When absolute zero gets too hot to handle
When Absolute Zero Gets Too Hot to Handle
What MRI Superconducting Magnets Reveal About Risk in Operational Technology
I recently spoke at an OT cyber security event about a subject that, on the surface, looks highly specialised: superconducting magnets used in MRI scanners. What surprised me was not the level of interest, but the recognition in the room. Again and again, people from very different industries pointed out that the risk patterns I was describing felt immediately familiar.
MRI cryogenics turn out not to be a niche curiosity, but a particularly clear example of a wider problem that affects many forms of operational technology.
Why MRI belongs in the OT conversation
Operational Technology refers to the hardware and software systems that monitor, control, and directly influence physical processes. Unlike IT, failures in OT are not abstract. They can stop production, damage physical assets, or put people in danger.
MRI cryogenic systems fit squarely into this category. Superconducting magnets are safety‑critical systems whose stability depends on continuous cooling, pressure control, ventilation, and reliable monitoring. They store large amounts of energy and they fail abruptly rather than gradually.
The most serious risks do not arise from dramatic sabotage or exotic attacks. They arise from ordinary failures that quietly remove safety margin: a cooling system degrading, a vacuum jacket slowly leaking, a sensor drifting, an alarm being suppressed, a control sequence being misconfigured. Everything can appear normal until it suddenly is not.
Superconductivity has hard physical limits. Once they are crossed, failure is immediate and irreversible in real time. That means the most important safety work happens before anything looks wrong.
This pattern is repeated across many OT environments. The technology differs, but the lesson remains the same. The most dangerous risks are indirect, coupled, and invisible without a genuine understanding of how the system actually works.
A career shaped by rapid change and control systems
My perspective on this did not begin in cyber security or safety engineering. It began in industry.
As an undergraduate, I spent an industrial year at the GEC Hirst Research Centre. That experience proved formative. It led directly to GEC funding a PhD they invited me to take up, focused on MRI at a moment when superconducting scanners were just moving from laboratory experiments into clinical practice.
The pace of development between 1979 and the early 1980s was extraordinary. When I started, we were imaging small objects like daffodil stems using iron‑cored magnets. Within a few years, we had built a superconducting rat scanner, and shortly after I was working with whole‑body superconducting systems at Hammersmith Hospital. Field strengths, image matrices, and acquisition speeds were advancing at a rate that now feels almost unreal.
My role sat at the boundary between physics, medicine, and computing. Others focused on building and tuning the magnets themselves. I focused on computer control, data acquisition, and reconstruction.
A hazardous event for a superconducting magnet is a 'quench': dumping all the energy of the superconductor into heat and boilng off the liquid helium. If it goes wrong the magnet can be damaged, and there is a risk of injury or even death.
My fellow student, Dave, was responsible for the engineering construction and managing the magnets. Whenever he initiated a quench, he announced it clearly beforehand. At the time, I thought this was excessive. Years later, I understood that he was recognising the point of highest risk, not just to equipment, but to people.
That interest in computers and control systems eventually took me out of academia and away from MRI itself, into embedded and industrial control systems where the consequences of silent failure were explicit and unavoidable. Only later did I return to medical imaging, via 3D ultrasound and radio‑wave imaging, carrying a control‑systems perspective shaped elsewhere.
That distance matters. It is what allowed me to recognise MRI cryogenics not simply as medical equipment, but as cyber‑physical control systems with familiar failure modes.
How superconducting MRI magnets work
An MRI scanner’s magnetic field is produced by a superconducting electromagnet. At temperatures near absolute zero, electrical resistance collapses and very large currents can circulate indefinitely without external power.
In practice, the coils are cooled to around 4 kelvin using liquid helium. Below this temperature, current flows persistently and the magnetic field remains stable for years.
This stability is conditional. Superconductivity exists only while three hard physical limits are respected: temperature, magnetic field strength, and current density. These are not safety margins. They are boundaries imposed by physics.
Once any of these limits is exceeded, superconductivity collapses abruptly. Resistance returns. Stored magnetic energy is converted rapidly into heat. There is no graceful degradation and no opportunity for last‑minute corrective action.
A modern MRI scanner carries currents up to 1,000 amps, and an energy of 25 mega Joules - about equivalent to 6 Kg of TNT. All that energy gets dumped to heat in a quench, in about 20 seconds if uncontrolled. If the venting systems fail you have a cryogenic pressure vessel heated beyond boiling - a cryogenic bomb.
Because of this, MRI magnets do not fail gradually. They fail catastrophically and irreversibly in real time.
