Interlock Logic Hardware

Machine-protection interlocks are implemented in dedicated hardware whose safe state is the default, so a failure denies rather than grants dangerous action.

Interlocks as a safety layer

An interlock is a permissive: a condition that must be true for an action to be allowed. Kronos implements the machine-protection interlock matrix in dedicated logic — PLC and hardwired relay/comparator chains — separate from the control loops that request actions. The interlock layer does not optimize anything; it only says yes or no, and it says no by default.

Design rules

• De-energize-to-trip: loss of power or signal forces the safe state.
• Independence: the interlock chain does not share components with the loop it guards.
• Simplicity: logic is inspectable so it can be certified.
• Latching: a trip persists until deliberate, evaluated reset.

Composition

Interlocks compose as a conjunction of permissives. An actuator's enable is the AND of every relevant safety condition; if any is false the enable drops. Because the composition is boolean and static, its behavior is fully enumerable — there are no data-dependent surprises. This is what lets a safety reviewer sign off on the interlock matrix line by line.

Interlocks and controllers

The FPGA and PLC controllers request actuation; the interlock layer grants or denies it. A breeder PF-coil supply cannot be driven unless coil-protection, cooling, and vacuum permissives are satisfied; a burner DEC grid cannot be energized unless the plug and vacuum states are proven. The interlock is thus the arbiter between intelligent intent and physical authority, upstream of the command arbitration layer and consistent with the hardware failsafe philosophy.