The ML-Independent Hardware Failsafe

The last line of defense contains no machine learning and no general-purpose software; it trips to a defined safe state through logic simple enough to certify by inspection.

Trust requires independence from intelligence

Every AI component at Kronos — the twin, the copilots, the MPC agents — can be wrong, stale, or absent. The failsafe is the layer that must still work when they are. It is therefore built with no dependence on any learned model, no dependence on the supervisory network, and where possible no dependence on running software at all: comparators, latching logic, and energy-dump hardware that default to safe on loss of power or loss of heartbeat.

What the failsafe does

• Continuously compares a small set of hardwired safety signals against fixed thresholds.
• On any breach, latches a trip and drives every actuator to its defined safe state.
• Requires no arbitration, no model inference, and no supervisory permission to act.
• Is fail-safe by default: loss of power, clock, or heartbeat itself causes a safe trip.

def failsafe_trip(signals, thresholds, heartbeat_ok, power_ok):
    # pure combinational logic: any breach OR loss of liveness -> trip
    breach = any(s > t for s, t in zip(signals, thresholds))
    if breach or (not heartbeat_ok) or (not power_ok):
        return 'TRIP -> safe state'      # latched until manual reset
    return 'permit'

The failsafe deliberately cannot be talked out of a trip by anything upstream. A model that is confident the machine is fine has no channel to suppress a hardwired trip. This asymmetry — intelligence can request action but never veto safety — is the core of the design and the reason the safety case can be argued without reference to any AI behavior.

This is also why the failsafe is validated by fault injection rather than by argument about the AI's behavior. Because it depends on no learned component, its correctness is a property of a small, fixed piece of logic that can be exhaustively tested against every trip condition. The safety authority can sign off on the failsafe without ever reasoning about model accuracy, training data, or distribution shift, which is exactly the independence that makes an AI-heavy plant certifiable at all.

The failsafe is validated by fault injection during commissioning and re-proven at intervals by proof testing. Its relationship to the intelligent layers is spelled out in tier separation.