matter most.

A system is controllable if the input can drive its state from any starting point to any target in finite time.

Two structural properties defining whether a system can be fully steered and fully inferred.

Gramians quantify how strongly states can be reached by inputs and seen by outputs, grading the degree of controllability and observability.

Two structural properties that decide whether a plasma quantity can be driven by the actuators and inferred from the sensors.

The always-available path to a defined low-energy configuration - the floor beneath every other resiliency behavior.

Applies a phase only to the all-ones state of three qubits, the diagonal cousin of the Toffoli.

Conditionally places the target into an equal superposition, a controlled-U with U equal to the Hadamard.

Applies a real-valued Y-axis rotation to a target qubit conditioned on the control being in state one.

Imparts a Z-axis phase rotation on the target qubit conditioned on the control, related to but distinct from controlled-phase.

Kronos operates two very different confinement schemes with one control philosophy, sharing tools while respecting distinct physics.

Copilots report calibrated uncertainty drawn from twin UQ, retrieval quality, and self-consistency — so operators know how much to trust each answer.

Copilots live in the seconds-and-slower advisory regime, cleanly separated from the microsecond control path they never touch.

Deliberate adversarial cases probe for envelope-evasion, prompt injection, ungrounded confidence, and forbidden claims before they can reach operators.

Operator splitting advances coupled physics one process at a time, a simple scheme whose accuracy and stability depend on how the pieces are ordered and iterated.

Connecting a twin to the plant control system demands strict timing, safety isolation, and clear authority between advisory and active roles.

Transfer-learned disruption prediction from the world's tokamak databases.

Cryo-CMOS moves qubit control and readout electronics into the cold stages of the cryostat to cut wiring counts and heat loads as processors scale.

Every sensor and actuator wire crossing the cryostat or vacuum boundary passes a feedthrough; the interface owns integrity, isolation, and interlocks.

Cryogenics and vacuum are preconditions for high-field, high-confinement operation; their interlocks gate energization and default closed on any doubt.

Heat switches turn thermal contact on and off at low temperature, enabling multi-stage adiabatic demagnetization and controlled thermal isolation.

Controlling the current profile controls the safety-factor profile, which sets both stability and confinement in advanced scenarios.

The controlled-phase gate uses an avoided crossing with a non-computational level to imprint a state-dependent phase of pi.

The same data serves different audiences only through different views; matching depth, framing, and controls to the reader is the design task.

Where several deterministic tasks share a core, priority follows deadline; a schedulability test proves the fastest safety task always meets its deadline.

The burner's direct energy conversion couples the plasma to an electrical load; the reflex tier isolates load-side faults before they perturb the plasma.

L1 isolates a faulted collector stage within the deterministic window so the direct-conversion train keeps running through single-stage upsets.

Layered controls ensure that the failure of any single defense does not lead to compromise, because an attacker must defeat several in sequence.

Independent layers with diverse failure modes multiply reliability; the safety case rests on the product of layer failure probabilities, not any single number.

A trip is only as good as the state it trips to; each machine has an explicitly defined, benign resting state that every failsafe path drives toward.

Attacks that overwhelm or exhaust a system to make it unavailable, threatening the one security property control systems value most.

Density control regulates how many particles the plasma holds, using gas puffing and pellet injection against pumping and the density limit.

A density matrix is a positive operator of trace one that describes any quantum state, pure or mixed, including classical uncertainty.

Divertor detachment spreads exhaust heat over volume by radiation and neutral collisions; control holds the detachment front in a safe location.

When the plant departs from the twin's forecast, that gap is both a model-drift alarm and a physical anomaly signal.

Kronos's anomaly ensemble catches the earliest signs of a REBCO magnet quench, below the threshold that would trip protection, so the twin can act before a trip is forced.

Determinism is the property that a system's timing behavior is bounded and repeatable, so its worst case can be known before it runs.

Control traffic rides a time-triggered network where every frame has a scheduled slot, so communication latency is bounded and jitter is negligible.

PLC-enforced vacuum interlocks protect both machines' vessels by making unsafe valve and pump states physically unreachable.

The data pipeline moves diagnostic signals to the controllers with bounded, predictable latency, the nervous system of real-time control.

A side-by-side comparison of the two quantum-simulation paradigms across generality, error control, coherence, and near-term reach.

A DAC turns a numeric command into a continuous voltage or current, forming the output stage that lets a digital controller act on the physical world.

A digital twin runs a live model of the machine alongside the real one, supporting estimation, prediction, and validation of control actions.

Dirac notation writes quantum states as kets and their duals as bras, making inner products, outer products, and operators compact.

The high-voltage direct current from a direct energy converter must be conditioned and inverted into stable, standards-compliant electrical output.

A direct energy converter turns the kinetic energy of charged fusion products straight into electricity by decelerating them against a voltage.

Digital controllers act at sample instants, not continuously; discrete-time analysis captures the effects of sampling, hold, and computation delay.

Acting on early warning to steer the plasma away from a disruption while keeping the discharge alive.

Avoidance keeps the plasma away from the boundaries where disruptions occur, always preferred over cleaning up after one.

L1 arms and fires a graded response to disruption precursors on the breeder, from beam notching and shape trims to controlled ramp-down and mitigation.

Turning a disruption prediction into an action: steering the plasma away from the boundary or safely shutting it down.

When a breeder disruption becomes likely, the interface collapses to a single decision surface: time remaining, options, and the mitigation path — with hardware still authoritative

An end-to-end disruption warning system fuses diagnostics, a trained predictor, and a mitigation trigger under strict real-time latency budgets.

When a disruption is unavoidable, spreading the released energy safely and suppressing runaway electrons to protect the machine.

When a disruption cannot be avoided, mitigation spreads the energy release and suppresses runaway electrons to protect the machine.

When a breeder disruption is unavoidable, L1 fires mass or impurity injection on a deterministic trigger to radiate energy uniformly and spare the vessel.

Disruption codes simulate the rapid loss of confinement and current, predicting the thermal, electromagnetic, and runaway-electron loads a device must survive.

Disruption codes model the fast loss of plasma confinement, predicting the thermal quench, current quench, forces, and heat loads on the machine.

Mitigation only helps if the whole chain from precursor detection to material in the plasma completes inside the disruption's own growth time.

For Hyperion, the anomaly ensemble specializes in the magnetic and kinetic signatures that precede a tokamak disruption, feeding disruption avoidance.

A twin can watch for the precursors of a plasma disruption and forecast its onset in time for the machine to respond.

Prediction gives the control system advance warning of an approaching disruption so it can avoid or mitigate in time.

