The Off-Normal Event Catalog
Every credible upset — plasma disruption, loss of power, coolant loss, magnet fault, leak — resolves toward a safe, bounded state.
A safety analysis enumerates the ways a plant can depart from normal operation and shows that each leads to a safe end-state. For Kronos the striking feature of this catalog is its monotony: nearly every off-normal event drives the machine toward off, because the reaction needs everything working to continue.
The catalog at a glance
| Off-normal event | Immediate consequence | End-state |
|---|---|---|
| Plasma disruption | Burn terminates | Safe — loads managed |
| Loss of off-site power | Heating/fueling stop | Safe — burn ends |
| Loss of coolant | Small decay heat only | Safe — passive cooling |
| Magnet quench | Energy dumped externally | Safe — confinement ends |
| Vacuum breach | Air cools plasma | Safe — burn extinguishes |
| Tritium leak | Caught by containment | Bounded — detritiation |
No line in this table escalates. There is no event that adds energy to the reaction, no cliff where a delayed response causes core damage, and no single failure that produces a large release. This is the practical expression of inherent and passive safety across the full off-normal spectrum.
Combinations and beyond-design
Even compounded events — loss of power plus loss of coolant, for instance — do not produce a melt, because the residual heat is small regardless. The maximum credible accident examines the beyond-design tail and finds it bounded by the tritium inventory. See why fusion cannot run away.
A hazard catalog whose every branch ends safely is the clearest statement of the fusion safety case.