Sub-10 Microsecond Latency Budget

The fastest protection loops must close under 10 microseconds; this page decomposes that budget stage by stage and shows the timing margin.

Why sub-10 microseconds

The tightest reflexes on both machines — quench onset, plug-coil overstress, vertical displacement arrest — evolve on timescales where a millisecond loop is far too slow. Kronos budgets the fastest protection path at under 10µs end to end, from analog front-end to actuator gate, so the reflex acts inside the physical growth time of the fault it guards against.

Stage-by-stage budget

The budget is additive and every term is a worst case, not a mean. The sum must sit below the period with margin for jitter.

# Worst-case latency budget for the fastest protection path (ns)
budget_ns = {
    'analog_front_end':   400,   # anti-alias + settle
    'adc_conversion':     300,   # pipeline ADC, fixed latency
    'deterministic_link': 900,   # point-to-point serial, fixed hops
    'fpga_validate':      500,   # range/rate/consistency checks
    'fpga_control_law':   700,   # bounded, cycle-accurate
    'arbitration_gate':   400,   # command arbitration + interlock AND
    'driver_actuate':    1200,   # gate driver to power stage
}
total = sum(budget_ns.values())          # 4400 ns
deadline = 10_000                         # 10 us
margin = deadline - total                 # 5600 ns headroom
assert margin > 0 and total < deadline

The example sums to 4.4µs, leaving 5.6µs of headroom against the 10µs deadline. That headroom absorbs clock jitter, temperature-dependent propagation drift, and one retransmission on the deterministic link without breaching the deadline.

Budgets are re-verified whenever any stage changes: a new front-end filter, a longer link, or a deeper control law reopens the sum. The rule is that no single change may consume the jitter margin, because the margin belongs to determinism, not to feature growth. When a needed change would breach the deadline, the loop is re-partitioned rather than the deadline relaxed — slow reasoning moves upstream to the supervisory tier and only a clamped result returns to the fast path. The example here sums to 4.4µs against a 10µs deadline, but the headroom is not spare capacity to be filled — it is the reserve that absorbs jitter, drift, and one link retransmission, and it is defended as strictly as the deadline itself.

Budgets are per-path, not global: the equilibrium and shape loops run at a slower, still-deterministic cadence and carry their own budgets. See control-loop timing math for how loop period is chosen from the physics bandwidth, and jitter and determinism bounds for how the margin is defended.