A disruption is a sudden loss of plasma confinement; predicting the precursors early enough to steer away from them is a core control task.

The breeder's fast-loop resiliency problem: predict a tokamak disruption early enough to soften it, at delta -0.30 and 9.66 MA.

Simulating how Hyperion loses control so the twin can recognize precursors and the failsafe can act before damage occurs.

When the twin predicts a breeder disruption, orchestration triggers a bounded mitigation sequence before the plasma terminates uncontrolled.

A code cannot maximize protection, efficiency, and locality at once, and where a family sits among these competing goals decides where it is useful.

Distributed control coordinates many local controllers, each using limited local information, to achieve a global objective without a central authority.

Correlation and causation IDs thread a single shot's activity across every service so latency and causality can both be reconstructed.

Disturbance rejection is a control loop's ability to hold the output near its target despite unwanted inputs, governed by the sensitivity function.

Derivative Removal by Adiabatic Gate adds a quadrature correction to a control pulse so that fast single-qubit rotations do not leak into higher levels.

Dual control balances two competing goals: controlling the plant well now and probing it to reduce uncertainty for better control later.

Controllability and observability are mirror images: each result about one becomes a result about the other by transposing the system.

Splitting a cross-resonance pulse into two halves separated by control pi pulses cancels several error terms and isolates the useful ZX interaction.

Economic MPC optimizes a general performance objective directly rather than tracking a setpoint, driving the plant toward the best operating regime.

Placing computation near sensors and actuators cuts latency and keeps control loops running independent of network and cloud availability.

Field-programmable gate arrays at the machine edge execute control logic in fixed clock cycles, giving cycle-exact, jitter-free actuation for both machines.

Some validation and feature extraction runs at the edge, near the machine, to cut latency and volume before telemetry travels to the archive and twin.

Electromagnetic codes compute induced currents and forces in conducting structures during field changes, essential for control and disruption loads.

Edge-localized modes are periodic edge bursts; control aims to make them small and frequent rather than large and rare.

The negative-triangularity edge suppresses edge-localized modes; L1 monitors edge conditions to keep the breeder in the ELM-free regime it was designed for.

A surrogate is only useful if its own error is bounded and propagated; emulator error control keeps the approximation honest.

The tandem-mirror burner confines the central cell with dense end plugs; L1 regulates plug density as the machine's primary confinement actuator.

The nested timescales the stack must respect, from sub-millisecond plasma control to multi-year campaigns, and how each loop is budgeted.

Ranking, deduplicating, and root-causing the anomaly flags raised by L3 ensembles so operators see prioritized, explained events rather than a raw alert stream.

Error rates quantify how often operations go wrong; their size relative to the fault-tolerance threshold decides whether error correction can work.

Detecting and cancelling small, unintended non-axisymmetric magnetic fields that can lock modes and trigger disruptions.

How an unattended or ambiguous condition finds the right human fast — and how the interface makes escalation the easy, recorded default.

Score a binary classifier that flags impending plasma disruptions, sweep the threshold, and build the ROC curve with its area.

Event-triggered control updates the control action only when a state-dependent condition signals that an update is needed, saving computation and communication.

The stack chooses delivery semantics per topic; safety-critical commands get effectively-once via idempotency, telemetry tolerates at-least-once.

A robust control system degrades gracefully, falling back to simpler safe behavior when a sensor, actuator, or computation fails.

How the stack detects off-normal conditions and branches to pre-validated recovery or termination rather than improvising in a crisis.

The scheduler allocates machine time by priority, preempts running work for safety, and prevents low-priority starvation.

Mechanistic explanations operators and regulators can audit — the "why", not just the confidence.

Explicit MPC precomputes the optimal control law offline as a piecewise-affine function of the state, replacing online optimization with a lookup.

Some L1 functions must fail into a safe state; others must keep operating through a fault. Kronos chooses per function based on which failure is worse.

When a system fails, it can default to the safe state or the secure state, and these are not always the same choice.

How control authority moves off a failed node, actuator, or model without losing the plant - redundancy that acts within a loop deadline.

Orchestration is partitioned into isolated failure domains so a fault in one subsystem cannot cascade into machine-wide loss of control.

Every anticipated fault maps in advance to a defined response and a defined safe state, so the reflex tier looks up the answer instead of computing it under duress.

Detecting that something is wrong, then locating which component - the FDI layer that every mitigation depends on.

When something goes wrong the plant must either ride through the disturbance or shut down safely in a controlled, predictable sequence.

Fault-tolerant design ensures that a single component failure causes at most one error per code block, so errors never cascade uncontrollably.

A fault-tolerant system keeps functioning despite component failures by detecting faults and switching to healthy resources without violating timing.

With millions of components, failures are routine; fault tolerance keeps long computations progressing despite hardware and software faults.

Encoding a fresh logical state must itself resist faults, or the errors introduced during preparation defeat the code before computation begins.

Measuring stabilizers without spreading a single ancilla fault into many data errors requires verified ancillas or flag qubits.

Feedback linearization cancels a system's nonlinearities with a change of coordinates and control, exposing linear dynamics for standard design.

A control arrangement where a system's output is measured and fed back to adjust its input.

Feedforward applies the planned command in advance; feedback corrects the difference between plan and reality. Good control uses both.

Feedforward acts on a measured reference or disturbance before it affects the output, complementing feedback's after-the-fact correction.

Feedforward uses a known plan or disturbance to command actuators in advance, leaving feedback to correct only the residual error.

Firmware and control artifacts are signed, version-monotonic, and delivered through the gated import path, so only authorized, non-rollback updates ever reach the machine.

In a cascade, showing the first alarm to fire and the inferred root cause turns a confusing flurry into an actionable diagnosis.

Flag-based syndrome extraction schedules a few ancilla qubits so that any harmful measurement fault is detected, keeping the effective distance intact.

Holding steady plasma conditions during the useful phase of a discharge, regulating current, shape, density, and profiles against drift.

Floyd-Warshall computes shortest paths between all pairs of vertices with a triple loop, in O(V^3) time.

Straight-field-line flux coordinates turn the tangled 3D field into simple geometry, and the safety factor q(psi) they yield is the master stability parameter for the breeder.

Each compute fabric has a place in Kronos: GPUs for offline training, CPUs for coordination, FPGAs for the timed control and protection paths.

A controlled swap of two target qubits, universal for reversible classical logic and central to the swap test.

A two-parameter fermionic-simulation gate that captures a tunable exchange plus a controlled phase in one native operation.

Each safety function gets an integrity target set by the severity and frequency of the hazard it prevents; higher targets demand more redundancy, coverage, and proof.

