Why Eight Layers
Eight was chosen so that each layer holds a single latency and safety class — fine enough to isolate microsecond safety, coarse enough to reason about.
The case for eight
The layer count is not arbitrary. Kronos chose eight so that each layer contains functions of a single latency class and a single safety criticality — no layer mixes microsecond determinism with hour-long training, and no layer mixes hardware protection with strategy.
What each boundary buys
- L0 | L1 — separates offline compute from hard real-time; a training job cannot stall a control loop.
- L1 | L2 — separates deterministic actuation from best-effort telemetry.
- L2 | L3 — separates data curation from model inference; data faults are not model faults.
- L3 | L4 — separates prediction from orchestration and safety bounds.
- L4 | L5 — separates routing and rules from applications and copilots.
- L5 | L6 — separates reasoning from presentation to humans.
- L6 | L7 — separates in-plant experience from external ecosystem integration.
Why not fewer
Collapsing layers would couple concerns that must stay independent. Merging L1 and L3, for example, would put AI inference on the safety path — precisely what the architecture forbids. Merging L2 and L3 would blur the line between a bad sensor and a bad model. Each boundary exists to make a specific failure mode diagnosable.
Why not more
More layers would add interfaces without adding separable concerns, raising the verification burden without improving isolation. Eight is the smallest number that gives every distinct latency-and-safety class its own home. The result is a stack whose interfaces are few, explicit, and testable.
The isolation this buys is quantified in the latency gradient.