Cryogenic Flow Simulation

Control sequences are difficult to rehearse when the real facility is unavailable, incomplete, or too costly to place into every fault and boundary condition. The simulator needed reproducible state transitions across valves, tanks, pipes, and instrumentation without depending on live hardware.

A simulation that hides its assumptions can create false confidence at the exact conditions where engineering errors are most costly: low temperatures, pressure differentials, actuator timing, alarms, and recovery sequences.

• All behavior must be deterministic from a fixed seed so artifacts are reproducible and auditable.
• No live hardware dependency; the simulation must run entirely from a Rust service with a browser-rendered UI.
• The capture pipeline must verify its own output with measurable thresholds, not just visual inspection.
• The current demonstration is not plant-calibrated, connected to PLC or DCS control logic, safety-authoritative, or an operational digital twin.
• Every increment is graded against an exit criterion fixed before the work starts; a milestone that misses a clause is recorded as not verified, never softened to pass.

Controls-domain translation, Rust workspace architecture, simulation implementation, capture pipeline, and artifact validation.

Since September 2026 the workspace also holds a fault library with a declared 13-mode supported set and a connection-seam leak that modifies process truth, a versioned imported-model contract that accepts only repository-authored synthetic sources, a per-commodity liquid property path for oxygen and nitrogen from a pinned MIT-licensed source, a software controller inside the core, a practice engine graded as an engineering demonstration, a renderer-neutral read-only projection contract with a browser 3D proof, and a localhost Unreal Engine 5.8.2 adapter whose WebRTC signalling is relayed by the Rust service. A Rust workspace drives three crates: cryo-core owns the physics domain model, cryo-service exposes an Axum HTTP layer, and cryo-web serves the browser-rendered SVG/HTML/CSS dashboard. Playwright orchestrates the Stage 1 capture scenario and validates the artifact.

Architecture descriptionA three-crate Rust workspace with a physics core, Axum service layer, and browser-rendered SVG/HTML/CSS dashboard captured by a Playwright scenario harness.

The scaled system ran 29,500 entities at 30 Hz and recovered to 30 Hz after deliberate overload. Its fixed-seed deterministic capture produced 1,800 frames with raw output pinned by SHA-256 inside the same executable, seed, GPU-adapter, and driver scope. Coordinated close, open, and restore waves moved across all 15,000 valves; the shipped video changed 24.3% of label-excluded fleet pixels versus a legacy 1.0% whole-percent comparator. A measured warmed 5.29 MB full JSON state snapshot compared with a 6.8 KB representative warmed binary delta, about 779× smaller, with static layout retained separately. Between 2026-09-07 and 2026-09-11 the project then ran as a milestone program: ten milestones, each with an exit criterion fixed before the work, a pre-registered budget file and negative controls, graded clause by clause with three verdict states (pass, fail, unmeasurable) and recorded in a private program repository with every decision and evidence record. The last graded commit passed 734 workspace tests with the reference run's final state hash unchanged across every increment, and the localhost Unreal Engine camera showed a seam-vapour cue 109 ms after the adapter applied it.

• Deterministic seeds make simulation artifacts auditable in a way that live hardware captures cannot be.
• Separating domain logic into a no-I/O core crate forces the physics model to be fully unit-testable before any service or UI code depends on it.
• Threshold-based artifact validation is more trustworthy than visual inspection alone, but the thresholds need calibration against known-good runs.
• An instrument can pass a black frame: the first packaged Unreal scene rendered black because a rotator's positional order is (roll, pitch, yaw), and a file-existence check and an orphan count by the wrong process name both graded it a pass. Both instruments were corrected before any verdict, and a still now carries its measured luminance.
• A measurement can name the wrong column: a memory gate summed working sets and read a 14-process browser at 1.03 GiB for the page a 7-process browser rendered at 0.63 GiB; the gate moved to private resident bytes with every earlier reading retained and the budget unmoved.
• The instrument's browser is not the owner's browser: ten automated runs of the streamed camera passed while the owner's own browser showed no video, because a decoded-frame callback never fires for a background tab. First-frame detection now uses three signals, and a visual is verified in the owner's client before acceptance.