Gain scheduling controls a nonlinear plant by interpolating a family of linear controllers designed at fixed operating points.

Fast piezo servo valves meter fuel and impurity gas into both machines; L1 modulates flow deterministically for density control and edge management.

The GRU is a streamlined gated recurrent cell that merges the LSTM's memory and gating into fewer parameters with often-similar performance.

Multiplies the entire state by a phase factor, invisible on its own but consequential when placed under a control.

Record the output of a trusted run as a reference, then flag any future change from it; a blunt but powerful safety net.

Occupancy is the ratio of active warps on a streaming multiprocessor to the hardware maximum, a proxy for how well latency is hidden.

When full service is impossible, deliver reduced service safely instead of tripping - the primary lever against the availability gate.

The force-balance equation that underlies equilibrium reconstruction, and why its structure shapes real-time control.

On sub-second timescales the burner supports grid frequency through droop control and direct-energy-conversion-backed synthetic inertia, all bounded by the safe envelope.

The burner housings export firm, dispatchable power through direct energy conversion; L7 is the interface that makes that export legible and controllable to a grid.

A gyrotron is the high-power millimeter-wave source for electron cyclotron heating, and its operation depends on tight control of voltage, current, and field.

H-infinity control minimizes the worst-case gain from disturbances to errors, giving a systematic route to robust multivariable design.

H-infinity control minimizes the worst-case gain from disturbances to regulated outputs, delivering guaranteed robustness against bounded uncertainty.

H2 control minimizes the energy of the closed-loop response to white-noise or impulsive disturbances by minimizing a system's H2 norm.

A disruption drives halo and eddy currents through the vessel; the safety envelope caps the forces these can exert on the structure.

A control action is only correct if it is also on time; L1 treats deadlines as functional requirements with provable worst-case bounds.

A real-time system is judged by whether it meets deadlines, not by raw speed; the cost of a missed deadline separates hard from soft.

The choice between implementing control in fixed hardware or in software trades determinism and speed against flexibility and complexity.

Hardware-in-the-loop testing runs real control hardware against a simulated plant, validating the twin and controllers before the machine exists.

The interlock matrix expresses which states permit which actions in permissive logic that lives outside software, so no software fault can grant a forbidden action.

A watchdog turns silence into safety: any controller that stops proving it is alive causes a trip, so a hung process fails safe instead of failing quiet.

Heating power control modulates auxiliary systems to regulate temperature, stored energy, and profiles while respecting source limits.

A large helium refrigerator uses staged compression, heat exchange, and turbine expansion to reach a few kelvin, and each stage is actively controlled.

Aggregating large amounts of computing power to solve problems too big for a single machine.

Designing the fusion control room around the limits of human attention and working memory so operators stay effective during the worst minutes, not just the calm ones.

A qualified operator remains the decision authority for every side-effecting action; copilots inform and propose, humans approve and own.

Automation runs the fast loops, but humans set intent, supervise, and hold authority to intervene from the control room.

A hypothesis test asks whether data are surprising enough under a default assumption to reject it.

L1 sequences the cryogenic ICE-PISTON cycle that preloads the high-field magnets, keeping REBCO strain inside its envelope through cooldown and energization.

Industrial control systems supervise physical plant, and securing them means protecting integrity and availability of control, not just data.

Retries are inevitable on a distributed control plane; idempotency keys make a repeated write or command harmless.

Impurity control balances the radiation that protects walls against the core dilution and radiative collapse that too many impurities cause.

Every shot and every upset is fully reconstructable: synchronized telemetry, twin state, model confidence, alerts, and operator actions replayed on one timeline.

Turning every fault into a reproducible record and a durable lesson - the loop that makes the stack more resilient over time.

When an actuator saturates, an integrator keeps accumulating error, causing large overshoot; anti-windup schemes prevent this.

Commissioning brings the control system online in careful stages, proving each layer before the next depends on it.

The low-latency, high-bandwidth fabric that decides how far Kronos coupled solves and distributed training can scale.

The interconnect is the network binding compute nodes; its latency and bandwidth often decide whether a large simulation scales.

How laser interferometry provides the fast, reliable density measurement that closes the density-control loop.

Hardware interlocks are the last line of defense and act independently of software; orchestration integrates with them but never replaces them.

Machine-protection interlocks are implemented in dedicated hardware whose safe state is the default, so a failure denies rather than grants dangerous action.

Interlocks block dangerous actions and permissives allow safe ones; together they enforce that a system operates only within its safe envelope.

Understanding why a model made a prediction, which matters when physicists and operators must trust it.

Interrupts let hardware demand prompt attention; interrupt latency, the delay before the response begins, is a key determinant of real-time responsiveness.

Ion cyclotron systems heat plasma ions with tens-of-megahertz waves launched from in-vessel antennas, where coupling and matching dominate control.

Two ways to frame the shape-control problem: matching flux at boundary points, or moving a rigid outline.

Jitter is the variation in timing between cycles; even when average latency is fine, jitter degrades control quality and complicates timing proofs.

Kinetic control shapes the radial profiles of temperature, density, and rotation rather than just their scalar averages.

The Koopman operator recasts nonlinear dynamics as a linear evolution of observables, enabling linear tools on nonlinear systems.

Kraus operators give a concrete, computable representation of any quantum channel as a sum of one-sided products.

The L1 tier is Kronos's hard real-time layer: edge FPGAs and PLCs that convert model intent into microsecond-deterministic actuation for both machines.

Edge FPGA microsecond-determinism, hard real-time actuation, and the autonomous hardware failsafe.

Edge FPGAs enforcing sub-10-microsecond determinism, synchronized actuation gates, and the autonomous hardware failsafe that dumps a quench with zero AI dependency.

The breeder's highest-consequence event is a disruption; L3 is architected to avoid disruptions early rather than mitigate them late.

Negative triangularity offers an ELM-free edge, but only if the shape is held precisely; L3 makes that a continuous control guarantee.

The electrostatic potential that traps the burner's central-cell ions is what L3 must estimate and shape, a control target with no tokamak analogue.

Event streaming, the workflow engine, the rules engine & safety bounds, and human-in-the-loop routing.

Layer 6 is where operators see, trust, and act on everything the lower layers compute — for the breeder (Hyperion) and the burner (Aegis / MetroVolt).

The control-room 3D twin overlays, plant-floor SCADA, and mobile engineering.

Lambda and kappa are two blueprints for combining historical accuracy with real-time freshness in one analytical system.

The shared control-room display that carries the one common operating picture every role must agree on — legible across the room and resilient to failure.

