Commissioning and Safety Validation

Before a safety layer guards a real plasma it is proven by fault injection in hardware-in-the-loop, so the failsafe is validated against faults, not assumed to work.

Validate against faults, not against hope

A protection system that has never seen a fault is a hypothesis. Kronos commissions the safety architecture by injecting faults deliberately — in simulation, then in hardware-in-the-loop with the real reflex hardware — and confirming each layer responds as designed. This happens now, in the design-and-simulation phase ahead of breeder construction in Q2 2027 and first-of-a-kind first tritium around 2030, so the safety case is mature before first plasma.

The validation ladder

• Simulation: inject each hazard against the digital twin and confirm the modeled reflex trips correctly.
• Hardware-in-the-loop: run the real FPGA reflex tier against a simulated plant, inject faults, measure the actual latency.
• Failsafe proof: cut power, drop the heartbeat, and confirm the machine defaults to safe state.
• Integrated drill: exercise human abort, bypass governance, and audit capture end to end.

def commission_case(inject_fault, expected_response, reflex, latency_budget_ns):
    t0 = clock_ns()
    inject_fault()
    resp = reflex.observe_response()
    latency = clock_ns() - t0
    return (resp == expected_response) and (latency <= latency_budget_ns)

Each commissioning case pairs an injected fault with the response the design promises, and passes only if the reflex both does the right thing and does it inside the budgeted latency. Measured latencies are compared against the static WCET bounds; the empirical distribution must sit inside the analytic one. Failing cases block operation until resolved.

Commissioning is deliberately adversarial: the goal is to make each protection layer fail on purpose, in a controlled setting, and confirm the response, rather than to demonstrate the machine running smoothly. A layer that has never been shown to trip under a real injected fault is treated as unproven regardless of how confident the analysis is, which is why fault injection, not clean operation, is the acceptance criterion for the safety architecture.

Commissioning is where the whole category comes together: the failsafe, the quench chain, the machine-specific disruption and plug-stability reflexes, and the human layer are all proven together and recorded for the safety case. For the burner, commissioning explicitly tests behavior at the edges of the modeled regime, respecting the open physics gates rather than assuming them resolved.