Cryogenic Flow Simulation

Control sequences are difficult to rehearse when the real facility is unavailable, incomplete, or too costly to place into every fault and boundary condition. The simulator needed reproducible state transitions across valves, tanks, pipes, and instrumentation without depending on live hardware.

A simulation that hides its assumptions can create false confidence at the exact conditions where engineering errors are most costly: low temperatures, pressure differentials, actuator timing, alarms, and recovery sequences.

• All behavior must be deterministic from a fixed seed so artifacts are reproducible and auditable.
• No live hardware dependency; the simulation must run entirely from a Rust service with a browser-rendered UI.
• The capture pipeline must verify its own output with measurable thresholds, not just visual inspection.
• The current demonstration is not plant-calibrated, connected to PLC or DCS control logic, safety-authoritative, or an operational digital twin.
• Every increment is graded against an exit criterion fixed before the work starts; a milestone that misses a clause is recorded as not verified, never softened to pass.

Controls-domain translation informed by Siemens and Rockwell PLC experience, Rust workspace architecture, simulation implementation, capture pipeline, and artifact validation.

The new process plant keeps three independent circuits inside the existing Rust simulation actor. Each vessel stores mass, internal energy and volume; a bounded pure-fluid saturation table determines its pressure, temperature and phase inventory. Valve travel, enthalpy transfer, heat ingress, vapor discharge and spill evaporation change that state. A pushed snapshot feeds the browser SVG/HTML/CSS P&IDs and qualitative canvas field view; page selection changes only the view. Blender-authored equipment and a separate Unreal scene provide a native visual presentation of recorded state. The earlier LOX topology, large generated fleet, fault library, controller and Unreal camera retain their own evidence boundaries.

Architecture descriptionOne Rust simulation clock advances nitrogen, argon and pure methane circuits; snapshots drive instrumented browser pages and recorded Blender and Unreal field effects.

The new circuits run together while the operator changes pages. A nitrogen leak feeds a boiling pool; isolation closes the valve while residual liquid keeps evaporating. Methane pilot loss extinguishes the flare and raises an alarm. Live P&ID footage and an explicitly labeled native replay show those behaviors alongside the project's retained scale and camera evidence.

• A dramatic effect needs a physical cause: nitrogen and argon do not burn, a boiling spill can leave liquid after isolation, and frost belongs on cold exposed surfaces or failed insulation. The UI and native scene consume process state; their appearance does not validate consequence physics.
• Deterministic seeds make simulation artifacts auditable in a way that live hardware captures cannot be.
• Separating domain logic into a no-I/O core crate forces the physics model to be fully unit-testable before any service or UI code depends on it.
• Threshold-based artifact validation is more trustworthy than visual inspection alone, but the thresholds need calibration against known-good runs.
• An instrument can pass a black frame: the first packaged Unreal scene rendered black because a rotator's positional order is (roll, pitch, yaw), and a file-existence check and an orphan count by the wrong process name both graded it a pass. Both instruments were corrected before any verdict, and a still now carries its measured luminance.
• A measurement can name the wrong column: a memory gate summed working sets and read a 14-process browser at 1.03 GiB for the page a 7-process browser rendered at 0.63 GiB; the gate moved to private resident bytes with every earlier reading retained and the budget unmoved.
• The instrument's browser is not the owner's browser: ten automated runs of the streamed camera passed while the owner's own browser showed no video, because a decoded-frame callback never fires for a background tab. First-frame detection now uses three signals, and a visual is verified in the owner's client before acceptance.