Trapped ions, neutral atoms, and NV centers are controlled with laser light, using resonant, Raman, or Rydberg transitions to drive gates.

Operators must always know how fresh what they are looking at is; the interface shows data age and freezes rather than extrapolating when a feed stalls.

Why bounded, predictable timing matters as much as raw speed in a real-time plasma control system.

Each physical interface carries an end-to-end latency budget from sensor edge to actuator gate, and the budget decides where its loop can close.

A control loop is only useful if it finishes in time; the latency budget is the discipline that keeps every step inside its deadline.

Latency is the elapsed time from a stimulus to the completed response, and in control it must be measured end to end, not stage by stage.

The fastest control layer: microsecond trip lines and interlocks implemented in fixed logic that protect the machine without waiting on any software decision.

The orchestration layer coordinates twin predictions and copilot proposals into bounded, gated actions before anything reaches real-time control.

The layer that fuses raw diagnostics into a coherent, physically consistent estimate of the plasma state for every controller above it.

The slowest and highest layer: human operators who set intent, approve exceptions, and make the judgments no automated layer should make alone.

Three line styles classify every connection by latency class — so the diagram proves that a microsecond command never rides a batch path.

LPV control designs one controller for a family of linear models indexed by measurable parameters, guaranteeing performance across the whole operating envelope.

LQR computes the state-feedback gain that minimizes a quadratic cost trading state error against control effort, yielding a robust optimal controller.

LQG combines an LQR optimal feedback gain with a Kalman filter estimator to control a noisy system using only its measured outputs.

A locked mode is a non-rotating magnetic island that often precedes a disruption; detecting and unlocking it is a priority for the off-normal layer.

Striping controls how many storage targets a Lustre file is spread across and in what chunk size, tuning single-file bandwidth.

Lyapunov redesign adds a robustifying term to a nominal controller so a known Lyapunov function keeps decreasing despite matched uncertainty.

Models predict and monitor the intense, narrow heat-flux loads on the divertor, informing detachment control and component protection.

The machine protection system is the last line of defense, acting to protect hardware even when it means abandoning the plasma.

Classifiers learn the signatures that precede a plasma disruption, providing warning time for mitigation before confinement is abruptly lost.

The earliest reliable sign of a quench in a high-field REBCO magnet is a localized temperature rise; L1 senses its rate to trip before a normal zone spreads.

When a magnet must be de-energized fast, its stored energy is driven into external resistors along a fail-safe path that defaults to dumping on loss of control.

A hard-wired interlock chain guards the coils, tripping the supply and firing the dump whenever any monitored condition leaves its safe window.

A superconducting magnet that loses superconductivity can destroy itself in seconds; detecting the onset fast is a hard real-time task.

A quench is a sudden loss of superconductivity; protection systems detect it early and safely dissipate the stored energy.

Flux loops, pickup coils, and saddle sensors - the fast, robust magnetic measurements that anchor real-time control.

A memory controller translates a processor's memory requests into the precise timed command sequences that DRAM chips require.

Page faults and cache misses cause unpredictable delays; locking memory and controlling cache behavior are standard techniques for real-time determinism.

The hard-deterministic connections: sub-10-microsecond, jitter-bounded, and the only lines permitted on the safety-critical command path.

Beyond coarse zones, every controller pair is placed in its own micro-perimeter, so lateral movement between two OT nodes requires an explicit allow rule that mostly does not exist

Mixed synthesis optimizes average performance under an H2 objective while enforcing a hard worst-case robustness bound in the H-infinity norm.

Learned models estimate proximity to the operational density limit, where excessive fueling drives radiative collapse and disruption.

Optimizing actuator commands over a receding horizon while explicitly honoring the plasma's and hardware's hard limits.

Model predictive control optimizes actuator commands over a short future horizon each cycle, handling constraints and coupling directly.

A compact, glanceable badge system that tells an operator at a glance whether an AI output is trained, validated, calibrated, and running on healthy inputs.

MPC repeatedly solves an online optimization over a finite horizon, applies the first move, and re-plans, handling constraints directly.

MPC plans actuation by solving a constrained optimal-control problem over a finite horizon each cycle, the core planner for breeder shape and burner potential.

Kronos's MPC agents plan actuation by solving a constrained optimization over the twin's predicted trajectory at every control cycle.

MRAC adjusts controller parameters online so the plant output tracks the response of a chosen reference model despite unknown plant parameters.

MRAC adjusts controller parameters online so the closed loop matches a chosen reference model despite plant uncertainty.

MHE estimates states by solving a constrained optimization over a sliding window of recent measurements, the estimation dual of predictive control.

A linear-model MPC step is a quadratic program; solving it fast and reliably each cycle is what makes real-time predictive control feasible.

Allreduce combines a value from every process using a reduction operator and delivers the identical result back to all processes.

Reduce combines a value from every process using an operator and delivers the single result to one root process.

mu-synthesis designs controllers that are robust against structured uncertainty by minimizing the structured singular value of the closed loop.

L1 coordinates the burner's TWDEC, ultra-high-field MHD, and thermionic conversion stages so each energy channel is captured by the mode suited to it.

A fleet controller coordinates many units through the same unified API each unit exposes, balancing power obligations, fuel, and maintenance across the population.

A multiplexer selects one of several data inputs and routes it to a single output under the control of select lines.

Multivariable systems have coupled inputs and outputs, so each actuator affects several variables, demanding coordinated design.

Orbit, pan, zoom, and framing controls, plus the keyboard and touch shortcuts that make the model quick to explore.

The breeder runs at negative triangularity delta -0.30; parameterizing and controlling that inverted-D shape is a specific geometric problem layered on Grad-Shafranov.

Neoclassical tearing modes form magnetic islands that degrade confinement; control locates and shrinks them with targeted current drive.

Learned stability certificates for the coupled twin-plus-controller loop.

Using trained networks as fast surrogates, estimators, or controllers inside the real-time loop - with the verification burden that implies.

Networks that learn mappings between functions, approximating the solution operators of the equations governing plasmas.

A neutral beam carries megawatts in a narrow line; misalignment can strike a wall, so aiming and geometric interlocks are safety-critical.

On current noisy devices no fusion computation beats classical; the honest case for quantum is fault-tolerant and years out.

The no-cloning theorem forbids copying an unknown quantum state, which rules out classical triple-modular redundancy but not error correction itself.

Nonlinear control handles systems where superposition fails, using tools like linearization, Lyapunov methods, and geometric techniques.

Nonlinear MPC solves a constrained optimal control problem over a nonlinear model at each step, applying the first move and re-optimizing.

