Safety-Case Replay and Decision Evidence

Every trip, override, and gated action is recorded with enough fidelity to replay the event deterministically and prove the safety layers behaved as designed.

Prove it, don't assert it

A safety architecture is only credible if you can show, after the fact, that it did what it was designed to do. Kronos records the reflex tier's inputs, decisions, gate states, and trips with timestamps precise enough to reconstruct any event. The record is captured on a path independent of the control decision, so logging cannot slow or perturb the reflex it observes.

What is captured

• The validated state vector feeding each reflex decision, at loop cadence.
• Every gate open/close, interlock permissive, and vote outcome, with cause.
• Every trip: which condition, at what value, and the resulting safe-state path.
• Every human action: who, what, when, and the authority exercised.

def replay(recorded_inputs, reflex_fn):
    # deterministic reflex + recorded inputs -> reproduce every decision
    outputs = [reflex_fn(x) for x in recorded_inputs]
    return outputs

def matches_live(replayed, recorded_outputs):
    # replay must reproduce the live decisions bit-for-bit
    return all(a == b for a, b in zip(replayed, recorded_outputs))

Because the reflex tier is deterministic (see cycle-accurate FPGA pipeline), replaying the recorded inputs through the same logic must reproduce the recorded decisions exactly. A mismatch means the record, the logic, or an assumption is wrong — a finding in itself. This bit-exact reproducibility is the backbone of the safety case.

The independence of the logging path is what makes the evidence trustworthy. Recording runs on a separate path from the control decision, so capturing an event can neither slow nor perturb the reflex it observes, and the record cannot be shaped by the same fault it is meant to document. This separation, plus the bit-exact reproducibility of the deterministic reflex, lets a reviewer replay any trip and confirm the safety layers behaved as designed rather than take the operator's word for it.

Replay serves three audiences: engineers debugging an event, the safety authority validating the protection functions, and regulators reviewing the design. It draws on the same deterministic-replay capability used in the data fabric, applied here specifically to safety evidence. It underpins commissioning validation and the periodic re-proof in proof testing.