The L1 Deterministic Reflex Loop

L1 is the hard real-time reflex tier: a fixed-latency sense-decide-actuate loop whose worst-case timing is proven, not measured after the fact.

What the reflex loop is

The Kronos control stack separates intelligence from reflex. Learning-based control lives in L3 on a 50–100 ms predictive shadow; the reflex loop lives in L1 and runs on edge FPGAs with a fixed, provable cycle. Its job is to hold the breeder (Hyperion) and burner (Aegis / MetroVolt) inside a hardware-defined operating envelope regardless of what any model does or fails to do.

A reflex loop is a strict pipeline: acquire the validated state vector, evaluate bounded control laws and envelope checks, arbitrate the resulting commands, and gate them onto actuators. Every stage has a budgeted, bounded execution time. The pipeline is data-flow, not event-driven, so there is no queue whose depth can grow without bound.

Loop invariants

• Fixed cycle period T_loop with hard deadline equal to the period.
• No dynamic memory allocation, no unbounded loops, no locks on the fast path.
• Every output is a function of the current validated inputs plus fixed state.
• The failsafe branch is reachable in one cycle from any state.

# The reflex cycle, conceptually: fixed work per tick, hard deadline
def reflex_tick(state, T_loop_s):
    x  = read_validated_state()      # bounded: fixed channel count
    u  = bounded_control_law(x)      # affine / lookup, no iteration
    u  = envelope_clamp(u, x)        # range + rate-of-change limits
    if not within_envelope(x):
        return drive_failsafe()      # single-cycle escape
    return gate_actuators(u)

# deadline == period: the loop must finish inside its own tick
assert wcet(reflex_tick) < T_loop_s

A useful mental model is that L1 is a governor, not a driver. It does not try to make the plasma perform; it makes sure the plasma cannot do anything the hardware cannot survive. Performance is the supervisory tier's problem and can be as clever as it likes, because it can only ever move setpoints inside a box L1 refuses to let it leave. That division is what keeps the reflex tier small, auditable, and stable across firmware and model changes above it.

The remainder of this category decomposes each element of that tick: the sub-10µs latency budget, the synchronized actuation gates, and the ML-independent failsafe that makes the whole design certifiable independent of the AI layers above it.