The Safety Hierarchy and AI

Safety is layered: deterministic hardware at the floor, bounded control above it, and AI advisory at the top — the higher the intelligence, the less it can harm.

Safety in layers

The architecture arranges safety as a hierarchy in which certainty decreases and intelligence increases as you go up. The floor is deterministic hardware that cannot be reasoned around; the ceiling is advisory AI that cannot, on its own, do anything irreversible. Between them, control is intelligent but bounded.

The hierarchy, floor to ceiling

• Floor — the autonomous hardware failsafe and deterministic interlocks; zero AI dependency.
• Below-mid — L1 deterministic control within the sub-10-microsecond boundary.
• Mid — L4 rules engine and safety bounds that gate every command.
• Upper — L3 MPC and predictions that propose, never dispose.
• Ceiling — L5 copilots and L6-L7 humans and strategy, advisory and confirmatory.

The inverse relationship

The defining property is inverse: the more autonomous and intelligent a layer, the less directly it can cause harm. A copilot's mistaken suggestion is caught by safety bounds; an MPC agent's bad trajectory is rejected by the rules engine; and if everything above fails, the physical floor still protects the magnets. Intelligence is allowed to be fallible precisely because it is never the last line.

Why this ordering is non-negotiable

Fusion hazards — quench, disruption — are fast and unforgiving. Placing the most certain mechanism closest to the hazard, and the most fallible one farthest from it, is the only ordering that lets the plant be both aggressive in its intelligence and conservative in its safety. Reversing any step would put a less certain mechanism between a hazard and its response.

The floor is the autonomous failsafe; the ordering is an application of determinism versus intelligence.