Control Safety Integrity Levels
Kronos grades each control function by the consequence of its failure and matches architecture, redundancy, and independence to that grade.
Not all functions are equal
A shape-refinement loop and a magnet-quench dump do not carry the same consequence of failure. Kronos classifies each control function by a safety-integrity grade — how severe and how likely the harm from its failure — and assigns architecture accordingly. The highest grades demand the strongest independence, redundancy, and simplicity.
The grading logic
- Highest grade: magnet quench protection, vacuum containment interlocks — simple, independent, de-energize-to-trip, no software in the trip path.
- High grade: vertical stability, disruption mitigation trigger, thermal protection — deterministic FPGA/PLC, redundant, model-independent action.
- Medium: density, current, position regulation — deterministic loops with graceful degradation.
- Advisory: MPC trajectories, learning-driven optimization — can fail without harm because L1 holds safe defaults.
The grade dictates design freedom. An advisory function may use any technique, including deep learning, because its failure is caught by the layer below. A highest-grade function may use only inspectable, independent hardware, because nothing catches it — it is the catch.
Independence
A core rule: a function must not depend on components it is protecting against. Magnet protection cannot rely on the compute racks it might have to survive losing; vacuum interlocks cannot rely on the software they gate. This is why the hardware failsafe is physically separate from the intelligent stack — independence is what makes its guarantee credible.
Certification and the two machines
Each function's grade, architecture, and evidence (WCET reports, interlock tables, redundancy analysis) form its certification record. The same grading applies to breeder and burner functions; the physics differs but the discipline — consequence drives architecture — is identical across the fleet.