FIELD NOTE / X
The PLC test oracle is physical.
The complete written thought and the evidence behind it. The video edition will follow its public release.
The written argument is here.
This approved X edition is on the journal now. Its video player and original platform link will appear after each public release is verified.
The PLC test oracle is physical.
Video caption
The PLC test oracle is physical. Both can assume the actuator follows instantly. Compile, simulate, bench, then commissioned physical readback. #EricFieldNotes
Full written post / accessibility read
A generated PLC test that asserts motor command equals off proves the controller issued a command. It does not prove motion stopped within the owner-defined window. In a physical system, feedback, sensor age and actuator behavior belong in the acceptance condition.
If the same agent writes logic and the toy process model, both may encode instant stop. A green simulation then confirms its own assumption. The physical failure mode is absent from both sides of the test.
A qualified owner supplies expected behavior for fresh jam, stale jam, delayed feedback and restart. The harness drives those faults in an offline model, checks command and measured-motion proxy, and deliberately removes one guard to ensure the test turns red. An isolated controller bench checks timing next.
Keep every oracle tied to what it can actually observe. A compiler checks language; a model predicts faults; a disconnected bench checks controller behavior; qualified commissioning observes the installed machine. Do this because no earlier green badge can certify a later physical claim.
#EricFieldNotes
Four-beat scene transcript
1. The PLC test oracle is physical.
A generated PLC test that asserts motor command equals off proves the controller issued a command. It does not prove motion stopped within the owner-defined window. In a physical system, feedback, sensor age and actuator behavior belong in the acceptance condition.
Visual: An output bit is not a stopped machine.
2. The agent and simulator may share a blind spot.
If the same agent writes logic and the toy process model, both may encode instant stop. A green simulation then confirms its own assumption. The physical failure mode is absent from both sides of the test.
Visual: Both can assume the actuator follows instantly.
3. Bring an outside expected trace.
A qualified owner supplies expected behavior for fresh jam, stale jam, delayed feedback and restart. The harness drives those faults in an offline model, checks command and measured-motion proxy, and deliberately removes one guard to ensure the test turns red. An isolated controller bench checks timing next.
Visual: Fault matrix and deliberate negative control.
4. Observe each rung separately.
Keep every oracle tied to what it can actually observe. A compiler checks language; a model predicts faults; a disconnected bench checks controller behavior; qualified commissioning observes the installed machine. Do this because no earlier green badge can certify a later physical claim.
Visual: Compile, simulate, bench, then commissioned physical readback.
Research and claim limits
- PLCopen IEC 61131-3 (S138)
- Siemens Automation Framework documentation (S140)
- NIST: Credibility Consideration for Digital Twins in Manufacturing (S141)
The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.