{ "description": "Verified Soma programs. Every entry passed `soma check` (and `soma test` / `soma verify` where applicable) on the soma version below, re-run when this index was generated. Fetch `url` for the source. Filter by `domain` or `features` to find a working example of what you are about to write.", "soma_version": "3.2.4", "count": 14, "domains": { "safety_interlocks": 14 }, "features": [ "agent", "cost", "fail", "guard", "http", "invariant", "lambda", "match", "multi_cell", "native", "pipeline", "service", "skeleton", "state_machine", "sum_type", "think", "tools", "try" ], "programs": [ { "id": "safety_interlocks/autoclave_door", "domain": "safety_interlocks", "title": "AUTOCLAVE DOOR — a quick-opening door never unlocks under pressure", "summary": "AUTOCLAVE DOOR — a quick-opening door never unlocks under pressure. Quick-opening pressure vessel doors (autoclaves, sterilizers, curing vessels) have killed operators for a century the same way: residual pressure behind a door someone believed was vented, and the door becomes a projectile. ASME PCC interlocks demand the door cannot unlock until pressure is verifiably zero. Here {pressurized, door open} is not a state: steam is only admitted behind a locked door, and the lock releases only from `sealed_cold` — the exhaust edge zeroes the chamber BEFORE the unlock edge exists. The chamber ledger refuses any pressure beyond the 300 kPa nameplate.", "url": "https://soma-lang.dev/corpus/safety_interlocks/autoclave_door.cell", "repo_path": "examples/corpus/safety_interlocks/autoclave_door.cell", "lines": 96, "features": [ "state_machine", "invariant", "try" ], "cells": [ "AutoclaveControl", "AutoclaveTests" ] }, { "id": "safety_interlocks/blast_furnace_door", "domain": "safety_interlocks", "title": "BLAST FURNACE TOP — never open a door against live CO gas", "summary": "BLAST FURNACE TOP — never open a door against live CO gas. Blast furnace top gas is roughly a quarter carbon monoxide at positive pressure; opening an access door on a live furnace has gassed entire maintenance crews. The kill chain is isolation -> venting -> gas test, and every fatality is a skipped link. Here the door has no edge from any pressurized state: `live -> door_open` and `isolated -> door_open` do not exist, only `vented` reaches the door. The gas-test ledger is the final wall — entry is logged with the measured CO ppm, and the memory itself refuses a reading above the 30 ppm entry limit.", "url": "https://soma-lang.dev/corpus/safety_interlocks/blast_furnace_door.cell", "repo_path": "examples/corpus/safety_interlocks/blast_furnace_door.cell", "lines": 83, "features": [ "state_machine", "invariant", "try" ], "cells": [ "FurnaceTop", "FurnaceTests" ] }, { "id": "safety_interlocks/chlorine_dosing", "domain": "safety_interlocks", "title": "CHLORINE DOSING — no chemical feed without proven water flow", "summary": "CHLORINE DOSING — no chemical feed without proven water flow. The CDC logs hundreds of poolgoers hospitalized in chemical-controller incidents with one recurring shape: the recirculation pump stops, the chlorine feeder keeps running, and the stagnant line accumulates a slug that gasses the first swimmers when flow returns. The fix is a flow interlock: the feeder is DOWNSTREAM of proven flow in the state machine itself — `standby -> feeding` does not exist, and losing flow while feeding forces the feed-stop edge before the pump-stop edge. The residual ledger independently refuses any dose past the 4 ppm EPA maximum residual disinfectant level.", "url": "https://soma-lang.dev/corpus/safety_interlocks/chlorine_dosing.cell", "repo_path": "examples/corpus/safety_interlocks/chlorine_dosing.cell", "lines": 88, "features": [ "state_machine", "invariant", "try" ], "cells": [ "ChlorineFeed", "FeedTests" ] }, { "id": "safety_interlocks/conveyor_pullcord", "domain": "safety_interlocks", "title": "GRAIN