Control-Plane Isolation and Integrity

The safety-critical control plane is isolated from general networks; only validated, one-directional interfaces cross into it, protecting deterministic operation.

Isolation as a safety property

A deterministic control plane must be protected from anything that could inject latency, jitter, or unauthorized commands — including from the network. Kronos isolates the L1 safety-critical layer from general-purpose and external networks, so its timing and behavior cannot be perturbed by traffic or actors outside the machine's control domain. Isolation here is a determinism and safety measure, described operationally, not a product claim.

Controlled crossings

• Telemetry egress to L2 is one-directional where feasible — data out, no command in.
• Setpoint ingress from L3 passes the validation gate before it can act.
• Configuration and bitstream loading happen only in defined maintenance states.
• Every crossing is authenticated and logged.

The principle mirrors the layer boundary: information may cross, but the ability to compromise timing or force an unsafe actuation must not. A setpoint that arrives from above is data to be validated, never a trusted command — exactly the discipline the whole control plane applies to any external input.

Why the failsafe is immune

The hardware failsafe is the strongest expression of isolation: it uses only local analog sensing and passive-biased switching, so no network path exists to it at all. Nothing reachable over any interface can prevent it from protecting a magnet. Protection that cannot be reached cannot be subverted.

Maintaining integrity over life

Bitstreams and PLC logic are version-controlled with their WCET and interlock evidence; a change enters the machine only through a controlled maintenance state with review, never during operation. This keeps the certified behavior of the deterministic layer stable and auditable across the machine's life, on both the breeder and the burner.