The study of algorithms that compute approximate solutions to mathematical problems, with control of error.

The orchestration layer is measured against explicit service-level objectives for latency, lag, and safety-check availability.

Observability asks whether sensors can reveal the internal state; controllability asks whether actuators can steer it.

Observables are represented by Hermitian operators, whose real eigenvalues are the possible measurement outcomes and whose eigenvectors are the outcome states.

Control policies are learned from the logged L0 pulse archive using conservative offline RL, never by exploring on the live machine, where exploration is a fault.

Pretrain a policy on logged data, then fine-tune it with limited online interaction, combining safety and adaptability.

Solve a single model-predictive-control problem: minimize a quadratic cost over a short horizon, apply only the first control, then repeat.

Controlled vocabularies fix the terms used to describe data; ontologies add the relationships among those terms so machines can reason.

Detect when the plant is outside the training distribution and defer before acting.

Open-loop control commands blindly; closed-loop control measures the result and corrects, buying disturbance rejection and robustness.

Generating startup, shutdown, recovery, and maintenance procedures from approved templates, twin state, and retrieved standing orders.

A human can always take the machine to safe state through a path that does not route through the AI, the network, or ordinary software.

Operator-learning methods approximate the solution operators of plasma partial differential equations, generalizing across inputs and resolutions.

Operator learning studies when and how mappings between infinite-dimensional function spaces can be approximated and generalized from data.

The operator, or subsystem, framework generalizes the standard correction conditions to allow part of the encoded space to be discarded rather than protected.

Designing displays around Endsley's three levels — perception, comprehension, and projection — so operators of both machines always know what is, what it means, and what comes next

Operator splitting advances a multi-physics problem by solving its constituent operators in sequence, each with a method suited to it.

A twin-based training simulator lets operators practice normal, off-normal, and emergency operations on a faithful virtual machine.

High-fidelity plant simulators that let operators build skill and rehearse rare events safely before the plant exists.

Optimal control finds the input that minimizes a cost functional subject to the system dynamics, unifying many design methods under one principle.

The single most important trust signal: telling the operator plainly when the machine has entered a regime the AI was never trained on.

Out-of-order execution runs instructions as soon as their inputs are ready rather than in program order, hiding latency.

Overlapping hides communication latency by performing independent computation while messages are in flight rather than waiting for them.

Passivity-based control exploits energy conservation and dissipation, ensuring stability because interconnecting passive systems remains passive.

Keeping software current closes known vulnerabilities, but on safety-critical systems patching itself carries risk and must be managed carefully.

Cryogenic pellets deliver deep, discrete fuel; L1 times each injection precisely for density profile control, pacing, and disruption mitigation.

Security claims are tested by an adversarial team against the digital twin and staging OT, because a control that has never been attacked is only a hypothesis.

When several actuators must move as one, Kronos uses a two-phase commit locked to a shared clock so the group either acts coherently or not at all.

When simple proportional-integral-derivative loops suffice and when model-based multivariable control is needed.

The PID controller combines proportional, integral, and derivative action; it is the most widely used feedback law and a template for real-time control code.

The proportional-integral-derivative loop is the workhorse regulator behind coil currents, temperatures, flows, and pressures throughout the plant.

A widely used feedback controller that combines proportional, integral, and derivative terms to correct error.

Control a damped mass-spring to a setpoint with a tuned PID loop and with an optimal LQR gain, and compare the closed-loop behavior.

Pipelining overlaps instruction stages for throughput, but data, control, and structural hazards can stall it unless resolved.

A supervisory state machine sequences the whole plant through its operating phases and enforces the conditions required to move between them.

The supervisory control and data acquisition surface for balance-of-plant: pumps, cryogenics, vacuum, tritium handling, and power supplies, rendered for floor operators.

Control simulation codes model the plasma response to actuators so shape, position, and profile controllers can be designed and tested before operation.

Control simulation codes model the plasma as a dynamic system with sensors and actuators to design and test the feedback that holds a discharge.

A plasma control system links diagnostics, real-time computation, and actuators into feedback loops that hold a discharge on its intended trajectory.

The hardware and software organization that lets many control functions run at different rates while sharing sensors and actuators.

Confining a fusion plasma requires fast, multivariable real-time control coordinating many magnets and diagnostics within microsecond timing budgets.

Why a burning plasma must be actively steered every millisecond, and how a layered control system keeps it inside a narrow operating window.

The copilot watches the twin's disruption precursors and margins, explains why risk is rising, and proposes avoidance moves — while fast mitigation stays in hardware.

Plasma current control regulates the total toroidal current, the quantity that anchors confinement, stability, and the safety factor.

Programmable logic controllers run the plant's control logic, and their security, especially for safety-rated controllers, is uniquely consequential.

Programmable logic controllers run the plant's slower deterministic sequencing and interlocks, complementing the FPGA fast loops with certified logic.

At the design bore the burner plug coil is stressed 3-3.9x beyond feasibility; the protection loop treats coil stress as a first-class safety limit, not a design detail.

The burner's tandem-mirror end plugs must hold continuously; orchestration supervises plug field and stability and gates every corrective setpoint.

State feedback u = -K x can move a controllable system's closed-loop poles to any chosen locations, setting its dynamics by design.

Software can wait for an event by repeatedly checking or by being interrupted; each has distinct latency, overhead, and determinism characteristics.

Pontryagin's principle gives necessary conditions for optimal control through a Hamiltonian and an adjoint costate system.

Positive operator-valued measures describe the most general quantum measurement, going beyond projective observables.

Turning telemetry into scheduled maintenance so faults are fixed on plan, not on failure - the strategic lever on availability.

Drawing the twin's 50-100 ms lookahead as a labeled forecast beside the live state so operators see where the machine is going, with its uncertainty.

Priority inheritance stops a low-priority plan holding a shared resource from blocking a high-priority safety action.

Human preference feedback shapes control-policy behavior where a scalar reward is hard to specify, but only in simulation and only behind the full validation and canary chain.

A model with authority is watched every cycle — inputs, outputs, uncertainty, latency, and agreement with physics — so degradation is caught before it becomes a fault.

The value of a precursor detector is the lead time it buys; Kronos measures lead-time distributions and designs actuation around the time available.

Models are shrunk to meet the L1 latency budget through quantization and pruning, with accuracy and calibration re-verified so compression never silently degrades safety.

Estimate the eigenphase of a unitary using a counting register, controlled powers, and an inverse QFT.

Sub-threshold signatures engineered from magnetics, strain, and profile telemetry give the anomaly ensembles a head start on quench and disruption.

A quench is the loss of superconductivity in part of a coil; detecting the resistive voltage it produces fast enough is the core protection problem.

