# The Nervous System of AI at the Edge

### A ControlForge White Paper

*Part I of II — The Machine That Runs Today*

> **A note on how to read this document.** It is built in two halves with a hard
> wall between them. **Part I** is sober. Every capability, every number, and every
> claim in it is measured against a live, licensed instance and can be reproduced
> by anyone with the binary — the figures below were taken on **2026‑06‑21 against
> ControlForge v1.0.1058**. **Part II** is forward‑looking, and says so plainly.
> The wall is deliberate: a vision is only worth reading if you can trust the
> ground it stands on. Nothing in Part I is aspirational. Everything in Part I
> runs today.

---

## The Thesis

Every machine in your plant is deaf, mute, and amnesiac.

It cannot see the part it is making. It cannot tell the technician what just went
wrong. It remembers nothing from one shift to the next. This is not a failure of
any one vendor — it is the settled state of an entire industry, and it has held
for over fifty years. We decided it was a bug, not a law of nature.

The control loop — the deterministic scan that reads inputs, runs logic, and
drives outputs, thousands of times a second — is the most trustworthy piece of
software in the industrial world. It is also the dumbest. It does exactly what it
was told and not one thing more. For half a century that trade was correct:
determinism near moving steel is sacred, and nobody dared put a system that
*guesses* anywhere near a press, a pour, or a person.

Meanwhile, machine intelligence finally grew hands and eyes. It can perceive,
reason, explain, and write. But it grew up in the wrong place — in the cloud, a
network round‑trip and a non‑deterministic inference away from the machine. You
cannot put it inside the scan. The loop will not wait 300 milliseconds for an
answer that might be wrong.

So the field is stuck on the horns of a false choice: a body with no mind, or a
mind with no body.

**ControlForge dissolves the choice.** It is a real, standards‑compliant PLC
runtime — deterministic, auditable, a single self‑contained binary — that was
built from the start to let cognition live *beside* the scan instead of across a
network from it. The reflex stays sacred and untouched. Around it, the runtime
grows the rest of a nervous system:

- **Reflex** — the deterministic IEC 61131‑3 scan. Unchanged, uncompromised.
- **Nerves** — thirteen industrial protocols, wire‑proven, reaching every device
  on the floor.
- **Senses** — perception primitives (vision, inference, live video) already
  callable from control code.
- **Cognition** — an embedded AI assistant and an open agent control plane, so
  intelligence can read, reason about, and shape the machine — at the edge,
  where the loop lives.

We did not bolt a brain onto a machine. We gave the loop a place where a mind can
live. The rest of this paper is the evidence that the body already exists (Part I),
and the argument for what it becomes once it wakes up (Part II).

---

# Part I — The Machine That Runs Today

## 1. The Forty‑Year Freeze

The programmable logic controller was born in 1968 to replace banks of
electromechanical relays. Its core architecture — scan inputs, solve logic, write
outputs, repeat on a fixed cycle — was right then and is right now. It is the
reason a stamping line can run for twenty years without a software surprise. The
determinism is not an accident; it is the whole point.

But the very properties that make the loop trustworthy also froze it. Three walls
went up and never came down:

- **The determinism wall.** A control decision must happen on time, every time.
  Anything that *might* take longer this scan than last scan — a garbage
  collector, a network call, a model that thinks for a variable number of
  milliseconds — is disqualified by construction. So the loop stayed simple.

- **The IT/OT wall.** The smart software — historians, analytics, dashboards,
  now AI — lives in IT, on the other side of an air gap, talking to the machine
  through a thin straw of tags sampled once a second. It can watch the machine.
  It cannot *be* the machine. The intelligence and the control live in different
  buildings, sometimes different states.

- **The amnesia wall.** A classic PLC has no memory of yesterday and no awareness
  of the plant next door. Each controller is an island that wakes up knowing only
  its ladder logic. Knowledge that should compound — every fault, every recipe,
  every hard‑won tuning — evaporates at the end of the scan.

None of this was a mistake. It was a rational response to stakes that are
genuinely high: when the output drives real machinery, "mostly right" is a
synonym for "dangerous." The industry chose reliability over capability, again
and again, and was correct to.

The cost of that correct choice is the plant you have today: millions of machines
in the installed base, every one of them deaf, mute, and amnesiac — not because
it had to be, but because until now there was no way to add a mind without
poisoning the reflex.

## 2. What ControlForge Is

ControlForge is an IEC 61131‑3 PLC runtime written in Go. Before it is anything
visionary, it is a *correct PLC* — and that ordering is the entire architectural
thesis.