CONVEYOR PULL-CORD — a latched trip, and a broken safety circuit that stays broken", "summary": "GRAIN CONVEYOR PULL-CORD — a latched trip, and a broken safety circuit that stays broken. Grain handling kills dozens every year; engulfment victims are often pulled in by a conveyor a coworker restarted while they were still in the boot pit. Two properties are structural here. Anti-restart: a pull-cord trip latches, and `tripped` has NO edge to `running` — the only exit is `reset_walked`, a state a human reaches by walking the belt line. Fail-safe wiring: the pull- cord loop is supervised, and a severed wire lands in `circuit_fault`, a TERMINAL state soma verify proves has no exit — a conveyor whose safety circuit is cut can never be software-restarted.", "url": "https://soma-lang.dev/corpus/safety_interlocks/conveyor_pullcord.cell", "repo_path": "examples/corpus/safety_interlocks/conveyor_pullcord.cell", "lines": 88, "features": [ "state_machine", "invariant", "try" ], "cells": [ "ConveyorGuard", "ConveyorTests" ] }, { "id": "safety_interlocks/crane_load_moment", "domain": "safety_interlocks", "title": "CRANE LOAD MOMENT — the tipping write is refused by the ledger", "summary": "CRANE LOAD MOMENT — the tipping write is refused by the ledger. \"Big Blue\", Miller Park, 1999: a 567-ton lift in wind put the crawler crane past its load moment and it came down across the stadium — 3 ironworkers dead. Load moment is load x radius against the rated chart; the killer is that each input looks fine alone. Here the computed moment percentage is written to a slot whose invariant tops out at 100: a lift plan that tips the crane is REJECTED AT THE WRITE, so the hoist edge is never taken. The machine adds the second wall — a crane cannot hoist from `parked`, and an out-of-chart plan leaves it safely in `rigged`.", "url": "https://soma-lang.dev/corpus/safety_interlocks/crane_load_moment.cell", "repo_path": "examples/corpus/safety_interlocks/crane_load_moment.cell", "lines": 90, "features": [ "state_machine", "invariant", "try" ], "cells": [ "LoadMomentIndicator", "CraneTests" ] }, { "id": "safety_interlocks/drawbridge", "domain": "safety_interlocks", "title": "DRAWBRIDGE — the span never moves while the deck is open to traffic", "summary": "DRAWBRIDGE — the span never moves while the deck is open to traffic. Bascule bridges have killed pedestrians and drivers who were still on the span when it began to rise — tenders raising on a green gate, cars driving around half-lowered barriers. The opening sequence is law: signals stop NEW traffic, gates physically close the deck, and only then may the span move. Here that order is the state machine itself — `traffic_flowing -> span_raised` does not exist, and a raised span has no edge back to traffic without first seating and re-gating. The span angle ledger refuses any value beyond the 75-degree mechanical stop.", "url": "https://soma-lang.dev/corpus/safety_interlocks/drawbridge.cell", "repo_path": "examples/corpus/safety_interlocks/drawbridge.cell", "lines": 85, "features": [ "state_machine", "invariant", "try" ], "cells": [ "BridgeControl", "BridgeTests" ] }, { "id": "safety_interlocks/gas_burner_purge", "domain": "safety_interlocks", "title": "GAS BURNER IGNITION — purge before spark, lockout is forever", "summary": "GAS BURNER IGNITION — purge before spark, lockout is forever. NFPA 86 exists because furnaces that spark into a fuel-laden chamber detonate: the prepurge (4+ air changes) is the single step operators skip when restarts are slow, and skipped purges are a recurring CSB explosion class. Here `off -> pilot_spark` simply does not exist: the only road to a spark runs through `purging` and `purge_done`. A failed ignition or flame loss lands in `lockout` — a TERMINAL state soma verify proves has no exit. Re-light