Safety-Instrumented System Isolation
The safety-instrumented system is physically and logically independent of the control network, with a one-way status feed out and no command path in.
A shutdown that cannot be talked out of it
The safety-instrumented system (SIS) exists to place the machine in a safe state when defined limits are crossed. Its assurance comes from independence: it must not share failure modes, networks, or authority with the control system it protects. Kronos runs the SIS on separate hardware, separate networks, and separate power, with logic simple enough to verify exhaustively. Nothing on the control plane can disable or reprogram it during operation.
One-way relationship with control
- Status flows out: the SIS publishes its state to the supervisor for display, over a one-way link (conceptually a diode).
- No commands in: the control plane cannot arm, disarm, or retune the SIS remotely; changes require physical, two-person maintenance access.
- Distinct sensors: the SIS reads its own instrument channels, not the control system's, so diagnostic spoofing of the control loop cannot blind it.
- Distinct actuators: safe-state actuation paths are dedicated to the SIS.
Why sensor independence matters
If the SIS trusted the same diagnostics an attacker could spoof to fool the control loop, a single spoof could defeat both control and safety. Independent instrument channels mean an attacker would have to compromise two physically separate sensing chains to hide a limit violation from safety - a much higher bar.
Simplicity as a security property
The SIS logic is intentionally not an ML model or a general-purpose computer. It is small, deterministic, and formally analyzable, so its behavior under all inputs can be reasoned about. Complexity is where vulnerabilities hide; the safety layer minimizes it deliberately, in contrast to the model-rich control stack it guards.
Design status: the isolation architecture and one-way status feed are validated in the twin and bench rigs. The physically independent SIS hardware and its dedicated actuation are FOAK build scope; not yet operating on a reactor.