Keeping the system stable therefore depends on a tightly coupled set of functions: cryogenic cooling, pressure control, vacuum insulation, helium inventory management, ventilation and quench relief, and accurate sensing, monitoring, and alarms.
Modern MRI systems rely heavily on digital control and monitoring to maintain these conditions. Sensors feed process control systems. Alarms are routed through networks. Trends are analysed to detect early warning signs.
Once superconductivity is lost, control no longer matters. Safety depends entirely on preserving margin before the limits are crossed.
What a quench is and why it matters
A quench is the sudden loss of superconductivity in an MRI magnet.
When it occurs, the energy stored in the magnetic field is converted rapidly into heat. Liquid helium flashes almost instantaneously into gas, expanding by roughly seven hundred times its liquid volume.
Quenches are rarely initiated by dramatic failures. They are more often triggered by mundane events: loss of cooling, gradual helium depletion, vacuum degradation, accidental heating during current injection, or control and configuration errors during ramp‑up or ramp‑down.
These precursors may not be obvious. The magnet can appear to operate normally while safety margin disappears.
When helium flashes to gas, several hazards arise immediately. Pressure can rise rapidly, making doors difficult or impossible to open and damaging building fabric. Oxygen is displaced, creating a serious asphyxiation risk. The escaping gas is intensely cold, causing cold burns and frostbite. Moisture and carbon dioxide can freeze out of the air, reducing visibility and compounding injury risk.
For people in or near the MRI suite, this is not abstract. Frostbite, asphyxiation, and serious injury or death are plausible outcomes if safeguards fail.
Once a quench begins, the process is physically unrecoverable. Safety relies entirely on passive protections functioning as designed.
When networking safety systems adds risk
Historically, many MRI safety functions were mechanical or locally wired. Modern systems increasingly depend on networked sensors, digital controllers, and software‑mediated alarm pathways.
This brings real benefits, but it also introduces new failure modes.
When sensing, switching, and alarms depend on software and networks, loss of telemetry can hide early warning signs. Alarm routing failures can prevent staff being alerted. Control systems may continue operating on false assumptions. Network outages, misconfigurations, or cyber incidents can silently remove safety layers.
From the magnet’s perspective, it makes no difference whether incorrect data arises from a sensor fault, a software bug, a failed update, or malicious interference. The physical outcome is the same: false reassurance while margin disappears.
The danger is one of timing. Digital failures matter most before a quench begins, exactly when intervention might have prevented it.
The persistent current switch as a managed hazard
At the heart of every superconducting MRI magnet is the persistent current switch. Its purpose is to allow current to circulate indefinitely once the magnet has been energised.
A perfect superconductor cannot be driven directly. To inject or remove current, resistance must be introduced briefly. The persistent current switch does this by deliberately heating a short section of superconductor so voltage can be applied.
From a physics perspective, this is elegant. From a safety perspective, it is inherently risky.
Heat is intentionally applied to the coldest part of a system storing enormous energy. Correct operation depends on precise sequencing, accurate sensing, and reliable control logic. Errors in heater control, mis‑sequencing, sensor failure, or loss of visibility can inject energy at exactly the wrong moment.
In modern systems, persistent current switch operation is typically controlled digitally. Configuration changes, software faults, telemetry loss, or cyber events all create pathways for unintended heating.
What makes the switch especially dangerous is risk concentration. Maximum stored energy, minimal thermal margin, active heating, and software‑driven sequencing all intersect in one place. It is a managed hazard, safe only while control integrity is preserved.
The broader lesson for operational technology
MRI cryogenics make something visible that applies far beyond medical imaging.
The most dangerous risks in OT rarely come from dramatic attacks. They come from misunderstanding how systems operate, how they degrade, and where recovery boundaries lie. Shallow risk models and generic checklists can provide confidence while missing the pathways that actually matter.
Depth of understanding matters. Not encyclopaedic detail, but enough to ask the right questions about assumptions, margins, failure modes, and coupling between digital systems and physical processes.
That understanding cannot be gained from documentation alone or from assessments conducted at arm’s length. It requires real engagement with the engineers, operators, and technicians who live with these systems every day.
Where cyber security, safety engineering, and operations remain siloed, risk falls between the gaps. Where they work together, risk assessments become grounded, credible, and genuinely useful.
MRI superconducting magnets are an extreme example, but a clear one. They remind us that protecting operational technology starts with understanding it, technically, operationally, and humanly.
Comments
Post a Comment