The millisecond loop that catches a spreading normal zone in the superconducting coils and dumps stored energy safely.

Above the passive failsafe, an FPGA estimator fuses co-wound voltage, thermometry, and REBCO strain to detect quenches earlier and localize them.

Once a quench is confirmed the magnet's stored energy must leave the coil fast enough to keep the hot spot below damaging temperature.

A superconducting magnet losing superconductivity must be detected and de-energized in milliseconds; the quench chain is the fastest shared reflex on both machines.

A magnet quench is the highest-priority breeder event; orchestration coordinates a fast, safe, pre-authorized shutdown that preempts all else.

Radiated-power control regulates how much and where the plasma radiates, protecting surfaces without collapsing the core.

Ramp-down safely unwinds a discharge from flat-top to termination, avoiding the disruptions that a careless shutdown can trigger.

Bringing current and stored energy down on a controlled path - a phase as disruption-prone as ramp-up if handled carelessly.

Ramp-up brings a discharge from breakdown to the flat-top current while keeping the plasma stable and the current profile well behaved.

The early, fragile phase where current and shape are established while avoiding the instabilities that thrive at low current and density.

Randomized computations reproduce only when their randomness is controlled; a recorded seed turns chance into a repeatable input.

Even valid commands are throttled to engineering slew limits and per-actuator quotas so no burst can drive hardware faster than it may move.

Ratio control holds two flows or quantities in a fixed proportion by driving one to track a scaled version of the other.

Real-time analytics answers queries over data that is seconds old, combining fast ingestion, incremental computation, and low-latency serving.

Watching many sensor streams at once to flag deviations from normal behavior fast enough to act on them.

The bridge from digital command to physical effect is the actuator driver: deterministic RT-compute stages that turn setpoints into coil currents, beam power, and grid voltages.

Real-time computing guarantees not just correct answers but answers delivered within a strict, predictable time bound.

Plasma control depends on hard real-time computing, where meeting a deadline every cycle matters more than raw average throughput.

The control-relevant parts of a twin must produce answers within hard deadlines, which shapes their algorithms and hardware.

The sub-10µs control loop, synchronized gates, autonomous failsafe, and human oversight.

Plasma and component control demand deterministic communication, so a real-time network moves sensor and command data on a fixed, guaranteed schedule.

Decoders must return corrections fast enough to keep up with the syndrome stream, or the unprocessed backlog grows and computation stalls.

The subset of plasma diagnostics fast and reliable enough to close control loops, and what each contributes.

Running a model fast and reliably enough to sit inside a plasma control loop.

Real-time operating systems bound scheduling latency in software, but only fabric removes it; Kronos uses RT-Linux for supervision and FPGA for the fast loops.

An RTOS provides bounded, predictable scheduling and services so that timing guarantees, not just average performance, can be proven.

An operator dashboard turns a live stream of measurements into a compact, glanceable picture of machine state and margin to limits.

A fusion plasma changes on millisecond timescales, so control loops must sense, decide, and act faster than the instabilities they suppress.

A plasma flight simulator runs a fast physics model in place of the real machine so controllers can be tested and tuned before a discharge.

Real-time state estimation fuses many noisy diagnostics into one best picture of the plasma, fast enough for Kronos's control system to act within its latency budget.

Inferring the current plasma state from partial, noisy diagnostics fast enough to feed control.

REBCO conductors quench with a slow-propagating normal zone that is hard to see electrically; detection must be sensitive and fast without tripping on noise.

REBCO tape is strain-sensitive; L1 reads distributed strain gauges to catch conductor disturbances that can precede a thermal quench.

High-field REBCO tape is strain-sensitive; Kronos monitors distributed strain gauges to catch mechanical precursors to conductor degradation and quench.

MPC re-solves every cycle; Kronos chooses horizon length and solver so the plan is both far-sighted enough and fast enough for the control cadence.

Redundancy uses multiple channels so a single failure does not defeat a function; the architecture chosen trades availability against safe-fault detection.

Intelligence proposes on a slow horizon; reflex disposes on a fast one. Keeping these tiers physically separate is what lets the safety case ignore the AI entirely.

Reinforcement learning trains control policies against a simulator, offering a route to coordinate many actuators toward hard-to-specify goals.

Training control policies in simulation to steer plasma shape and position, and the honest limits of the approach.

The rectified linear unit is the default hidden activation of deep learning: cheap, non-saturating, and easy to differentiate.

Because measurements themselves fault, syndromes are extracted over many rounds and decoded as a three-dimensional spacetime history.

Proving the resiliency stack works by injecting faults in simulation and demanding a safe outcome every time - before hardware exists.

Designing the reward signal so a learned controller pursues the physical goal and not a loophole.

Operator copilots are tuned with reinforcement learning from human feedback so their suggestions match how expert Kronos operators actually reason — never to grant them control.

Robust control guarantees stability and performance despite bounded uncertainty in the plant model, designing for the worst case.

Granting permissions to roles rather than individuals, so access follows job function and is easy to review and revoke.

Runaway electrons accelerated during a quench can damage the wall; control aims to prevent their formation or safely dissipate the beam.

A certified simple controller that provably takes over when the learned policy is unverified.

Keeping a learning or learned controller inside physically safe bounds on hardware where mistakes are costly.

Constrained-RL control policies trained in the twin, deployed behind the clamp.

The controlled procedures that bring a plasma to rest with minimal stress on the machine, whether planned or triggered by fault.

Controlling the winding of the magnetic field, which governs stability, through the current profile.

SILs grade how reliably a safety function must perform, turning a hazard's severity into a measurable target for the protective system's design.

Interlocks are simple, independent safety functions that act automatically when a hard limit is crossed, regardless of the control software.

The independent protection system that guards the machine regardless of what the control system is trying to do.

Safety protects people from the system; security protects the system from people. Their measures sometimes pull in opposite directions.

Every trip, override, and gated action is recorded with enough fidelity to replay the event deterministically and prove the safety layers behaved as designed.

Cybersecurity and functional safety are co-designed so that no cyber event - however severe - can prevent the machine from reaching a safe state.

The envelope checker validates that a command keeps the machine inside a state-dependent safe region, not just under individual scalar limits.

The safety-instrumented system is physically and logically independent of the control network, with a one-way status feed out and no command path in.

A safety-instrumented system is an independent layer that detects dangerous conditions and forces the process to a safe state, separate from normal control.

Sawteeth are periodic core relaxations; control tunes their period so they flush impurities without seeding larger instabilities.

Periodic internal crashes that flatten the core when the central safety factor drops below one.

