Jitter and Determinism Bounds

A deadline met on average is a deadline missed under load; the reflex tier is engineered for bounded worst-case jitter, not good typical behavior.

Determinism is a worst-case property

Determinism on the reflex path means the response time is bounded above by a value that holds under every admissible input and load. Average latency is irrelevant to safety; only the tail matters. Kronos designs the fast path so its distribution has a hard right edge, not a long tail.

Sources of jitter, and how each is bounded

• Clock jitter: bounded by a distributed reference (PTP-disciplined) and cycle-accurate FPGA logic.
• Contention: eliminated on the fast path — no shared buses, no locks, no OS scheduler.
• Cache / pipeline effects: absent in the FPGA datapath; every stage is fixed-latency logic.
• Link variability: point-to-point deterministic serial with fixed framing, not switched Ethernet.

def deadline_ok(wcet_ns, jitter_ns, deadline_ns):
    # the loop is safe only if worst case + jitter still fits
    return (wcet_ns + jitter_ns) <= deadline_ns

# fast protection path: 4400 ns WCET, 800 ns bounded jitter, 10 us deadline
assert deadline_ok(4400, 800, 10_000)

def utilization(wcet_ns, period_ns):
    return wcet_ns / period_ns          # keep well below 1 for headroom

The design target keeps loop utilization low so that even the worst admissible tick leaves slack. Utilization near unity is a design smell: it means the deadline is met only when nothing goes wrong, which is precisely when safety loops must not fail.

The empirical check matters as much as the analytic bound. Kronos captures long-run latency histograms in operation and confirms the measured maximum sits inside the static WCET, with the jitter margin unspent. A drift in the empirical tail — even one that never breaches the deadline — is treated as a leading indicator of a hardware or configuration problem and investigated before it grows into a real miss. Determinism is thus maintained, not merely asserted once at design time.

Determinism is verified two ways: static worst-case execution time analysis of the FPGA datapath, and long-run capture of the measured latency distribution to confirm the empirical tail sits inside the analytic bound. Both must agree before a loop is cleared for operation.