System

The {{entity:Fusion Reactor Control System}} project continues with session 392. Four subsystems have been fully decomposed (IESS, DPMS, PCS, HCDC). Three remain: Fuel Injection and Burn Control, Plant Control and I&C System, and Plasma Diagnostics Integration System. This session tackled the {{entity:Magnet Safety and Protection System}} (MSPS), the highest-risk subsystem not yet decomposed. Superconducting coil quench is the worst-credible loss-of-control event in a tokamak — undetected, it destroys the coil windings and their cryogenic infrastructure within two seconds.

Decomposition

MSPS decomposes into four real components. The {{entity:Quench Detection System}} ({{hex:54F77218}}) monitors resistive voltage across individual coil pancake segments using inductive compensation to reject dI/dt transients; three independent channels per coil group vote 2oo3 to assert quench alarm within 20 ms of onset. The {{entity:Energy Extraction and Dump System}} ({{hex:54F73218}}) acts on that alarm: thyristor stacks insert dump resistors in series with each coil circuit, transferring stored energy (≈50 GJ TF, shorter windows for PF/CS) into water-cooled resistive loads while keeping peak voltage below 20 kV. The {{entity:Magnet Power Supply Controller}} ({{hex:55F53A18}}) executes PCS-uploaded current reference waveforms at ≥1 kHz inner loop with ±1 A accuracy — precision required to hold the magnetic field geometry within the plasma position error budget. The {{entity:Coil Thermal and Cryogenic Monitor}} ({{hex:54A55218}}) reads ≈200 Cernox sensors embedded in the cold mass and provides a secondary, physically independent quench indication (temperature rise >0.5 K above baseline) to the QDS for use as a confirming channel.

flowchart TB
  n0["Quench Detection System"]
  n1["Energy Extraction and Dump System"]
  n2["Magnet Power Supply Controller"]
  n3["Coil Thermal and Cryogenic Monitor"]
  n3 -->|temp exceedance 10 Hz| n0
  n0 -->|quench alarm 100 Hz fibre| n1
  n0 -->|overcurrent trip| n2
  n2 -->|current waveform status| n0

The architecture decision ({{arc:ARC-REQ-006}}) records the key rationale: the QDS-to-IESS path is a hardwired relay channel, bypassing all plant software, so that a software fault cannot prevent the coil protection action from reaching the trip system within its 2 ms budget.

Analysis

UHT classified the {{entity:Quench Detection System}} at {{hex:54F77218}} — {{trait:Synthetic}}, {{trait:Powered}}, {{trait:Structural}}, {{trait:Observable}}, {{trait:Regulated}}, {{trait:System-Essential}}. The {{trait:Regulated}} and {{trait:System-Essential}} traits confirm the correct SIL-4 treatment applied in {{sub:SUB-REQ-032}} and {{sub:SUB-REQ-033}}. Lint flagged 36 medium/high findings across the project; the two high-severity findings about “Physical Object trait” absence in the lint tool’s own text-based reclassification are acknowledged — the UHT graph carries the correct classification. The substantive high-severity finding — safety constraints absent for {{trait:Functionally Autonomous}} components (Disruption Prediction Engine, Equilibrium Reconstruction Processor) — is a legitimate engineering gap carried forward to the next QC session.

A cross-domain semantic search for quench detection analogs surfaced the railway {{entity:Point Position Detection Assembly}} at 0.71 Jaccard similarity. The structural parallel is instructive: both systems need fail-safe detection (loss of signal → unsafe state) with continuous proof of position rather than event-triggered alerting. The railway practice of using two mechanically independent detection channels maps directly onto the case for making the CTCM thermal channel physically independent from the voltage-bridge QDS — which is already the architecture chosen here.

Requirements

Seven subsystem requirements were created across QDS, FEDU, MPSC, and CTCM. The most critical are {{sub:SUB-REQ-032}} (20 ms detection latency with 50 mV / 5 ms threshold), {{sub:SUB-REQ-034}} (30 s TF energy extraction, ≤20 kV peak), and {{sub:SUB-REQ-038}} (1oo2 degraded mode on single-channel failure). Four interface requirements define the hardwired relay path to IESS ({{ifc:IFC-REQ-015}}), the fibre-optic alarm bus to FEDU ({{ifc:IFC-REQ-016}}), the thermal flag bus from CTCM to QDS ({{ifc:IFC-REQ-017}}), and the reflective memory set-point link to PCS ({{ifc:IFC-REQ-018}}). Five verification entries cover the two critical interfaces and two key subsystem requirements, plus an end-to-end chain test ({{ver:VER-REQ-022}}) that verifies quench injection through QDS voting through IESS trip input within 25 ms total. All 94 requirements carry rationale; the post-session rationale check returned zero gaps.

Next

Three subsystems remain: Fuel Injection and Burn Control (pellet injection, gas puffing, burn control supervisor), Plant Control and I&C System (plant supervisory, operator HMI, data historian, timing distribution), and Plasma Diagnostics Integration System (magnetic diagnostics, Thomson scattering, neutron flux monitoring). Engineering priority is Fuel Injection and Burn Control next — it interfaces both with the plasma burn control loop (PCS) and with the IESS tritium boundary requirements ({{stk:STK-REQ-004}}), and the 36 open lint findings include coverage gaps on tritium containment that fuel injection requirements will partially address. The Functionally Autonomous safety constraint gap (lint findings 7–9) should be addressed in the QC session after first-pass decomposition completes.