means a human walks to the burner; software cannot talk its way out. The retry ledger caps trial-for- ignition attempts at 3 in memory itself.", "url": "https://soma-lang.dev/corpus/safety_interlocks/gas_burner_purge.cell", "repo_path": "examples/corpus/safety_interlocks/gas_burner_purge.cell", "lines": 82, "features": [ "state_machine", "invariant", "try" ], "cells": [ "BurnerControl", "BurnerTests" ] }, { "id": "safety_interlocks/lockout_tagout", "domain": "safety_interlocks", "title": "LOCKOUT/TAGOUT — a machine with a personal lock on it cannot start", "summary": "LOCKOUT/TAGOUT — a machine with a personal lock on it cannot start. OSHA calls 1910.147 violations a perennial top-ten killer: maintenance inside a machine, someone hits start, the machine wins. The padlock works because ONLY its owner holds the key. Here `locked_out` has no edge to `running` — re-energizing exists only from `isolated`, and the handler that leaves `locked_out` refuses while any personal lock remains on the hasp. The lock ledger itself rejects a negative count (the classic double-remove bookkeeping bug) and more locks than the 6-hole hasp can hold.", "url": "https://soma-lang.dev/corpus/safety_interlocks/lockout_tagout.cell", "repo_path": "examples/corpus/safety_interlocks/lockout_tagout.cell", "lines": 91, "features": [ "state_machine", "invariant", "try" ], "cells": [ "LotoControl", "LotoTests" ] }, { "id": "safety_interlocks/mine_hoist", "domain": "safety_interlocks", "title": "MINE HOIST — no motion with the gate open, and a trip is forever", "summary": "MINE HOIST — no motion with the gate open, and a trip is forever. Markham Colliery, 1973: the hoist brake failed and the cage carrying 29 miners ran away down the shaft — 18 dead. Overwind and overspeed arrestors exist because a winder must be STOPPED by hardware, not promised to stop by software. Two structural walls here: the cage can only wind with its gates sealed (`gates_open -> winding` does not exist, and a moving cage cannot open its gates mid-shaft), and the overspeed trip is TERMINAL — soma verify proves `tripped` has no exit, so no command sequence ever winds a tripped hoist again. The speed ledger refuses any value past the 12 m/s arrestor setting.", "url": "https://soma-lang.dev/corpus/safety_interlocks/mine_hoist.cell", "repo_path": "examples/corpus/safety_interlocks/mine_hoist.cell", "lines": 86, "features": [ "state_machine", "invariant", "try" ], "cells": [ "HoistControl", "HoistTests" ] }, { "id": "safety_interlocks/pig_trap_closure", "domain": "safety_interlocks", "title": "PIPELINE PIG TRAP — the closure never opens against trapped pressure", "summary": "PIPELINE PIG TRAP — the closure never opens against trapped pressure. Pig launcher/receiver closures keep killing pipeliners the same way: the trap is valved off from the line, the gauge \"reads zero\" (or nobody looks), the yoke is swung — and residual gas behind the pig fires the closure door like a cannon breech. Industry recommended practice is a hard sequence: isolate, blow down, PROVE zero, then open. Here that sequence is the only path that exists: `in_service` and `isolated` have no edge to `door_open`; only `blown_down` does, and the blowdown edge zeroes the trap before the door edge appears. The trap gauge ledger refuses any write past the 6000 kPa rating.", "url": "https://soma-lang.dev/corpus/safety_interlocks/pig_trap_closure.cell", "repo_path": "examples/corpus/safety_interlocks/pig_trap_closure.cell", "lines": 99, "features": [ "state_machine", "invariant", "try" ], "cells": [ "PigTrap", "PigTrapTests" ] }, { "id": "safety_interlocks/pressure_relief", "domain": "safety_interlocks", "title": "PRESSURE RELIEF VALVE — a live vessel can never lose its relief path", "summary": "PRESSURE RELIEF VALVE — a live vessel can never lose its relief path. Williams Olefins, Geismar 