Control and Diagnostics: Closing the Loop on an Envelope

It is set by the fastest instability the loop must suppress, not by the vehicle dynamics. Plasma instability growth rates in the relevant regimes span microseconds to milliseconds, while a coil's field cannot be slewed anywhere near that fast. This mismatch is the central architectural fact of the problem: fast modes must be suppressed by design — geometry, gradient, and passive stabilization — while the active loop manages the slower drift. A concept that promises to actively control a microsecond mode with a superconducting magnet is not credible.

By using the envelope's own behavior as the measurement. Antenna impedance, coil current response, and optical self-emission all vary with plasma state, and each is available without an aperture that has to survive an external view. This inverts the sensing problem described on the optics and communications page: the interference becomes the signal. It is an appealing idea and, at present, an unvalidated one.

In three places with reasonable justification: as a surrogate for physics too slow to run in real time, as a state estimator combining several partial and noisy diagnostics, and as a controller trained in simulation for a regime where classical control design is intractable. The precedent most often cited is the reinforcement-learning tokamak plasma shape control demonstrated on the TCV tokamak by DeepMind and EPFL and published in Nature in 2022. That work is real and important; it is also a controlled laboratory device with extensive diagnostics, and the distance between it and an entry vehicle is large.

Anywhere it is the sole authority over a safety-critical actuation with no bound on its behavior outside the training distribution. The failure mode of a learned controller is that it is confident in exactly the excursion regime where it has no data. Our position is that a learned element must sit inside a monitored envelope with a deterministic fallback that has been analyzed on its own merits, and that a controller which cannot be shown to be safe when its model is wrong should not fly.

Not by demonstrating good average performance. The path that reviewers accept — visible in emerging aviation and space guidance for learned components — runs through bounded authority, run-time assurance monitors, deterministic reversion, extensive off-nominal simulation, and traceable training-data provenance. We treat certifiability as a design constraint from the start rather than an approval to be sought afterward, because the alternative is a research result that can never become a system.

It must have a defined safe state and it must reach it without argument. For an entry application that means a passive configuration whose thermal and aerodynamic behavior is understood and survivable without any envelope control at all. In plain terms: the vehicle has to be able to come home with the system switched off. Any concept without that property is not an engineering proposal.