The Nervous System of AI at the Edge

Every machine in your plant is deaf, mute, and amnesiac.

It cannot see the part it is making. It cannot tell the technician what just went wrong. It remembers nothing from one shift to the next. This is not a failure of any one vendor — it is the settled state of an entire industry, and it has held for over fifty years. We decided it was a bug, not a law of nature.

The control loop — the deterministic scan that reads inputs, runs logic, and drives outputs, thousands of times a second — is the most trustworthy piece of software in the industrial world. It is also the dumbest. For half a century that trade was correct: determinism near moving steel is sacred, and nobody dared put a system that guesses anywhere near a press, a pour, or a person.

Meanwhile, machine intelligence finally grew hands and eyes. It can perceive, reason, explain, and write. But it grew up in the wrong place — in the cloud, a network round-trip and a non-deterministic inference away from the machine. You cannot put it inside the scan. The loop will not wait 300 milliseconds for an answer that might be wrong.

So the field is stuck on a false choice: a body with no mind, or a mind with no body.

ControlForge dissolves the choice. It is a real, standards-compliant PLC runtime — deterministic, auditable, a single self-contained binary — built from the start to let cognition live beside the scan instead of across a network from it. The reflex stays sacred and untouched. Around it, the runtime grows the rest of a nervous system: reflex (the deterministic IEC 61131-3 scan), nerves (thirteen wire-proven industrial protocols), senses (perception primitives already callable from control code), and cognition (an embedded AI assistant and an open agent control plane).

We did not bolt a brain onto a machine. We gave the loop a place where a mind can live.

1.The Forty-Year Freeze

The programmable logic controller was born in 1968 to replace banks of electromechanical relays. Its core architecture — scan inputs, solve logic, write outputs, repeat on a fixed cycle — was right then and is right now. The determinism is not an accident; it is the whole point. But the very properties that make the loop trustworthy also froze it. Three walls went up and never came down:

The determinism wall. A control decision must happen on time, every time. Anything that might take longer this scan than last — a garbage collector, a network call, a model that thinks for a variable number of milliseconds — is disqualified by construction. So the loop stayed simple.

The IT/OT wall. The smart software lives in IT, on the other side of an air gap, talking to the machine through a thin straw of tags sampled once a second. It can watch the machine. It cannot be the machine.

The amnesia wall. A classic PLC has no memory of yesterday and no awareness of the plant next door. Knowledge that should compound — every fault, every recipe, every hard-won tuning — evaporates at the end of the scan.

None of this was a mistake. It was a rational response to genuinely high stakes: when the output drives real machinery, "mostly right" is a synonym for "dangerous." The cost of that correct choice is the plant you have today: millions of machines, every one deaf, mute, and amnesiac — not because it had to be, but because until now there was no way to add a mind without poisoning the reflex.

2.What ControlForge Is

ControlForge is an IEC 61131-3 PLC runtime written in Go. Before it is anything visionary, it is a correct PLC — and that ordering is the entire architectural thesis.

It is one binary. A single, statically-linked, cgo-free executable with no runtime dependencies. It drops onto a server, an industrial PC, or a single-board computer and runs. One file you can hash, sign, audit, and deploy.

It is deterministic. Programs are written in Structured Text and executed on fixed-period tasks with real priorities and scan times. The control core does the classic thing the classic way, on time, every time.

It is standards-real. Not a simulator and not a subset that breaks on contact with the field. The AI, the perception, and the connectivity were added around the deterministic core without compromising it. Everything intelligent the runtime does, it does beside the scan — never inside it, slowing it down, and never across a network, starving it. That is the design constraint the cloud-AI approach cannot satisfy and the single-binary edge-native approach can.

3.The Capability Surface

The measured ledger, read from the live registry of a licensed v1.0.1058 instance on 2026-06-21.

The nerves — thirteen wire-proven protocols

ControlForge speaks, on both client and server sides where the protocol defines them, and from both ST code and configuration. This is depth, not a checklist — counting only the functions exposed to control code:

"Wire-proven" means tested against real protocol stacks in a loopback harness, not asserted from a datasheet.

The senses — perception in the control language

This is the part that does not exist in a classic PLC at all. The runtime exposes vision and video primitives directly to control code: VISION_* triggers inference and reads object counts, labels, confidences, and per-object fields, with inference timing as a first-class value; VIDEO_CAMERA_* creates, configures, and captures from live cameras inside the runtime. A control program can ask what do you see and branch on the answer — on the machine, in the loop. The eye is already wired to the reflex.

