Safety-Envelope Checks

The envelope checker validates that a command keeps the machine inside a state-dependent safe region, not just under individual scalar limits.

Beyond scalar limits

Individual quantities can each be legal while their combination is unsafe. The safety-envelope checker evaluates the joint operating point: for the breeder, a plasma current, shape, and pressure combination that risks a vertical displacement or a disruption; for the burner, a plug-to-throat mirror ratio and beta combination that risks losing plug confinement. It is state-dependent, evaluated against the current reconstructed machine state.

Envelope as a region

def in_envelope(cmd, state):
    proj = project_state(state, cmd)          # predicted next operating point
    return all([
        g_current(proj)   <= 0,   # each g_i <= 0 defines the safe region
        g_shape(proj)     <= 0,   # negative triangularity delta -0.30 maintained
        g_vertical(proj)  <= 0,   # vertical stability margin preserved
        g_density(proj)   <= 0,   # below empirical density limit fraction
    ])
# projection uses a certified reduced model, NOT the learned twin

Why the checker is not the twin

The envelope projection uses a small, certified, deterministic reduced-order model whose properties are analyzed and bounded, not the full learned digital twin. The twin (L3) may be more accurate on average but is not certified for veto authority. If twin and envelope-checker disagree, the checker wins and the command is rejected. Accuracy is not the same as trustworthiness for a safety veto.

Margins and hysteresis

• The safe region is drawn with margin inside the true physical limit so prediction error does not cross the real boundary.
• Hysteresis prevents chattering near the boundary from oscillating command approvals.
• Margins tighten automatically when state reconstruction uncertainty is high.

Placement in the gate

The envelope check runs after schema validation and rules evaluation and before any human gate, so approvers never see a proposal that is already unsafe. See the action-gating pipeline. Every check, its inputs, and its verdict are journalled for replay and audit.