2013: a reboiler was isolated from its relief valve, heat crept in, and the blocked-in vessel ruptured — 2 dead, 167 injured. The century-old version is the gagged boiler safety valve. Here the joint state (vessel pressure x relief path) is one machine, and the state {in service, relief blocked} does not exist: you can only block the relief valve for maintenance from the cold, offline state, and a blocked-relief vessel has no edge into service. The gauge ledger independently refuses pressure above MAWP.", "url": "https://soma-lang.dev/corpus/safety_interlocks/pressure_relief.cell", "repo_path": "examples/corpus/safety_interlocks/pressure_relief.cell", "lines": 88, "features": [ "state_machine", "invariant", "try" ], "cells": [ "ReliefInterlock", "ReliefTests" ] }, { "id": "safety_interlocks/railway_block", "domain": "safety_interlocks", "title": "RAILWAY BLOCK SIGNALING — two trains never share a block", "summary": "RAILWAY BLOCK SIGNALING — two trains never share a block. Ladbroke Grove (1999, 31 dead) and a century of telescoped carriages before it happen when a second train enters an occupied block. Here the collision state is unrepresentable: a block is a state machine with exactly `clear` and `occupied`, and `occupied -> occupied` does not exist — the second grant RAISES instead of being a flag you forgot to check. A train-count ledger is the independent second wall: the write of a 2 is refused by the memory itself.", "url": "https://soma-lang.dev/corpus/safety_interlocks/railway_block.cell", "repo_path": "examples/corpus/safety_interlocks/railway_block.cell", "lines": 80, "features": [ "state_machine", "invariant", "try" ], "cells": [ "BlockSignal", "BlockTests" ] }, { "id": "safety_interlocks/robot_cell_gate", "domain": "safety_interlocks", "title": "ROBOT CELL GATE — full-speed automation only behind a closed gate", "summary": "ROBOT CELL GATE — full-speed automation only behind a closed gate. A 21-year-old contractor died inside a robot cell at a German auto plant in 2015, struck by an arm that should never have been live with a person inside the fence. ISO 10218 guard interlocking says the gate and the robot mode are ONE state: here `auto_run` exists only behind a closed gate, opening the gate from auto requires the safety-stop edge FIRST, and there is no {gate open, full speed} state to race into. Inside the fence the robot may move only in teach mode, and the speed ledger structurally caps teach motion at the 250 mm/s collaborative limit — a faster write is refused by the memory.", "url": "https://soma-lang.dev/corpus/safety_interlocks/robot_cell_gate.cell", "repo_path": "examples/corpus/safety_interlocks/robot_cell_gate.cell", "lines": 84, "features": [ "state_machine", "invariant", "try", "guard" ], "cells": [ "RobotCell", "RobotCellTests" ] }, { "id": "safety_interlocks/two_hand_press", "domain": "safety_interlocks", "title": "TWO-HAND PRESS CONTROL — anti-tie-down, anti-repeat, structural", "summary": "TWO-HAND PRESS CONTROL — anti-tie-down, anti-repeat, structural. Mechanical power presses amputated thousands of hands a year before OSHA 1910.217. The classic defeat: tape one palm button down, feed the die with the free hand. Here the machine has NO path from `one_held` to `armed` — concurrent actuation (both buttons inside the 500 ms window) is the ONLY arming edge, so a tied-down button is a dead end that must be fully released. Anti-repeat is the same trick: `stroking` exits only to `released`, so holding both buttons cannot recycle the ram. The stroke ledger refuses a ram position outside the die set.", "url": "https://soma-lang.dev/corpus/safety_interlocks/two_hand_press.cell", "repo_path": "examples/corpus/safety_interlocks/two_hand_press.cell", "lines": 78, "features": [ "state_machine", "invariant", "try" ], "cells": [ "PressControl", "PressTests" ] } ] }