Plant State Machine

The explicit plant-wide states and the guarded transitions between them - the backbone that makes every other resiliency behavior legible.

One authoritative state

Resiliency starts with a single, authoritative plant state. Ambiguity about what mode the machine is in is itself a failure mode. The stack defines a finite set of plant modes with guarded transitions; only one supervisor may command a transition, and every transition has explicit entry conditions and a defined fallback. Both machines share the same skeleton with machine-specific guards.

Guarded transitions

A transition fires only when its guard evaluates true against the twin state. Illegal transitions are refused, not attempted. The most important edges are the ones toward lower energy: OPERATE to DERATE, DERATE to SAFING, and any mode to FAULT, which are always reachable and take priority over productive commands.

EDGES = {
  ('STANDBY','ARMED'): guard_interlocks_ready,
  ('ARMED','OPERATE'): guard_scenario_converged,
  ('OPERATE','DERATE'): guard_degradation_detected,
  ('DERATE','SAFING'): guard_limit_approaching,
  ('*','FAULT'): guard_protective_trip,   # always available
}
def step(cur, req, twin):
    g = EDGES.get((cur, req)) or EDGES.get(('*', req))
    return req if (g and g(twin)) else cur

Why it aids resiliency

A well-defined state machine makes failover, degradation, and safing composable: each is just a set of edges. It also makes postmortem exact, because the state trace is unambiguous. The safe-ward edges are detailed in Safe States and the degraded edges in Graceful Degradation.