Watchdog Timers and Heartbeats

Every L1 controller proves it is alive by servicing a watchdog; a missed heartbeat forces the guarded actuator into its safe state.

Detecting a stuck controller

A controller can fail silently — hung, stalled, or looping — while its last output lingers on an actuator. Watchdog timers catch this. Each controller must periodically service (kick) a hardware watchdog; if it fails to within the timeout, the watchdog assumes the controller is dead and forces the guarded actuator to its safe state.

Heartbeats across the fabric

Beyond a single watchdog, L1 nodes exchange heartbeats on the deterministic fabric so peers and supervisors know each node is alive and on time. A missing heartbeat is treated like a fault: authority is withdrawn from the silent node and its actuators default safe, per each function's fail-safe or fail-operational disposition.

Design points

• Watchdog timeout set below the actuator's safe-response requirement.
• The kick must depend on the controller actually completing its work, not a dumb timer.
• Watchdog action is hardware, independent of the controller it guards.
• Heartbeat loss is logged and raises a supervisory alarm.

A subtlety: a naive watchdog kick on a fixed schedule can hide a controller that runs but computes garbage. Kronos ties the kick to evidence of correct completion — the controller must reach its output stage to service the watchdog — so the watchdog detects functional failure, not just total halt.

Part of the safety net

Watchdogs and heartbeats complement redundancy and interlocks: redundancy masks a fault, watchdogs detect a stalled channel, interlocks deny unsafe action. Together they ensure that no L1 component can fail in a way that leaves an actuator stuck in a dangerous state. The independent hardware failsafe underneath means even a total control-plane failure is caught.