Hard Real-Time Bounds

A control action is only correct if it is also on time; L1 treats deadlines as functional requirements with provable worst-case bounds.

Soft vs hard real time

In soft real-time systems a missed deadline degrades quality. In Kronos's L1, a missed deadline on a protection or fast-stability loop is a fault, indistinguishable from a wrong answer. A vertical-stability command that arrives late for the breeder plasma, or a DEC modulation update that slips on the burner, is not merely suboptimal — it can allow an event the loop existed to prevent.

The deadline model

Each loop is characterized by a period T and a deadline D ≤ T. For every task the system proves that its worst-case response time R satisfies R ≤ D under all admissible input and interference conditions. Because L1 avoids preemptive multitasking on its critical paths — logic is spatial in the FPGA rather than time-shared — interference terms are eliminated by construction rather than bounded by analysis alone.

Composability

Bounds must compose. If acquisition is bounded by A, processing by C, and delivery by L, the end-to-end bound is A + C + L only when the three stages do not contend for a shared resource. Kronos enforces this with dedicated fabric regions, dedicated links, and a time-triggered schedule so that adding one loop cannot inflate another's worst case.

• No unbounded loops or data-dependent iteration on critical paths.
• No dynamic memory allocation in the actuation datapath.
• No shared mutable state between independent protection channels.
• Every path has a synthesis-time WCET, archived with the bitstream.

Consequences for design

Hard bounds force honesty about what can be computed in time. Complex model inference cannot meet a 10 µs deadline, so it is placed at L3 as advisory. L1 carries only what is provably fast. This is the architectural reason Kronos separates determinism from learning rather than embedding a network in the fast loop.