This simulator models a guarded mixer with a start/stop station, guard interlock switch, emergency stop, air-pressure permit, overload contact, contactor and contactor auxiliary feedback. It teaches the distinction between a permit (a condition that must be present to accept a start), a running interlock trip (loss of a condition while running), and the separate operator actions of acknowledging, resetting and restarting.
• A real-time 3D model of the guarded mixer/impeller, hinged guard and interlock switch, emergency-stop station, air-pressure switch, safety-interface context, power contactor with auxiliary proof, and machine PLC/start station, with home view, focus-selected-part, toggleable full-enclosure cutaway, exploded view, auto-rotate, expand and show/hide labels controls, and tappable numbered components with callouts. • Six live toggle controls: guard closed, emergency-stop released, pneumatic pressure available, overload healthy, contactor feedback available, and an "inject welded power contact" fault. • Play/pause, single-step (0.1 s) and larger-step (1 s) time controls, plus a playback-speed selector (10× slow motion, real time, 10× faster, 1 minute per second). • Six actions: Start trial, Stop trial, Start machine, Stop machine, Acknowledge trip and Reset trip, with a live sequence narrative, switch-state tokens (trial running/stopped, trip/diagnostic status) and per-component status. • Eight live metrics: all start permits, run latch, contactor coil travel, power contact closed, mixer speed, trip latch, guard closed and e-stop released. • A Curves & measurements tab with two charts (run latch/power contact/trip vs. time, and coil/mixer speed vs. time), the full model equations, and snapshot measurements. • An Experiments tab with four guided scenarios (blocked start, normal start, running interlock loss, welded power contact), a model-verification bench of independent automated checks, and a timestamped event log with a copyable trial report. • A Learn & assess tab with four guided lessons, a two-question knowledge-check quiz, and a written scope/reference statement.
The model requires guard closed, e-stop released, pressure available, overload healthy and contactor feedback available before a fresh start request is accepted — and only a rising edge of the start request, evaluated while all permits are true and no trip or welded-contactor condition exists, sets the run latch. Once running, losing any one of those conditions immediately records that condition as the first-out cause and clears the run latch; if a second condition is subsequently lost, the first-out label does not change, preserving the true original cause for diagnosis.
A welded power contact — the auxiliary proof disagreeing with a de-energized coil command — is modeled as its own trip condition and specifically blocks Reset trip until contactor feedback is restored, illustrating why a control-side reset can never substitute for physical verification of the power path. Restoring conditions and pressing Reset trip only clears trip memory and re-arms readiness; the mixer requires a separate, deliberate Start machine action to run again.
The equations panel states permits = guard AND stop-chain healthy AND pressure AND overload AND feedback, that the run latch sets only on an accepted start edge, that loss of a running permit produces a first-out trip, and that reset restores readiness without restoring run state. This is a sequence-training model, not a certified safety PLC program or SIL/PL-rated design — the safety-interface component is explicitly a logical teaching model of sequence behavior only.
The scope note is explicit that dual-channel diagnostics, timed guard locking, braking and certified stopping-distance calculations are all omitted, and that no safety performance level should be inferred from this generic PLC-style representation.
A permit (guard closed, e-stop released, pressure available, overload healthy, feedback available) is a condition that must already be true before a fresh start request is accepted. A trip is the recorded consequence of losing a required condition while the machine is already running — it clears the run latch and records a first-out cause, which is a distinct event from simply failing to start.
The model records only the first lost condition as the first-out cause and does not overwrite it if a later condition is also lost — for example injecting an e-stop loss after the guard has already tripped the machine leaves the first-out label as GUARD OPEN. This preserves the true original cause for troubleshooting instead of letting a secondary condition obscure it.
Reset trip only clears trip memory and the run latch once all permits are restored (and, for a welded-contactor fault, once contactor feedback confirms the contact has actually opened). Restarting the mixer always requires a separate, deliberate Start machine action — reset alone never produces motion in this model, which is the core lesson of the "reset is not restart" experiment set.
This is a representative educational sequence-training model with generic parameters, not a manufacturer-specific safety PLC program. It omits dual-channel diagnostics, timed guard locking, braking dynamics and certified stopping-distance calculations, and no safety integrity or performance level should be inferred from it.