Growing from hundreds to the millions of qubits fault tolerance needs runs into wiring, heat, control, calibration, and error-correction bottlenecks at once.

Designing and executing the time-varying reference trajectories that carry a plasma safely from breakdown to controlled termination.

Planning maintenance activities to keep a plant available while respecting resource, access, and safety constraints.

Self-triggered control predicts the next update time at the current update, eliminating the continuous monitoring that event-triggered control requires.

A self-tuning regulator estimates plant parameters online and continually redesigns the controller as if the estimates were exact.

Finding which inputs a result depends on most, to focus measurement, control, and design effort where it pays.

Sensitivity analysis ranks which inputs most influence an output, focusing effort on the parameters that actually control a prediction.

Consequential actions require two people in distinct roles, so no single credential holder can move the machine to a high-consequence state or bypass safety alone.

A shadow controller runs on live machine data and computes what it would command, but its outputs go nowhere near an actuator — pure observation before authority.

Maintaining the breeder's delta -0.30 boundary is a continuous feedback task; L1 tracks shape moments and corrects the plasma-facing profile in real time.

Simpson's rule fits parabolas through triples of points, achieving fourth-order accuracy that integrates cubics exactly.

Sliding-mode control forces the state onto a stable surface and holds it there, giving strong robustness at the cost of chattering.

Sliding-mode control forces the state onto a designed surface and holds it there, giving strong robustness to matched uncertainty at the cost of chattering.

The Smith predictor compensates for process dead time by using a model to predict the delayed output and control against the prediction.

A loop that only just holds is a loop about to fail; Kronos designs gain and phase margin plus actuator headroom so faults have somewhere to be absorbed.

The same variational stability question specializes to different operators on the breeder and the burner; this map pairs each mode with its equation and its AI treatment.

State-space methods describe a system by its internal state vector, enabling systematic control of coupled, multivariable dynamics beyond single-loop PID.

Stochastic MPC handles random disturbances with chance constraints, enforcing limits with a specified probability rather than for the worst case.

Stream processing computes over unbounded data as it arrives, using windows, watermarks, and stateful operators to produce continuous results.

The fastest protection loops must close under 10 microseconds; this page decomposes that budget stage by stage and shows the timing margin.

The acquisition chain digitizes every analog channel below the microsecond, fast enough to resolve the transients that precede disruptions and plug collapse.

Detecting precursors below protection thresholds only helps if the alarm rate is low enough to act on; Kronos tunes thresholds against a cost of false vs missed alarms.

Quench codes model the transition of a superconducting magnet to the normal state, predicting temperature, voltage, and the protection a coil needs.

The supervisor sequences discharge phases, enables and disables controllers, and holds the logic that ties fast loops into one discharge.

Full multi-physics solves are too slow for real-time control, so Kronos distills them into fast surrogates that preserve the physics that matters.

Commands do not reach actuators the instant they are computed; they pass a synchronized gate that admits them only in a valid window and only when all interlocks agree.

Multiple actuators must fire on a common time base; L1 uses synchronized gates so coordinated commands take effect at the same deterministic instant.

Building the time-evolution operator by truncating its power series and implementing the sum as a linear combination of unitaries.

Detecting and suppressing magnetic islands that degrade confinement and can lock into disruptions.

KRONOS-CTRL runs ahead of the real plant, holding a 50-100 ms forecast so controllers act on where the machine is going, not only where it is.

A layered control stack that spans microsecond hardware reflexes to a predictive digital twin and human oversight, each layer with its own latency budget.

An AI-native plant treats computation as a core subsystem, not an add-on: design, control, and operations share one model of the machine.

A self-contained hardware chain detects a magnet delta-T precursor and dumps the quench with zero latency and zero dependence on any AI or software.

A fermion-to-qubit encoding that stores occupation and parity information in a tree structure, cutting operator locality to logarithmic scale.

The cold-electronics stack distributes signal generation, amplification, and control across temperature stages to match each function to the cooling available.

A control-room display is a shared, stable, high-reliability view designed so a team can maintain situational awareness under pressure.

The resistive-diffusion equation that evolves the poloidal flux and hence the safety-factor profile.

Five principles govern the architecture: safety is physical, intelligence is bounded, data is the asset, layers are contracts, and the twin is the source of truth.

The write plane accepts bounded, idempotent commands that are validated, envelope-clamped, and staged into the L1 control plane rather than executed blindly.

Reliable operation is not one trick but a layered strategy combining prediction, avoidance, control, and safe termination.

No quantum code can implement a universal gate set transversally, forcing every fault-tolerant scheme to use a non-transversal technique for at least one gate.

L0 Foundation to L7 Ecosystem: a strict layered separation that isolates microsecond safety from petabyte-scale learning.

Finite volumes integrate conservation laws over control cells so that fluxes between neighbors cancel exactly, enforcing conservation by construction.

The velocity-space diffusion and drag operator describing cumulative small-angle Coulomb collisions.

The kinetic equation that adds small-angle Coulomb collisions as a drift-and-diffusion operator in velocity space.

The single figure of merit n T tau_E that compresses the ignition requirement into one number.

How the empirical density limit constrains real-time density control and why staying below it is a scenario design requirement.

A block-structured product of two matrices that builds large operators from smaller ones.

The Kronos control stack layers fast stabilization, feedback regulation, supervision, and protection into one coordinated system.

A staged, honest plan: benchmark now, invest in fault-tolerant materials simulation later, and treat the He-3 link as the nearest-term reality.

The current-driven external kink threshold requiring the edge safety factor to exceed unity.

L0 is the offline, high-compute substrate that trains, simulates, and re-grounds everything the real-time layers do for both Kronos machines.

L1 is the hard real-time reflex tier: a fixed-latency sense-decide-actuate loop whose worst-case timing is proven, not measured after the fact.

L1 streams validated telemetry up and receives advisory targets down, but its safety and timing guarantees never depend on the layers above it.

From microseconds at the edge to hours at the foundation, each layer operates at the timescale its responsibility demands.

From sub-10-microsecond actuation at L1 to multi-hour Monte Carlo at L0, the stack spans nine orders of magnitude in time — deliberately.

A feature store serves engineered features to control, the twin, and the copilots at low latency, guaranteeing the same values online and offline.

The ratio of resistive diffusion time to Alfven transit time, controlling the rate of magnetic reconnection.

The last line of defense contains no machine learning and no general-purpose software; it trips to a defined safe state through logic simple enough to certify by inspection.

Fault tolerance multiplies the number of physical qubits and operations needed, and estimating this overhead is central to planning real machines.

