A twin without the fault cannot certify the stop.

Video caption

A twin without the fault cannot certify the stop.

Commanded stop and measured motion are different.

Fault, sensor age, actuator delay and restart.

Let authorized commissioning settle the physical claim.

#EricFieldNotes

Full written post / accessibility read

An AI-drafted PLC change can pass a digital twin that never models a stuck-high jam sensor. In the fictional conveyor, the twin's sensor is always fresh and the drive stops instantly. The test is green because the hard behavior was never represented.

The PLC may command the motor off while the conveyor continues moving for a time, or the input may be stale. A unit test that checks only the output bit cannot tell whether the physical system reached the owner-specified state within the allowed window.

For each acceptance claim, write the modeled assumptions. Inject stuck-high and stale sensor traces, delayed actuator feedback and restart attempts offline. Compare the simulation prediction with an isolated controller bench; record mismatches for qualified review before any plant window.

A twin is powerful for finding counterexamples early, but its green result only covers represented cases. Keep a mismatch register and an owner-signed physical acceptance plan. Do this because the machine can answer questions a simplified model never asked.

#EricFieldNotes

Four-beat scene transcript

1. A twin without the fault cannot certify the stop.

An AI-drafted PLC change can pass a digital twin that never models a stuck-high jam sensor. In the fictional conveyor, the twin's sensor is always fresh and the drive stops instantly. The test is green because the hard behavior was never represented.

Visual: A green simulation is conditional on its model.

2. The real contract has two observations.

The PLC may command the motor off while the conveyor continues moving for a time, or the input may be stale. A unit test that checks only the output bit cannot tell whether the physical system reached the owner-specified state within the allowed window.

Visual: Commanded stop and measured motion are different.

3. List what the twin omits.

For each acceptance claim, write the modeled assumptions. Inject stuck-high and stale sensor traces, delayed actuator feedback and restart attempts offline. Compare the simulation prediction with an isolated controller bench; record mismatches for qualified review before any plant window.

Visual: Fault, sensor age, actuator delay and restart.

4. Use simulation to narrow risk.

A twin is powerful for finding counterexamples early, but its green result only covers represented cases. Keep a mismatch register and an owner-signed physical acceptance plan. Do this because the machine can answer questions a simplified model never asked.

Visual: Let authorized commissioning settle the physical claim.

Research and claim limits

• Siemens Automation Framework documentation (S140)
• NIST: Credibility Consideration for Digital Twins in Manufacturing (S141)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.