Synchronized Actuation Gates

Commands do not reach actuators the instant they are computed; they pass a synchronized gate that admits them only in a valid window and only when all interlocks agree.

The gate between decision and energy

A synchronized actuation gate is the last checkpoint before a command moves energy. It admits a command only when three conditions hold simultaneously: the command is inside its clamped envelope, the machine state permits the action, and every relevant interlock reads permissive. Any one condition failing holds the gate closed and the actuator stays in its last safe state.

Gate truth table

The gate is a hardware AND of independent permissives. It is deliberately not clever: no single software fault can force it open, because the interlock permissive originates outside the software domain in the hardwired interlock matrix.

def gate(cmd_valid, state_permits, interlocks_clear, in_window):
    # all four must be true in the same cycle for the gate to open
    return cmd_valid and state_permits and interlocks_clear and in_window

def in_actuation_window(t, t_edge_ns, width_ns=200):
    # phase-locked window: pellet/beam/coil edges align to the clock
    return 0 <= (t - t_edge_ns) <= width_ns

The gate also enforces the actuation window itself: even a fully permissive command is held until it falls inside the phase-locked window it belongs to, so late or early commands are never applied. This turns timing errors into safe no-ops rather than mistimed energy. A command that misses its window is dropped and re-requested on the next cycle, never stretched or applied stale, which keeps the effect of every admitted command equal to its designed effect. The gate thus does double duty as both a safety permissive and a timing enforcer, and its simplicity — a hardware AND of independent conditions plus a window check — is exactly what makes it trustworthy as the last checkpoint before energy moves.

Synchronization matters when several actuators must act coherently — for example pellet injection timed to a plasma phase, or multi-coil current steps that must step together to avoid a transient force imbalance. The gate aligns these to a common clock edge so their combined effect is the designed one. See phase-locked actuation commit for the multi-actuator commit protocol.