Reflex and Supervisory Tier Separation
Intelligence proposes on a slow horizon; reflex disposes on a fast one. Keeping these tiers physically separate is what lets the safety case ignore the AI entirely.
Two clocks, two mandates
Kronos runs two control mandates on two different clocks. The supervisory tier (L3 model-predictive control, twin-informed optimization) plans setpoint trajectories on a 50–100 ms horizon. The reflex tier (L1) enforces safety on a microsecond-to-millisecond horizon. The reflex tier never waits on the supervisory tier and never trusts it beyond a clamped setpoint.
What crosses the boundary
| Direction | Payload | Trust level |
|---|---|---|
| L3 to L1 | clamped setpoint + validity | advisory, re-checked |
| L1 to L3 | validated state + gate status | authoritative |
| L1 internal | failsafe trigger | authoritative, immediate |
Setpoints from above are treated as suggestions until L1 re-validates them against the live envelope. If the supervisory link goes silent, stale, or produces an out-of-envelope value, L1 falls back to a safe holding law without any supervisory input at all. This is the property that lets the failsafe be certified independently — see the ML-independent failsafe.
def accept_setpoint(sp, live_envelope, age_ms, max_age_ms=150):
if age_ms > max_age_ms:
return holding_law() # stale supervisory link
if not live_envelope.contains(sp):
return live_envelope.clamp(sp) # trust, but verify + clamp
return spThe boundary is also a security boundary. Because the reflex tier accepts only clamped setpoints and never executable logic from above, a compromised supervisory node cannot induce an unsafe action — the worst it can do is propose values that L1 clamps or rejects, or fall silent, which triggers the holding law. Keeping the fast path free of any interpreter, script, or model weight means the certified safety behavior does not change when the software above it is updated, attacked, or replaced.
The separation is not only logical but physical: distinct compute (FPGA vs GPU/CPU), distinct networks, distinct power and clock domains. A fault that takes out the intelligence tier cannot propagate into the reflex tier, and the reflex tier can hold the machine safe with the intelligence tier entirely dark. Compare defense-in-depth layering.