Recruitment ads for immersive venues describe multi-zone sound, DMX, cameras and PLCs in fine detail. They almost never say who, while a show is running, sees the real state of the system, or on what. Argus is that display: an operations plan showing where the visitors are and what the machinery is doing, local on your network, on one screen.
The name comes from Argus Panoptes, the hundred-eyed giant, half of whose eyes keep watch while the other half sleep. That is a fair description of a control post: the point is not to see everything at once, it is never to have every eye shut.
Try the demonstration
The specimen is playable straight away, in the browser. It opens with a code we provide on request, and runs on an invented venue: no real data behind it, and nothing leaves it.
This is a service under development, not off-the-shelf software. What you see here runs on an invented venue, "The Last Opera", an attraction after The Phantom of the Opera. A control tower is only worth something if it describes your spaces, your machinery and your pacing: commissioning therefore always begins with a site visit and a survey with the team. The detail is further down: a bespoke service.
Centralised supervision
Before opening, you know what to check: a procedure exists, and if it is properly kept it is written down. After an incident, you know what to do: you call, you repair, you record. Between the two, while the public is going through, the information scatters: one operator on sound, another at the entrance, a third who heard something over the radio. Nobody holds the overall picture, and above all nobody sees the next step coming.
An operator in the control tower sees an oversized queue forming: the queue is the symptom, and it appears ten to fifteen minutes after the cause of the delay. What was needed is the cause at the moment it appeared, and the means exist: a subtle speed-up of the show, and moving the previous group through the rooms faster.
See the bottleneck before the queue
The demonstration venue is an immersive attraction after The Phantom of the Opera, set in a disused opera house and its flooded basements: Box 5, a holding room, a descent by lift, the gallery and its chandelier, a staircase down to the dock, the crossing of the lake by boat between the columns, the lair and its organ, the climb back up. Thirteen rooms, and a way of working that is not a flow.
The empty room between two groups is not wasted space, it is part of the show: without it, one group hears the previous group's show. It is also why Argus displays no overall occupancy rate: each room says who is in it, but nothing scores the route, which would make that spacing read as waste.
Visitors move through in groups of six, one room per group, with an empty room between two groups: that is what guarantees a group never hears the previous group's show. Technically it is block working: a group only moves on if the next room is ready and the room after that is free. Three groups at most are engaged at any one time.
And there is only one boat. This is not a fleet reduced to one unit, it is a different regime: its cycle, boarding, crossing, landing, empty return, sets the pace of the whole attraction on its own. Six people every nine minutes, and nothing can go faster.
That is where a display earns its keep. If the crossing lengthens by three minutes, the boat returns less than what is sent to it: nothing shows, all seems well, and the queue will be born ten minutes later at the boarding dock. Argus does not say "boarding dock full", it says the cycle is degraded while there is still time. And the decision it calls for is not to repair the boat, but tospace out the dispatches, which takes one keystroke.
Interval between two dispatches
The boat does not change pace: its cycle is what it is. The only setting is the interval between two dispatches, and that is what makes the decision counter-intuitive: for the attraction to run better, fewer people must enter it.
Green does not mean "it is fine". Green means "I know it is fine"
This is the distinction almost every dashboard misses, and it is expensive. The operator looks at a green display, feels reassured, and is wrong: collection stopped ten minutes earlier, and nothing on screen gives any reason to suspect it.
The worst display is not the one showing an alarm. It is the one that is green because it is no longer receiving anything.
Argus therefore has four states, not three.
| State | What it says |
|---|---|
| Nominal | The data is fresh, and it is within limits. |
| Warning | The data is fresh, and it is out of limits. |
| Critical | The data is fresh, and it demands action. |
| Unknown | I do not have the data. Neither good nor bad: absent. No stale value is shown as though it were current. |
Cut the source. Nothing turns red, and above all nothing stays green: everything switches to "unknown", and the values disappear instead of remaining on screen as though they were still true.
The age of the data is shown at all times, and past the permitted delay everything switches to "unknown". It looks austere until the day the PLC falls silent: the display then says "I do not know" instead of lying with confidence.
What a room is allowed to say
Each room shows one sentence only, and always the same wording, because an operator does not read a display, he recognises it:
| "No presence detected" | The room is empty and at rest. |
| "Show resetting. Show ready in 23 seconds." | The group has left, the show is rewinding. The room is not available yet, and you know when it will be. |
| "Standby - ready" | Armed. It is waiting for the next group. |
| "Show running, 6 people" | A group is inside. |
What happens in the room
What the display shows, to the second
Send the group out, then wait. The countdown is not decorative: while it runs, the room cannot take the next group, and that is the information the operator needs to decide whether to dispatch or hold.
The lake adds a condition that is not its own: it is never "ready" while the boat is not at the dock, and it then announces the time remaining until it is. It is the only place where a room's state depends on a vehicle, and that is precisely what sets a single-vehicle attraction apart from all the others.
An alarm that cries wolf kills all the others
The false alarm rate is the first design parameter, before aesthetics and before features. Three unwarranted alarms in one show and the operator acknowledges by reflex, without reading. The tool then becomes worse than nothing, because it gives the feeling of a vigilance that no longer exists.
Three rules follow, and they are held: an alarm presupposes a possible action, otherwise it is information and it does not sound; the clearing threshold is not the triggering threshold, otherwise an oscillating value produces one alarm per oscillation; and a condition must hold for several seconds before sounding. The log is on a light background, apart from the plan: you do not read a list of events the way you watch a synoptic.