- **It is one binary.** A single, statically‑linked, **cgo‑free** executable with
  no runtime dependencies. It drops onto a server, an industrial PC, or a
  single‑board computer and runs. There is no interpreter to install, no
  framework to provision, no container required. One file you can hash, sign,
  audit, and deploy.

- **It is deterministic.** Programs are written in Structured Text and executed on
  fixed‑period tasks with real priorities and scan times. The control core does
  the classic thing the classic way, on time, every time.

- **It is standards‑real.** Not a simulator and not a subset that breaks on
  contact with the field. It speaks the languages, the data types, and the
  protocols that real devices on real floors actually use.

The discipline that makes the rest of this paper credible is here: the AI and the
perception and the connectivity were added *around* the deterministic core
without compromising it. The reflex was never put up for negotiation. Everything
intelligent the runtime can do, it does beside the scan — never inside it,
slowing it down, and never across a network, starving it. That is the design
constraint that the cloud‑AI approach cannot satisfy and the single‑binary
edge‑native approach can.

## 3. The Capability Surface

This is the measured ledger. Figures are from the live registry of a licensed
v1.0.1058 instance, read on 2026‑06‑21.

### The control core

- **2,361 built‑in functions** in the live function registry — math, string,
  time, type conversion, data structures, cryptography, compression, and the
  protocol libraries below.
- **Standard IEC 61131‑3 function blocks** for timing and counting — `TON`,
  `TOF`, `TP`, `RTO`, `CTU`, `CTD`, `CTUD` — plus edge detection (`R_TRIG`,
  `F_TRIG`) and latching/semaphore primitives (`SR`, `RS`, `SEMA`).
- **A compiling compute tier.** Eligible Structured Text is certified and
  executed on an accelerated backend, delivering roughly **85–103× speedups on
  heavy floating‑point kernels** (scalar, array, and struct workloads) while
  preserving IEC float semantics — math fast enough to matter inside a control
  program, not in a cloud job an hour later.

### The nerves — thirteen wire‑proven protocols

ControlForge speaks, on both client and server sides where the protocol defines
them, and from both ST code and configuration:

**Modbus · EtherNet/IP · OPC UA · MQTT · Sparkplug B · DNP3 · BACnet · SNMP ·
IEC 60870‑5‑104 · FINS · S7 · SEL · DF1**, with InfluxDB for historian egress.

This is depth, not a checklist. Counting only the functions exposed to control
code: Modbus 84, SEL 59, BACnet 58, S7 56, SNMP 48, NATS 44, EtherNet/IP 43,
MQTT 42, OPC UA 36 (plus 13 for OPC UA PubSub/UADP), FINS 31, IEC 60870‑5‑104 27,
DNP3 25, DF1 24. "Wire‑proven" means tested against real protocol stacks in a
loopback harness, not asserted from a datasheet.

### The senses — perception in the control language

This is the part that does not exist in a classic PLC at all. The runtime exposes
**vision and video primitives directly to control code**:

- **`VISION_*`** — trigger inference, read object counts, labels, confidences,
  and per‑object fields, with inference timing surfaced as a first‑class value.
- **`VIDEO_CAMERA_*`** — create, configure, and capture from live cameras inside
  the runtime.

A control program can ask *what do you see* and branch on the answer, on the
machine, in the loop. The eye is already wired to the reflex.

### The data spine and the memory

- **Northbound by design** — MQTT, Sparkplug B, and NATS carry machine state up
  to the rest of the world; an embedded historian and tag‑freshness primitives
  (`VAR_TS`, `VAR_AGE_MS`) mean the runtime knows not just a value but *how old*
  it is — the first crack in the amnesia wall.

### The cognition surface

- **An embedded AI assistant** runs *inside* the runtime — it can read the
  project, draft and validate Structured Text, and answer questions about the
  live machine, with no external service in the loop.
- **An open agent control plane.** The runtime exposes its full operation —
  programs, tasks, variables, diagnostics, protocols — over a standard
  agent‑interface protocol, so an AI agent can *operate* the PLC the same way a
  human engineer does through the API. This is not a future integration. It is
  how the runtime is administered today.

## 4. Proof, Not Promises

A vision document earns the right to dream in its second half by proving, in its
first, that the team behind it does not ship vapor. Three standing disciplines
make Part I trustworthy — and they are themselves part of what ControlForge *is*.

