Operating ITER Robustly Without Disruptions

Disruptivity in ITER must be minimized to limit downtime and maximize use of the limited number of discharges. Minimizing disruptivity requires sufficient control capability, including robustness to disturbances and disruption avoidance through prediction of controllability limits. Robust control implies a balance of passively stable nominal scenarios, robust operation near or beyond open loop stability limits, and responses to off-normal events to avoid disruptive termination. Such a solution is possible because disruptions result from deterministic loss of controllability due to many proximal causes (e.g.\ loss of hardware resources, human error, or uncontrollable disturbances), most of which can be addressed with good physics models and known control methods. We illustrate the required approach with DIII-D experiments to assess ITER controllability and pre-qualify ITER scenarios, and with design and analysis ensuring sufficiently robust vertical control for ITER.