The Certified Safe Operating Envelope
MPC never optimizes freely; it optimizes inside a certified envelope of states and actuator moves proven safe, which is the constraint set X_safe.
What the envelope is
The safe operating envelope is the region of state and actuator space in which the machine is known to operate safely. It is defined offline from physics limits and validated against simulation and (later) plant data: field and current limits, stability margins, thermal and strain limits, density limits, and the DEC operating range. MPC treats it as the hard constraint set X_safe; the optimizer may seek performance anywhere inside it but may never plan a trajectory that leaves it.
- Magnet limits: field, current, and REBCO strain within qualified bounds
- Stability margins: distance to MHD / peeling-ballooning (breeder), mirror modes (burner)
- Thermal limits: divertor and first-wall heat-flux and temperature bounds
- Density limits: Greenwald-type edge (breeder), plug and central-cell density (burner)
- Actuation: coil slew rates, heating-power ramps, fueling rates
Envelope vs failsafe
The envelope and the L1 hardware failsafe are distinct and complementary. The envelope is a soft, model-based boundary MPC stays well inside; the failsafe is a hard, hardware-enforced trip that fires if physical thresholds are crossed regardless of any model. MPC's job is to make failsafe activation rare by keeping the machine comfortably within the envelope; the failsafe's job is to guarantee safety if MPC or its model is ever wrong.
The envelope has margins. Kronos does not let MPC ride the exact edge of a constraint, because model error and imputation uncertainty are real. When observability degrades (many imputed channels, low twin confidence), the effective envelope shrinks automatically, so the controller becomes more conservative exactly when it knows less. This uncertainty-aware tightening is a core safety property of the L3 design.
The envelope is machine-specific and phase-specific: a commissioning ramp uses a tighter envelope than a validated flat-top, and the envelope expands only as operation is proven, a deliberately conservative posture consistent with the design/simulation status of both machines before FOAK.