Hardwired Interlock Matrix

The interlock matrix expresses which states permit which actions in permissive logic that lives outside software, so no software fault can grant a forbidden action.

Permissives, not permissions

An interlock is a permissive: it does not command anything, it only allows or forbids. The interlock matrix encodes the full set of preconditions for every energetic action — opening a high-vacuum valve, energizing a coil supply, firing a beam — as combinational logic in hardware. The reflex loop can request an action, but the action only proceeds if the matrix reads permissive.

Example: coil energization permissive

Every zero in the permit column is a state where energizing the coil would be unsafe: cryogenics not ready, vacuum lost, a quench indication present, or the energy-dump path not armed to catch a fault. The matrix makes these preconditions explicit and enforces them in logic that no model and no operator keystroke can bypass without an audited exception.

def energize_permit(cryo_ok, vac_ok, quench_clear, dump_armed):
    return cryo_ok and vac_ok and quench_clear and dump_armed

# permissive is AND of independent conditions -> any missing input = deny
assert energize_permit(1,1,1,1) and not energize_permit(1,1,0,1)

The matrix is intentionally static: its logic is fixed for a given machine configuration and changes only through a controlled engineering process, never at runtime and never by a model. This is what lets a reviewer read the matrix once and know the permissive conditions for every energetic action. Runtime flexibility lives entirely above the matrix, in the supervisory tier, which can only ever request actions the fixed permissives already allow. Because the matrix reads unknown or stale inputs as not-permissive, a degraded sensor closes an interlock rather than opening one, so the failure of an input can only ever make the machine more conservative, never less.

The matrix is deliberately conservative: unknown or stale inputs read as not-permissive, so a lost sensor closes the interlock rather than opening it. Bypassing an interlock for maintenance is possible but tightly governed — see interlock bypass governance. The matrix feeds the synchronized actuation gates as the interlocks-clear term.