- **Every regression becomes a permanent sentinel.** When something breaks, the
  fix is not the end — a check that re‑detects that entire class of failure,
  forever, is added to an automated overseer that probes live instances and
  regenerates a status board on every run. Bugs do not get fixed twice.

- **No fabricated demonstrations.** Numbers and behaviors shown to anyone come
  from the actual running system, never a reimplementation or a mock‑up. The
  capability ledger above was read from a live registry for exactly this reason.
  If it is in this paper, it answered an API call.

- **Wire‑proven, not datasheet‑proven.** Protocol support is validated against
  real protocol stacks in a loopback harness. The standard for "supported" is
  the device on the wire, not a claim in a table.

This is the culture. It is why the body described in Part I can be trusted to be
real — and why the nervous system described in Part II is worth taking seriously.

---

> **Everything above this line runs today.** What follows does not yet — and will
> always say so. *Part II — The Nervous System — begins below.*

---

# Part II — The Nervous System

*Forward-looking. The wall is behind us. From here on, where something does not yet
exist, the text says so — and where a moonshot already has a seed running in the
codebase, it names it.*

## Proof of Life

Before we describe the nervous system waking up, here it is twitching.

![A three-body system tracing the stable figure-eight choreography, rendered from the live ControlForge runtime.](assets/threebody_trails.png)

*Three masses on the classic figure-eight orbit — one of the most numerically
delicate solutions in celestial mechanics. This is not an animation and not a
side tool reimplementing physics for a video. It was computed by a gravity
solver, integrated by a rigid-body engine, and rendered — three heavy workloads
on one shared control plane, supervised by the runtime, stepped in lock-step with
the deterministic scan. Run it twice and you get bit-identical results.*

And here is the part that matters more than the picture:

![The ControlForge historian recording a Newton's-cradle twin: 23 physics tags, 35.2 million samples, with a contact-force trace selected.](assets/cradle_historian.png)

*A Newton's cradle — the textbook torture test for a physics engine, because
momentum has to march cleanly down a chain of touching bodies or the illusion
collapses. Here it runs as a digital twin, and every physical quantity it
produces — contact forces, per-ball velocities and positions — is a **live PLC
tag** in the runtime's own historian: 23 tags, 35.2 million samples, disk-backed,
with the `f34` contact force selected and trending. The cradle is not a video of
a simulation. Its physics are data flowing through the same runtime that drives
real machines.*

Two demonstrations, both already real, both captured from the actual system. They
exist to make a single promise credible: **the runtime can host a faithful,
deterministic model of the physical world, beside the scan, and treat that model
as first-class control data.** Hold that thought. Every section below is a
consequence of it.

## 5. AI at the Edge Needs a Body

The prevailing bet on industrial AI is a disembodied one: keep the intelligence in
the cloud, let it sip tag data through the historian, and send advice back down.
It is a reasonable bet, and it is wrong about the most important loops. Advice that
arrives a network round-trip late, with no guarantee of arriving at all, cannot
own a control decision. The cloud can *counsel* the machine. It cannot *be* the
machine.

A mind that acts on the physical world needs a body with three properties the
cloud cannot offer: it must be **local**, so the loop never waits on a network; it
must be **deterministic**, so the reflex underneath the cognition is never
poisoned; and it must be **auditable**, so that when an intelligence touches
metal, a human can see exactly what it did and why. ControlForge is built to be
that body. The remainder of this paper is what becomes possible once a mind has
one.

## 6. The Self-Explaining Machine

*Picture the technician at 2 a.m., alone, with a line down and a plant manager
already calling.* Today the machine offers a fault code and a stack of manuals.
Tomorrow the machine explains itself — in plain language, on the panel, offline:
*"I stopped because infeed pressure fell below the interlock for the third time in
an hour. Each time it followed a dropout on the upstream conveyor's network
segment. Here is the trend. The conveyor, not me, is the thing to look at."* Not a
chatbot bolted to a dashboard — a machine that understands its own state and its
own history well enough to narrate them.

**The seed running today:** an AI assistant embedded *inside* the runtime, with
read access to the live program, the variables, the diagnostics, and the fault
history — plus tag-freshness primitives (`VAR_TS`, `VAR_AGE_MS`) that let it
reason about *when* it last knew something, not just what. The narrator already
has everything it needs to see; what remains is to teach it to speak the
technician's language. This is the nearest moonshot, and the one your fifteen
years in the field should aim first.

