The Gatekeeper Decision Layer
A gatekeeper continuously decides whether to keep pushing performance, hold, or abandon the discharge, arbitrating avoidance and mitigation.
The decision at the top of off-normal handling
During a discharge, one question recurs: is it safe to continue toward the performance goal, or should the system back off or stop? A gatekeeper is the decision layer that answers this continuously, weighing the proximity to disruptive boundaries against the value of continuing. It is the arbiter between avoidance and mitigation.
Inputs
- Disruption-proximity indicators from the predictor
- Actuator headroom, how much authority remains to correct
- Progress toward the scenario goal
- Health of diagnostics and controllers
The core logic
The gatekeeper compares proximity to boundaries against remaining actuator authority. If margin is comfortable, it lets performance control continue. If margin shrinks but authority remains, it commands avoidance actions to restore margin. If margin is lost and authority is exhausted, it triggers a controlled ramp-down, and only if that is impossible does it release mitigation.
Why it must be automated
These decisions unfold in milliseconds, faster than a human can judge. The gatekeeper encodes the operators' intent as automated logic so the right decision is made in time. Its rules are made explicit and reviewable, so operators can trust and audit the choices it makes on their behalf during a shot.
In the Kronos program
The Hyperion breeder's gatekeeper implements the avoidance-first strategy: it prefers restoring margin, then safe termination, and treats mitigation as a last resort. It draws on the disruption predictor and the actuator allocator to know both the threat and the available authority. Its decision logic is exercised across normal and fault scenarios in the flight simulator ahead of operation.