Operator Abort and Manual Trip

A human can always take the machine to safe state through a path that does not route through the AI, the network, or ordinary software.

The button that always works

The manual trip is the human end of the failsafe. It must work when everything else has failed: no dependence on the copilots, the twin, the supervisory network, or the control application. Kronos routes the manual abort through the same hardwired, fail-safe path as the automatic failsafe, so pressing it commands the machine to its defined safe state directly.

Design requirements

• Hardwired: the trip signal reaches the failsafe logic without traversing general-purpose software.
• Always available: no operating mode disables it; it is not gated by authority level.
• Unambiguous: a single, clearly identified control per station, with no confirmation that could delay it.
• Latching: a trip stays tripped until a deliberate, authorized reset and investigation.

def manual_trip(button_pressed, failsafe):
    # direct path to the failsafe; no model, no network, no permission check
    if button_pressed:
        failsafe.latch_trip()
        return 'TRIP -> safe state (hardwired)'
    return 'armed'

The manual trip is deliberately dumb. It does not ask the AI whether a trip is warranted, does not weigh the loss of a pulse, and does not require the operator to justify it in the moment. A spurious trip is an acceptable outcome; a suppressed real trip is not. Investigation happens after the machine is safe, not before it is made safe.

Its deliberate dumbness is a feature, not a limitation. By refusing to weigh the loss of a pulse, ask the AI for a second opinion, or require justification in the moment, the manual trip removes every path by which a real emergency stop could be delayed or argued down. The consequences of a spurious trip are handled after the machine is safe; nothing is allowed to stand between a worried human and the safe state, which is the whole point of a last-resort control.

Because the manual trip shares the ML-independent failsafe path, it inherits the same certification argument: the human's ability to stop the machine does not depend on any AI being correct or even present. Every manual trip is logged for the safety case, and re-arming follows the reset governance in bypass and reset governance.