## 7. The Self-Writing Plant

Control logic is still written the way it was written in 1990: by hand, by a
specialist, one rung or one statement at a time. Tomorrow, the engineer describes
*intent* — "interlock the press until both light curtains are clear and the part
is seated" — and the machine drafts the Structured Text, checks it against the
runtime's own rules, simulates it against a twin, and hands back logic that is
correct before it is ever downloaded. The specialist moves from typing to
judging.

**The seed running today:** the embedded assistant can already draft Structured
Text and validate it against the live function registry and parser — and the
runtime exposes its *entire* operation (programs, tasks, variables, diagnostics)
over an open agent-interface protocol, so an AI agent can author, load, and
inspect logic through exactly the same surface a human engineer uses. The plant is
already programmable *by* an agent. Teaching that agent to start from human intent,
and to prove its work against a twin before it ships, is the road from here.

## 8. The Perceiving Plant

A blind machine cannot inspect the part it just made. Today, vision lives in a
separate box from a separate vendor, integrated through a fragile handshake, its
verdict arriving as a single bit. Tomorrow, perception is simply part of the
control program: the loop asks *what do you see* and branches on the answer —
counts the parts, reads the label, judges the weld, rejects the defect — in the
same scan, in the same language, as the logic that drives the actuator.

**The seed running today:** this one is barely a moonshot — the perception
primitives are already in the function registry. `VISION_*` triggers inference and
returns object counts, labels, confidences, and per-object fields with inference
timing as a first-class value; `VIDEO_CAMERA_*` brings live capture into the
runtime. The eye is wired to the reflex *now*. What grows from here is breadth —
more models, more inspection vocabulary — not a new architecture.

## 9. The Learning Fleet

A classic plant is an amnesiac archipelago: every controller an island, every
shift a fresh start, every hard-won bit of tuning lost when the power cycles. The
fleet that learns is the opposite. Before bad logic touches real steel, it is
tried against a faithful twin and its consequences are *seen*, reproducibly. Good
logic, once found on one line, propagates to every identical line. Tuning
discovered in one plant raises the floor for all of them. Knowledge stops
evaporating and starts compounding.

**The seed running today — and this is the one that just got firmer:** the physics
twin from *Proof of Life* is no longer an experiment on a branch. The sidecar
platform — a Rapier-based physics engine and a Python compute brain (SymPy, SciPy,
control), each supervised by the runtime over one shared, capability-discoverable
control plane — **is merged into the codebase.** It is at foundation maturity, not
a finished product: the lock-step twin, the control plane, and the compute worker
are real and measured; the polished authoring tools and packaging are still ahead.
But the substrate for *try-it-against-a-twin-before-you-touch-metal* exists today,
and the runtime can already snapshot and restore its own state — the raw material
of "fork the plant, try the change, keep it only if it survives." Pair that with
the runtime's existing fleet discovery, and "the line learns, then teaches its
siblings" stops being a metaphor and becomes a roadmap.

## 10. The Negotiating Plant

The last wall is between machines. Today they are wired together by a human who
decides, in advance, exactly how the conveyor hands off to the press. Tomorrow,
machines that each understand their own state and goals negotiate the handoff
themselves — the upstream cell tells the downstream cell what is coming and when,
the downstream cell answers with what it can take, and the line balances itself
without a central choreographer scripting every move.

**The seed running today:** the data spine for this already exists — Sparkplug B
and NATS give every machine a real-time, structured voice on a shared bus, and the
northbound-quality work means a machine can publish not just a value but *how much
to trust it*. Machines can already talk. Teaching them to *bargain* — to carry
intent and constraint, not just telemetry — is the long arc, and the most
speculative claim in this paper. We mark it as such.

## Where This Goes

Read the two halves of this paper together and the shape is clear. Part I is a
body that already exists: deterministic, connected, sensing, single-binary,
trustworthy near metal. Part II is that body waking up — explaining itself,
writing itself, perceiving, learning across a fleet, and eventually negotiating
with its peers. None of the second half requires abandoning the first. Every
moonshot is a consequence of the same architectural choice — *let cognition live
beside the scan, not across a network from it* — and every one of them already has
a seed running in the codebase, several of which you can watch execute today.

The machines on the floor have been deaf, mute, and amnesiac for fifty years. The
body that fixes that is built and running. What remains is to wake it up.

---

*This document is maintained in two halves by deliberate design. Part I is
re-measured against a live instance on each revision; Part II is revised as its
seeds mature — and any capability that graduates from "seed" to "runs today"
crosses the wall into Part I, with its number attached.*