Industrial robot arms are controlled by a continuous stream of joint-angle setpoints over a real-time fieldbus, and that bus is an attack surface: a compromised HMI, a replayed capture, or a man-in-the-middle can inject forged commands even through a network that looks authenticated at the packet level. This simulator renders a 3-joint arm driven by a genuine trajectory generator alongside the live packet stream on its command bus, and layers a physics-based intrusion detector on top — one that compares the arm's actual motion against what its own trusted trajectory model predicts, rather than trusting the bus. Toggle a spoofed-command injection, tune the injection magnitude, the per-sample detection threshold, and the windowed-vote size, and watch the residual gauge, flagged-packet count, and alarm state respond exactly as a real model-based industrial intrusion-detection layer would.