Determinism vs Learning
Kronos separates the provably-timed control plane from the data-driven models above it, so intelligence can improve without ever endangering the deadline.
Two different jobs
Learning systems generalize from data; their runtime and outputs are data-dependent and, for deep networks, hard to bound. Control-plane logic must be timed and, on protection paths, provably correct. Kronos does not force these opposing properties into one component. It layers them: L3 learns, L1 acts.
The handoff
L3's MPC agents produce setpoint trajectories on a 50–100 ms shadow horizon — coil current profiles for the breeder's shape, plug-cell power for the burner, DEC grid schedules. These arrive at L1 as advisory targets. L1 validates them against static envelopes and executes them with deterministic loops. If the trajectory stops arriving, L1 holds the last valid target and its fast loops keep the machine safe.
Why the network is never in the fast loop
- A neural network's inference time varies with implementation and load; it cannot certify a 10 µs WCET on protection paths.
- Model outputs can be out-of-distribution; deterministic clamps bound them regardless.
- Retraining changes behavior; the fast loop must not change behavior without re-certification.
- A failsafe that depends on a model is not a failsafe.
Where learning helps most
Learning shines exactly where determinism is not required: predicting a breeder disruption precursor tens of milliseconds early so the deterministic avoidance loop is armed sooner; imputing a dropped diagnostic so the state vector stays complete; anticipating burner plug drift. Each raises the quality of the target L1 receives without touching L1's guarantees. The autonomous hardware failsafe is the extreme case: it has zero AI dependency by design.