Formal safety envelopes for tokamak control
Anulum Institute / SCPN Control
Challenge
Tokamak plasma control must satisfy hard safety constraints while reacting to stochastic disruption precursors. Existing controllers optimize for performance but rarely present the boundary within which a command is valid. Without an explicit boundary, a downstream operator or automated actuator can mistake a model-based recommendation for a machine-validated clearance.
Approach
SCPN Control encodes each controller decision as a stochastic Petri-net transition and checks it against a formally specified safety envelope. The envelope captures the plasma-current (Ip) range, closure assumptions, and disruption-precursor validity domain under which the command is admissible. Each checked command is emitted as a studio.safety-certificate.v1 evidence bundle and, when accepted, sealed with the Anulum publication seal and recorded in the transparency log.
Results
During synthetic equilibrium campaigns the safety envelope rejects out-of-bound commands and records the exact Ip range and closure assumptions for every accepted command. The current bundle is graded external-dependency-blocked because discharge-reference validation against experimental data is still pending — the boundary is rendered verbatim rather than overstated.