Safety is not in this display
This is the point on which we do not compromise, and it is better read here than discovered in a meeting. Argus carries no emergency stop, no interlock, and no function whose failure would endanger people. The safety PLC remains in charge; Argus reads, displays, and commands only what commits nothing: starting an effect, stopping it, acknowledging, changing a show mode.
This is not a limitation endured, it is what makes the whole thing possible. A supervision display that does not touch the safety chain runs on an ordinary Ubuntu server, without certification, and updates on a Tuesday morning without anyone holding their breath. Software that enters that chain changes trade, cost and tempo, and loses the ability to evolve, which is precisely what is expected of a supervision tool.
You can see it on screen: safety states, such as the fire-detection inhibit that heavy fog requires, are framed separately and marked read only. One demonstration scenario shows that inhibit left active while the fog is off: Argus reports it, and can do nothing but report it. That is what the fire safety system is for. An operator must know at a glance what he cannot in do.
The intrusion mat around the basin follows the same logic, and it is the clearest example: it is wired to the safety chain, not to Argus. When somebody sets foot where they should not, the boat stops by itself. Argus displays "triggered", says where, timestamps it, and can command nothing. That is exactly what is expected of a supervision display: that it make an event legible without ever standing between the sensor and the cut-off.
For commands that commit, a physical desk remains the right answer, and we offer it as a clearly separate option. A button is found blind, in the dark, under stress, and it does not depend on a browser that has frozen.
Try the demonstration
Seven scenarios fire by hand: lengthened boat cycle, boat immobilised, intrusion at the basin, slow door, fog off, source lost, blocking incident. The clock speeds up so a whole show can be seen in two minutes.
The cameras are on the other screen
Argus shows no video feed, and that is deliberate. An operations plan shows the state to within two tenths of a second; a video image carried to a browser lags by two to ten seconds. Putting them side by side would amount to presenting two different instants as though they were the same, at the very moment somebody is deciding.
Separating the screens above all separates the technologies, and that is where the lag disappears: a native video wall holds two to three tenths of a second. Argus therefore confines itself to saying which camera to look at, on the plan and on every alarm. The CCTV system already installed is kept, with its access rights and its retention period.
The same display, at three metres or at six
Nothing is dimensioned in pixels, everything is in proportion to the screen. The same page fits a thirteen-inch laptop as well as a sixty-five-inch monitoring display, with nothing to redraw. What you see during the demonstration is therefore exactly what you will have on the wall, size apart: no unpleasant surprise on installation day.
Even so, a display is not read the same way depending on where you stand. One key switches between two settings. "Control room" is the working instrument: dense, numerical, made to be read at two or three metres by somebody who knows the attraction. "Room" targets six metres and the whole team; it does not merely enlarge the characters, it removes some. Door cycles, subsystem states, all the technical detail fades away, and only what can be decided upon remains.
The display must also stay legible without colour, and that is not a precaution of principle. One man in twelve tells green from red poorly. And the green and the amber we use have almost the same luminance: for those people, as on a black-and-white screen, the two become the same grey dot.
Each state therefore carries a shape as well as its colour: a filled disc for nominal, a triangle for warning, a diamond for critical, an empty circle for unknown. Colour speeds up reading, shape guarantees it. We check by putting the display back into greyscale: if the information survives there, it did not depend on colour.
Argus and Carbone, during and around
An incident seen on screen must end up in the register, otherwise it gets told from memory three hours later, with an approximate time and a reconstructed cause. One key sends the incident to CARBONE, our operations register, already filled in with the exact time, the zone and the state of the system at the time of the events.
The two tools answer each other: Carbone holds opening, declaration and closing; Argus holds the during. It is the same day, seen by its two halves.
What it changes
An operator who sees his bottleneck ten minutes before his queue acts on pacing instead of enduring the wait.
A team looking at the same display coordinates without a meeting and without a radio.
It goes to the register with its exact time and the state of the system at the time of the events.
A control room that says "I do not know" when it does not know is a control room you can trust the rest of the time.
We deliberately display nothing about individuals: no reaction time per operator, no ranking, no named counter. The reason is not moral but operational: a tool that watches the team very quickly stops being used honestly by it, and incidents stop being declared. You lose the very data you were trying to obtain. On the public side, the cameras serve to see an incident, not to measure visitors.
A bespoke service, not off-the-shelf software
A control tower describes one precise venue. Argus's zones, capacities, pacing, effects and subsystems are configuration, not code: the plan is a vector drawing of your attraction, and each space in it is tied to what needs to be known about it. That is what allows the same engine to be installed on two venues with nothing in common.
Commissioning therefore begins with a visit, a survey of the flows and a question we always ask before committing: what drives the effects today, and what cuts everything if there is a problem? If a stopping chain exists, we lay the supervision on top of it. If none exists, this is no longer the same trade or the same budget, and it is better said at the start.
Under the bonnet
Local server on Ubuntu, one video output to a monitoring display. No cloud, no account to create, no data leaving the site. PLC reading over Modbus TCP or OPC-UA, OSC inputs for show control, and a simulator that is a connector like any other: the demonstration and the installation run the same engine.
On the screen side, a 65-inch 4K LCD monitor is fine up to four metres of reading distance; beyond that a larger one is needed. Never OLED, which burns in within months on an image this static. No video projection either: a synoptic is ninety per cent black, and projection lifts the blacks to grey, which weakens precisely the red of an alarm.
The demonstration you can open above is a single file, with no server and no external dependency, whose randomness is reproducible: it tells the same story at every meeting.
Let us talk about your venue
The simplest thing is to show us the route and tell us where it jams today. The visit and the flow survey are the real starting point.