Threat Model: Actuator Manipulation
Even with valid-looking commands, actuator behavior is bounded by rate limits, interlocks, and an independent shutdown path so manipulation cannot exceed a safe envelope.
The last-mile of an attack
Actuators - magnet power supplies, gyrotron and neutral-beam heating, gas and pellet injection, and the burner's high-field plug/throat coils and direct-conversion grids - are where any attack must ultimately land to cause physical harm. Kronos assumes an attacker might issue commands that pass upstream checks and asks: can the actuator layer itself refuse to do something unsafe? The answer is designed to be yes, within a bounded envelope.
Envelope enforcement at the actuator
- Rate and magnitude limits enforced in the actuator controller, independent of the commanding node - a ramp toward 16.84 T peak cannot exceed safe di/dt regardless of the command.
- Hardware interlocks that trip on physical limits (current, temperature, field) without software mediation.
- Cross-checks: a commanded action inconsistent with plant mode or with other actuators is refused.
- The independent SIS can de-energize actuators outside the control plane's authority.
| cmd valid identity | within envelope | interlocks clear | EXECUTE |
|---|---|---|---|
| 1 | 1 | 1 | 1 |
| 1 | 1 | 0 | 0 |
| 1 | 0 | 1 | 0 |
| 0 | 1 | 1 | 0 |
Defense in depth against a valid-but-malicious command
The truth table above shows execution requires all three: authenticated identity (identity), being within the physical envelope, and interlocks clear. A command with a stolen but valid identity that asks for an out-of-envelope action still fails on the middle column. This layering is what makes a single compromised credential insufficient to cause harm.
Design status
Envelope logic and interlock trip conditions are implemented in actuator-controller models and hardware-in-the-loop rigs. The hardware interlocks and the SIS de-energization paths are FOAK build scope; no live reactor actuator is yet under this regime. For the burner specifically, recall the plug coil is overstressed ~3-3.9x at the design bore - a physics feasibility gate that constrains the machine independently of any cyber control.