Part 3 of 7 in our Edge to Enterprise in practice series. In Sense, Decide, Act we set one rule for the CATIMi Advisor - the model advises; the controller decides - and this post shows how that rule holds when advice reaches the control logic itself.
Why AI pilots stop at the dashboard
Many AI pilots end in the same place: a good model, a convincing dashboard, and a firm no from the controls engineer when someone suggests letting it near the process. The engineer is right. A model that can write to a plant output can make a machine do something nobody decided. A controller that waits on a model can stall a line when the network hiccups.
So the question is not whether AI should reach control. It is on what terms.
Four terms for AI near control
CATIM Nimbus sets four, and each holds on its own.
The controller never waits
Tributary's flows run inside the CODESYS controller, on its own scan. They do not subscribe to the network and they do not wait on the AI. The platform hands each flow the values it asked for - the Advisor's anomaly score, or a setpoint written through the i3X API - and the flow reads them like any other input. If nothing new has arrived, the scan runs anyway.
Control timing never depends on the network, the message broker or the model. That is a design rule, not a tuning target: a slow model has no way to hold up a scan.
Advice says whether to trust it
Advice arrives marked valid or not, like every value on the platform. It is valid only while it is fresh, inside its declared range and of good quality. If the Advisor stops publishing, its score goes stale, or the link to it drops, the advice turns invalid within seconds.
The flow sees that at once and falls back on its own logic. A stale score is never mistaken for a current one, and a missing score never passes for a real zero. Everything the flow computes from invalid advice is marked invalid too, so the doubt travels with the data instead of disappearing into it.
Advice reaches the plant only where the flow arms it
Reading advice is one thing; acting on it is another. A flow may use the Advisor's score freely to raise an alarm, log a trend or inform a person. But advice reaches a plant output - a write to a drive over Modbus, an output channel - only where the flow is explicitly armed to let it through.
If a flow that drives the plant reads advice it has not armed, every write it would make to the plant is refused and every output holds its safe value. The controller logs which input held it, and why. Arming is a deliberate setting in the flow, visible to anyone who opens it in Tributary Studio, never a side effect.
A shipped unit takes no advice at all
Above the flows sits the controller's own enable. On a unit as it ships, it is off: the controller takes no advice from the platform, whatever a flow says. Turning it on is a deliberate step on the unit itself, by the people responsible for it. Until then, advice informs people - on dashboards and in alarms - and never the control logic.
That makes two independent switches. The flow must arm the advice, and the controller must allow it. The model can set neither.
Shown on a simulated machine
We have run these terms against a simulated machine, not a customer plant. The Advisor's score and a setpoint written through the i3X API both reached a flow. With the controller's enable off, both were refused and read invalid. Advice feeding a write to the simulated device, unarmed, was refused, and the device's register stayed untouched. Armed, the same write went through.
What it means for you
- For executives: AI can add value on the line without becoming the thing that stops it, and the case for it fits on one page: two switches, both held by people.
- For project managers: a pilot can begin with advice to people and move into a flow one step at a time, each step a visible change rather than a leap of faith.
- For engineers: the controller stays the authority. Advice arrives in a flow as a checked input with its validity, and the flow, not the model, decides what it may touch.
Start where the risk is lowest
If your AI pilot has stalled at the dashboard because nobody will let it near control, the terms above may be the conversation you need. We would like to hear what your line would ask of it. Get in touch.
About CATIM. CATIM - Creating Automation Technology In Motion - empowers people to engineer automation solutions that solve hard technical problems. CATIM Nimbus, the CODESYS edge controller with advisory AI, is the next generation of the Nimbus platform it has built since 2019.