Skip to content
WINGMANAUTOMATION
Safety architecture

It cannot make things worse.

Machine learning in a control loop should make you nervous. That is why, in this system, the learning is structurally prevented from taking the wheel. The worst case is no worse than the proven controller. That holds by design, not just in testing.
01Who is in control

The learning is never allowed to drive.

A proven optimising controller makes a complete decision every cycle, from the very first one, inside the machine's limits. That decision is the floor.

The learning is only allowed to improve on that decision. When it can't, the proven decision is used unchanged. By design, it cannot substitute a guess for good control.

Every action in the audited session
All 115 logged control decisions came from the proven controller. The learned model was trained during the session but had not yet been given authority to adjust anything.
Four permissions, all must agree
  1. 01
    Is the machine in a state that accepts writes?
    Bagger running, line in production, not in standby.
  2. 02
    Is the controller licensed for this machine?
    Per-machine licensing, verified offline.
  3. 03
    Is the change inside the machine's own limits?
    Small enough steps, inside the configured bounds.
  4. 04
    Is the data behind this change trustworthy?
    Fresh, valid readings from the machine.

Any one of them says no, and nothing is written. Software cannot bypass these checks, and your E-stop and the weigher's own controls are untouched.

02Measured, not asserted

Every decision of the session was audited.

0
feeder settings issued in an unsafe configuration
Measured session, 23 Jul 2026Zero unsafe feeder combinations across all 115 logged decisions.
0
adjustments exceeding the configured rate limit
Measured session, 23 Jul 2026The largest single step on any head between successive decisions sat exactly at the configured limit. Never over.
0
overweight or no-dump events during autonomous control
Measured session, 23 Jul 2026Taken from the change in the machine's overweight counter across the armed window 10:07:14 → 10:42:30.
20
times it stood itself down: 7 when the line stopped, 13 while it settled after a restart
Measured session, 23 Jul 202620 stand-downs and 19 automatic resumes recorded in the controller's event log, every one driven by machine state.
Every adjustment, against the rate limit
STEP LIMIT010203040MINUTES · LARGEST PER-HEAD CHANGE
Swipe sideways to see the whole chart
Each mark is the largest single per-head change the controller made between one decision and the next, against the configured step limit. 21 changes reached the limit in the first 10 minutes, while it walked the feeders up from where the plant had them; after that it held them steady. It never crossed the limit in 115 decisions.Measured session, 23 Jul 2026All 115 logged control decisions on the autonomous machine. The largest per-head change equalled the configured step limit and never exceeded it. Violations: 0. Unsafe feeder combinations: 0.
Interlocks: when the line stopped, so did it
CONTROLLER WRITING010203040MINUTES · GREY = STOOD DOWN ON MACHINE STATE
Swipe sideways to see the whole chart
20 times in 45 minutes the controller stood itself down: when the bagger stopped or went idle, and again while the machine settled after each restart. It picked back up on its own 19 times. Nobody told it to.Measured session, 23 Jul 202620 stand-downs and 19 automatic resumes in the controller's event log, every one driven by real machine state: 7 for the bagger stopping or going idle, 13 for settling after a restart. The last stand-down came as the run ended, so it had nothing to resume.

These figures come from a single measured 45-minute session, not from sustained production experience. They describe what the controller did on that line, on that day.

03The full cluster

Seven safety properties, in plain terms.

Learning stays in second place

The learned model can only ever improve on a proven control move. It can never replace it with a guess.

The worst case is 'exactly as good as the proven controller'.

Layered authority to write

Four independent permissions must all agree before a single value reaches your machine.

Any one of them says no and nothing is written.

Machine-state interlocks

Bagger stops, line goes idle, machine goes to standby: the controller stands down on its own and re-engages when production resumes.

Seen 20 times in 45 minutes: 7 line stops, and 13 settling periods after a restart.

Rate-limited adjustments

It moves in small, bounded steps. It cannot lurch.

Verified: zero violations across every decision of the session.

Fail closed, always

Lost connection, bad data, expired licence, unexpected state: it stops writing and keeps watching. It never guesses.

Monitor mode

Runs alongside your line watching and learning without writing a single value, for as long as you want.

Off means off

Switch it to monitor and the machine runs exactly as it did before. Nothing to uninstall, no settings stranded.

04What people ask

The questions engineers actually ask.

What happens if it crashes or the computer dies?

The weigher keeps running exactly as it was, on the last settings it received. Wingman is a supervisor on top of your machine's own control, not a replacement for it. There is no state in which your line stops because our software stopped.

Can it damage my machine or make my weights worse?

It works inside your machine's own limits and moves in small, rate-limited steps. Four independent permissions must all agree before any value is written; if any of them disagrees, nothing is written. In the audited session, zero adjustments exceeded the safe step limit and zero unsafe configurations were issued.

Machine learning in my control loop makes me nervous.

It should. That's why the learning is structurally prevented from taking the wheel. The proven controller makes every decision. The learning can only improve on it, never overrule it.

The worst case is “no worse than the proven controller”.

Does my production data leave the plant?

No. Not a byte. It runs on your isolated plant network with no internet dependency. There is no cloud service, no telemetry, no phone-home. Even licensing is done offline by exchanging a short code.

Will this void anything with my equipment supplier?

It communicates over the weigher's standard interface and makes no physical or firmware modification. It writes the same setpoints an operator writes.

We already have good operators.

You do, and this doesn't replace them. It does the part of their job that requires watching fourteen heads simultaneously, every second, for eight hours, without a lapse of attention. It frees them for the work that actually needs a person, and it gives them an instrument that can tell them when a bad number isn't the weigher's fault at all.

Bring us your hardest question.

A line assessment starts with your line, not our slides. If there's a failure mode you're worried about, ask it on the call.