The data spine, the memory, and the mind

Northbound by design — MQTT, Sparkplug B, and NATS carry machine state up; an embedded historian and tag-freshness primitives (VAR_TS, VAR_AGE_MS) mean the runtime knows not just a value but how old it is — the first crack in the amnesia wall. An embedded AI assistant runs inside the runtime — reading the project, drafting and validating Structured Text, answering questions about the live machine, with no external service in the loop. And an open agent control plane exposes the runtime's full operation — programs, tasks, variables, diagnostics, protocols — over a standard agent-interface protocol, so an AI agent can operate the PLC the same way a human engineer does. This is not a future integration; it is how the runtime is administered today.

4.Proof, Not Promises

A vision document earns the right to dream in its second half by proving, in its first, that the team behind it does not ship vapor. Three standing disciplines make Part I trustworthy — and they are themselves part of what ControlForge is.

Every regression becomes a permanent sentinel. When something breaks, a check that re-detects that entire class of failure — forever — is added to an automated overseer that probes live instances and regenerates a status board on every run. Bugs do not get fixed twice.

No fabricated demonstrations. Numbers and behaviors shown to anyone come from the actual running system, never a reimplementation or a mock-up. The capability ledger above was read from a live registry for exactly this reason. If it is in this paper, it answered an API call.

Wire-proven, not datasheet-proven. Protocol support is validated against real protocol stacks in a loopback harness. The standard for "supported" is the device on the wire, not a claim in a table.

5.AI at the Edge Needs a Body

The prevailing bet on industrial AI is a disembodied one: keep the intelligence in the cloud, let it sip tag data through the historian, and send advice back down. It is a reasonable bet, and it is wrong about the most important loops. Advice that arrives a network round-trip late, with no guarantee of arriving at all, cannot own a control decision. The cloud can counsel the machine. It cannot be the machine.

A mind that acts on the physical world needs a body with three properties the cloud cannot offer: it must be local, so the loop never waits on a network; it must be deterministic, so the reflex underneath the cognition is never poisoned; and it must be auditable, so that when an intelligence touches metal, a human can see exactly what it did and why. ControlForge is built to be that body.

6.The Self-Explaining Machine

Picture the technician at 2 a.m., alone, with a line down and a plant manager already calling. Today the machine offers a fault code and a stack of manuals. Tomorrow the machine explains itself — in plain language, on the panel, offline: "I stopped because infeed pressure fell below the interlock for the third time in an hour. Each time it followed a dropout on the upstream conveyor's network segment. Here is the trend. The conveyor, not me, is the thing to look at." Not a chatbot bolted to a dashboard — a machine that understands its own state and history well enough to narrate them.

7.The Self-Writing Plant

Control logic is still written the way it was in 1990: by hand, by a specialist, one statement at a time. Tomorrow, the engineer describes intent — "interlock the press until both light curtains are clear and the part is seated" — and the machine drafts the Structured Text, checks it against the runtime's own rules, simulates it against a twin, and hands back logic that is correct before it is ever downloaded. The specialist moves from typing to judging.

8.The Perceiving Plant

A blind machine cannot inspect the part it just made. Today, vision lives in a separate box from a separate vendor, integrated through a fragile handshake, its verdict arriving as a single bit. Tomorrow, perception is simply part of the control program: the loop asks what do you see and branches on the answer — counts the parts, reads the label, judges the weld, rejects the defect — in the same scan, in the same language, as the logic that drives the actuator.

9.The Learning Fleet

A classic plant is an amnesiac archipelago: every controller an island, every shift a fresh start, every hard-won bit of tuning lost when the power cycles. The fleet that learns is the opposite. Before bad logic touches real steel, it is tried against a faithful twin and its consequences are seen, reproducibly. Good logic, once found on one line, propagates to every identical line. Tuning discovered in one plant raises the floor for all of them. Knowledge stops evaporating and starts compounding.

10.The Negotiating Plant

The last wall is between machines. Today they are wired together by a human who decides, in advance, exactly how the conveyor hands off to the press. Tomorrow, machines that each understand their own state and goals negotiate the handoff themselves — the upstream cell tells the downstream cell what is coming and when, the downstream cell answers with what it can take, and the line balances itself without a central choreographer scripting every move.

Read the two halves of this paper together and the shape is clear. Part I is a body that already exists: deterministic, connected, sensing, single-binary, trustworthy near metal. Part II is that body waking up — explaining itself, writing itself, perceiving, learning across a fleet, and eventually negotiating with its peers. None of the second half requires abandoning the first. Every moonshot is a consequence of the same architectural choice — let cognition live beside the scan, not across a network from it — and every one of them already has a seed running in the codebase, several of which you can watch execute on this very page.

The machines on the floor have been deaf, mute, and amnesiac for fifty years. The body that fixes that is built and running. What remains is to wake it up.