Engineering lab · Control-system simulation
Project Aegis: Deterministic Quality Cell
Deterministic control, fault handling, and recovery in a simulated production cell.
A simulated production cell for exploring deterministic control, interlocks, fault handling, recovery, and machine telemetry.
Try this Power On, Start, Inject Part. Then inject a conveyor jam mid-transport and try to start again — the refusal is the point.
Machine POWERED OFF. No active alarms.
Operator console
Machine status
POWERED OFF
No process running · T+00:00.000 · no part in cell
The controller is powered down. Every commanded output is off and no production is possible.
Start permissives
- Controller powered
- Blocked
- E-stop clear
- Met
- No active fault
- Met
- Machine idle
- Blocked
- Conveyor clear
- Met
- Presence sensor healthy
- Met
- Inspection available
- Met
Operator commands
Operator commands are requests. The controller decides whether to honor them, and refuses with a reason when it will not.
Safety input · simulated
Released
Simulated only. It latches the cell until an explicit reset, and it is not a safety-rated function.
Command feedback
No command outstanding.
Active alarm
No active alarms.
The cell
Five stations in sequence. Every status below is derived from controller state — there is no separate animation timeline that could disagree with the machine.
- 01
Part source
Offline - 02
Conveyor
Offline - 03
Presence sensor
Offline - 04
Inspection
Offline - 05
Pass / reject sorter
Offline
Last disposition
No part has completed a cycle yet.
Controller outputs
Derived from controller state. Nothing on this page can set them directly.
- Conveyor motor
- Off
- Source release
- Blocked
- Inspection trigger
- Idle
- Reject gate
- Home
- Alarm
- Off
Cell statistics
- Parts released
- 0
- Accepted
- 0
- Rejected
- 0
- Aborted
- 0
- Cycles completed
- 0
- Commands rejected
- 0
Aborted parts left the cell without an inspection result, so they are counted separately rather than folded into the reject total.
Fault injection · environment
These change the environment the machine is reacting to, not the rules it follows. That distinction is the point: an operator command asks the controller for something, an injected condition simply becomes true.
Conveyor
Clear
Presence sensor
Healthy
Inspection system
Available
Next inspection result
Pass
A failed inspection is simulated part quality, not an equipment condition. Disabling the inspection system is the equipment condition, and the controller treats the two very differently.
Event log
Times are controller ticks measured from power-on, not your clock. The same command sequence always produces the same log.
No events yet. Power the controller on to start the log.
The controller behind it
Machine behavior here is determined by explicit state, inputs, interlocks, and controller rules — not by what the interface happens to allow you to click.
The interface never sets an actuator. A button posts a command; the controller evaluates that command against the current state and the interlocks, and only then does an output change. That is why an illegal action produces a stated reason instead of silently doing nothing.
A permissive is a condition that must hold before an action may begin — the checklist at the door. An interlock is a rule that holds throughout, whatever anyone asks for. Start has seven permissives; the conveyor has an interlock that keeps it off while the machine is faulted.
Machine state and process phase are separate concepts. The machine state says what the controller is allowed to do. The process phase says where a part is in the cycle. A cell is RUNNING while it moves through waiting, releasing, transporting, inspecting, sorting and completing — those are not machine states.
Recovery is deliberately unhelpful. Clearing a jam does not restart production. Releasing the simulated E-stop does not restart production. A successful reset always lands in Idle and never in Running, so returning to production is always an explicit operator decision.
Machine states
Controller powered down. Every commanded output is off.
Power On → Idle, or E-Stopped if the E-stop latch is still set.
Powered and ready. No production motion.
Start → Starting, but only when every permissive holds. E-stop → E-Stopped. Power Off → Powered Off.
Startup permissives are re-verified. No motion is commanded during the check.
Checks pass → Running. A permissive drops, or Stop → Idle. E-stop → E-Stopped.
Production enabled. The controller advances the process phase.
Stop → Stopping. Jam, missed detection or unavailable inspection → Faulted. E-stop → E-Stopped.
Controlled stop. No new part may enter; a part already travelling runs to a real disposition.
Cycle finished → Idle. Fault → Faulted. E-stop → E-Stopped.
Production stopped on a controller-detected fault. Outputs held safe, fault latched.
Reset, once the cause is clear → Resetting. Never directly to Running. E-stop → E-Stopped.
Simulated emergency stop latched. Outputs held safe. Releasing the input does not clear the latch.
Reset, once the input is released → Resetting. Power Off → Powered Off.
Deterministic recovery checks before the controller returns to service.
Checks pass → Idle, always. A cause re-asserts → back to Faulted or E-Stopped.
Commands
Power On
Powered Off only.
Enters Idle, or E-Stopped if the E-stop latch survived the power cycle.
Power Off
Any powered state.
Forces every output safe, aborts any part in the cell, and clears production progression. Counters and the event log are kept.
Start
Idle, and only when all seven permissives hold.
Enters Starting, then Running once the checks re-verify.
Stop
Running, and Starting.
Blocks any new part and enters Stopping. From Starting there is nothing in process, so it returns to Idle.
Simulated E-Stop
Any state. It is an input, not a request.
Latches immediately, forces outputs safe, aborts the part in the cell, and enters E-Stopped.
Reset
Faulted or E-Stopped, once every cause is clear.
Runs recovery checks and returns to Idle. Never to Running.
Inject Part
Running, while the cell is waiting for a part.
Requests one part. The controller releases it on the next scan.
Next Inspection
Any state. It is simulated part quality, not a machine condition.
Selects the result the inspection station will report. Latched into the part when inspection begins.
Interlocks
- 01The conveyor cannot be commanded while the machine is faulted or E-stopped.
- 02The source cannot release a part unless the machine is Running.
- 03No new part may be released once a controlled stop has begun.
- 04An active fault, a latched E-stop, or any failed permissive prevents a start.
- 05Inspection that is unavailable when it is needed faults the machine; it never defaults a part to pass.
- 06A part cannot be accepted without a completed inspection pass.
- 07A reset requires every blocking cause to be clear, and always ends in Idle.
Where this goes next
Project Aegis is a multi-milestone build. This page is M0 and M1: the deterministic control foundation — explicit state, interlocks, faults, recovery, and machine telemetry — and nothing beyond it. The name of the page describes what is actually running, not what the project intends to become.
Later milestones extend the same controller: a richer process model, alarm history and operator authority, production quality analysis, industrial cybersecurity, and a physical prototype with the control model translated toward a PLC.
A constrained diagnostic AI layer belongs to a later milestone too, and it is bounded by design: advisory only, never required for safe machine operation, and never in control of a production-critical output. None of it exists yet, and nothing on this page pretends otherwise.
The broader “secure autonomous” description belongs to the finished system once security and autonomy have actually been built and tested. This milestone has not earned it.
What this is not
This is a browser simulation of control-system concepts. It is not a safety PLC, not safety-rated control, not a certified emergency-stop implementation, and not evidence of compliance with any machinery safety standard. The emergency stop here is a simulated input to a simulated controller; it models control-state behavior only.
Nothing here replaces a risk assessment or physical machine validation. The value of the model is that the rules are explicit and testable, not that it resembles a real machine's screen.