Failure Response Decision Table
Every anticipated fault maps in advance to a defined response and a defined safe state, so the reflex tier looks up the answer instead of computing it under duress.
Decide before, not during
Under a fast fault there is no time to reason about the right response. Kronos decides every anticipated fault's response in advance and encodes it as a decision table the reflex tier consults. The table maps fault class to action, target safe state, and which layer owns the response. Novel or unclassified faults default to the most conservative action: trip to safe state.
Representative entries
| Fault | Owning layer | Action | Target state |
|---|---|---|---|
| quench detected | reflex | dump magnet | de-energized |
| imminent VDE | reflex | mitigate + terminate | mitigated shutdown |
| plug coil overstress | reflex | cap/dump current | low-stress hold |
| ambipolar collapse | reflex | controlled ride-down | benign relax |
| stale supervisory link | reflex | holding law | safe hold |
| unclassified fault | failsafe | trip | defined safe state |
def respond(fault_class, table):
# look up, don't reason; default to the safest action
return table.get(fault_class, ('failsafe', 'trip', 'safe_state'))The table is not a runtime optimizer; it is a pre-agreed contract between the physics analysis, the safety authority, and the control system. Each row is justified by hazard analysis and validated by fault injection in commissioning. Adding a machine capability means adding and validating rows, not teaching a model to improvise.
Keeping the response predefined also makes the whole safety system testable: each row is a case that can be injected and checked, and the table's coverage of the hazard analysis can be audited directly. Novelty is handled conservatively rather than cleverly — an unrecognized fault falls through to the failsafe default and trips, because a safe pause on an unfamiliar event is always preferable to an improvised response computed under time pressure with incomplete information. Extending the machine's capability therefore means adding and validating rows, subject to the same hazard analysis and fault injection as the rest, rather than teaching a model to react to situations no one designed for.
The table ties the whole category together: it names the safe states each fault targets, assigns faults to the reflex or supervisory tier, and its conservative default is the ML-independent failsafe. Every response it prescribes is recorded for the safety case.