AI Control Beneath Deterministic Safety

Advanced control keeps the plasma burning, but safety never depends on it — simple fail-safe interlocks sit above the AI layer.

Holding a fusion plasma at its operating point is a demanding real-time control problem, and Kronos uses advanced, learning-based control to do it well. But a clear architectural rule governs the safety case: safety never depends on the AI. The intelligent layer optimizes performance; a separate, simple, deterministic interlock layer guarantees the safe state.

The layered architecture

• Top layer — safety interlocks: deterministic, fail-safe, independent; can always terminate the burn.
• Middle — conventional control: proven feedback loops for core plant functions.
• Bottom — AI performance control: optimizes and stabilizes the burn, supervised by the layers above.

If the AI control were to behave unexpectedly, the outcome is bounded by the layers above it and by the physics below it: the safety interlocks trip on out-of-bounds conditions, and the plasma — being self-limiting — ends the burn if control is lost. The AI can make the machine perform better; it cannot make it unsafe, because it is not trusted with safety.

Why this is the right structure

Complex, learned systems are hard to prove exhaustively. By keeping them out of the safety-critical path, Kronos keeps the safety case tractable: it rests on simple deterministic logic and inherent physics, both of which can be analyzed and defended. See control-system safety and passive safety by physics.

Advanced control earns its place on performance; safety is reserved for the simple, provable layer above it.