A high-fan-out read plane publishes a coherent, versioned snapshot of plant state drawn from the digital twin, never from raw control internals.

The proximal operator generalizes projection: it finds the point that balances staying near a target against reducing a possibly nonsmooth function.

The pulse schedule is the time-programmed plan of references and actuator waveforms that defines a discharge before it begins.

The architecture's central dividing line: hard real-time below, latency-tolerant learning above, with telemetry crossing up and validated models crossing down.

Turning geometry into pixels follows a fixed sequence of stages; knowing them is the basis for every real-time 3D visualization.

The Ry(theta) gate rotates with real amplitudes - the best-behaved trainable gate, and Kronos's default for encoding data and parameters in fusion circuits.

The boundary where the software stack meets steel: every layer terminates in a named subsystem, sensor, or actuator on the real machine.

The number of toroidal transits a field line makes per poloidal transit, the master parameter of tokamak stability.

The number of toroidal transits a field line makes per poloidal transit, central to tokamak stability.

Safety is layered: deterministic hardware at the floor, bounded control above it, and AI advisory at the top — the higher the intelligence, the less it can harm.

From feedthrough to physical gate, L1 is one deterministic pipeline whose stages each carry a bounded latency that composes into a certified whole.

For linear systems, the optimal controller and optimal estimator can be designed independently and combined without loss of optimality.

For the predictive shadow to lead the plant, every stage from telemetry to twin update must fit within a strict latency budget.

Describing states by the Pauli operators that fix them yields a compact language for error correction and efficient simulation.

How the architecture controls the burner's multi-modal direct-energy-conversion train — TWDEC, ultra-high-field MHD, and thermionic stages.

Command authority descends in steps from strategy at L7 to microsecond actuation at L1, tightening latency and narrowing scope at each step.

Every safety-critical actuation on both machines must complete inside a 10-microsecond deterministic window, from validated command to physical gate.

The T gate is the expensive non-Clifford gate whose count Kronos tracks as the real price of a fault-tolerant fusion-chemistry calculation.

How the unitary e^(-iHt) propagates quantum states, and why its structure sets the shape of every simulation algorithm.

The Toffoli gate is a controlled-controlled-NOT that makes classical logic reversible and is a key primitive in quantum arithmetic.

Displays that stay legible and low-fatigue as control-room lighting changes across day and night shifts, without altering the meaning of any color.

Every wire entering a cryostat carries heat inward; controlling that load through anchoring, attenuation, and material choice is central to reaching base temperature.

Even with valid-looking commands, actuator behavior is bounded by rate limits, interlocks, and an independent shutdown path so manipulation cannot exceed a safe envelope.

An attacker who reaches the fast control loop would try to drive the plasma off its operating point; layered identity, attestation, and an independent safety path deny that.

Distributed real-time systems need a shared, precise clock so events can be ordered, timestamped, and coordinated across independent nodes.

Determinism is defined by the spread of latency, not its average; L1 engineers jitter down to nanoseconds so worst-case equals typical-case.

Build a small logistic classifier that flags impending plasma disruptions from a few diagnostic features - a scaled-down version of a real fusion control task.

A transversal gate acts independently on corresponding qubits of code blocks, making it automatically fault-tolerant.

Critical L1 channels are triplicated and voted so a single fault is outvoted, giving fail-operational behavior without a single point of failure.

Real-time, safety-critical tritium inventory and barrier permeation.

How the interface lets an operator accept, question, or overrule the AI — with the context to do so well and a record of why.

Tube MPC keeps the true state inside a bounded tube around a nominal trajectory by combining a nominal optimizer with an ancillary error-rejecting feedback.

Drive a process to a setpoint with proportional, integral, and derivative terms, and understand what each knob does.

End-to-end latency, from sensor to corrected estimate to action, sets what a twin can control and must be budgeted deliberately.

Twin-in-the-loop control runs Kronos's digital twin alongside the real machine, so the controller can test an action against the model before committing it - and catch drift when t

Placing the twin inside the control loop gives the controller a live, corrected model to plan against, not a fixed design model.

The rare actions that must span two coupled actuators atomically use a prepare-then-commit protocol with a safe abort on any failure.

Every hypothesis test can err two ways: a false alarm or a missed detection, and reducing one tends to raise the other.

Fusion performance predictions inherit uncertainty from physics inputs and models; propagating it turns single figures into honest, conditioned ranges.

Attaching honest error bars to every Kronos prediction by propagating input, data, and model uncertainty through the workloads.

The uncertainty set is the modeling choice at the heart of robust optimization; its shape controls both conservatism and computational tractability.

Control policies that quantify their own uncertainty can defer to safe fallbacks when they encounter conditions outside their training experience.

Pumping control regulates the removal of exhaust gas during a pulse, setting particle throughput while protecting each pump's operating window.

A fusion device needs a very high vacuum before and during operation, maintained by staged pumps under continuous control and interlocking.

Establishing that a control system does what it should before it is trusted with a machine - and keeping that trust over time.

Control software must be shown correct before it commands a machine; verification checks the code, validation checks it against reality.

Version control records every change to code and data so history is auditable, mistakes are reversible, and teams can collaborate safely.

Tracking every change to code and inputs so any result can be traced to the exact state that produced it.

Actively stabilizing the vertical position of an elongated plasma, which is intrinsically unstable and must be corrected faster than it grows.

An elongated plasma is vertically unstable on millisecond timescales; L1 runs a fast feedback loop on the breeder to arrest vertical displacement before it grows.

The AI's confidence is never hidden behind a single number: distributions, bands, and hatching let operators see how much to trust each estimate on both machines.

Critical safety signals are triplicated and voted so that a single failed channel is outvoted and flagged, not obeyed.

When the precursor trips, a metal-oxide switching element commutates coil current into an external dump, removing stored magnetic energy from the winding.

The warmup-then-cosine schedule ramps the learning rate up briefly, then lowers it along a cosine curve to a small floor, a widely used default.

Every L1 controller proves it is alive by servicing a watchdog; a missed heartbeat forces the guarded actuator into its safe state.

AI-native means the intelligence is not a bolt-on analytics layer but the control fabric itself — designed in from the plant's first block diagram.

Eight was chosen so that each layer holds a single latency and safety class — fine enough to isolate microsecond safety, coarse enough to reason about.

The architectural decision to keep heavy, non-deterministic foundation compute strictly apart from the microsecond control plane.

The exclusive-OR gate is the workhorse of digital arithmetic, comparison, parity, and controllable inversion.

The Youla parametrization describes every stabilizing controller for a plant with a single free stable transfer function, making closed-loop maps affine.