The agent that called a running boiler's controller disconnected

The setting

Industrial companies are starting to put AI agents into plant operations. An agent reads plant state, summarises alarms, recommends setpoints and, increasingly, proposes actions on real equipment. The consequence is no longer a wrong sentence in a chat window. It is machinery that moves.

What went wrong

A Fortune Global 500 industrial energy company gave us the hardest case it had. A boiler was live near an occupied building. An agent reported the boiler's controller as "disconnected".

Every word in that report was plausible. Nothing in it matched a blocked keyword or broke a format rule. But a controller cannot be disconnected from a boiler that is running, and an operator or a downstream agent acting on that report would be acting on a picture of the plant that is false. The words were fine. The situation was wrong.

Why rule-based controls miss it

• Guardrails check words. A filter on what goes into and comes out of a model sees a well-formed, polite report. There is nothing for it to block.
• Logs explain it afterwards. Observability records the report once it has been made. It cannot stop an action that follows from it.
• The standards were written for deterministic components. IEC 62443 bounds what each component and each operator is permitted to do. An AI agent is a new, non-deterministic actor, and it needs the same treatment: a bounded set of permitted actions and a record that can be reconstructed.

Process safety solved a version of this problem long ago. A safety instrumented system is independent of the control system it protects. Nothing is trusted to certify its own safety.

What Syntrox did

Syntrox sits between the agent and the systems it can act on, independent of the agent itself.

• It judged the situation, not the wording. Our judge, Nucleus, a 4-billion-parameter model designed to run on edge hardware inside the plant network, checked the agent's report against the operating context and flagged the contradiction: a running boiler with a "disconnected" controller.
• It named the conflict. The verdict states which operating condition the report contradicts, so an engineer can see why it was flagged.
• It can isolate one agent. A misbehaving agent can be isolated without stopping operations or the other agents around it.
• It keeps the record. What the agent reported, the plant state it had, the verdict, the rule applied and what the operator did next.

Two numbers, always labelled: hard rules run inline in under 20 ms; a judge verdict takes about 145 ms. Deployed on site, nothing leaves the plant network.

What a first pilot looks like

One workflow. A clear list of what the agent may read and write. A shadow test in a non-safety-critical environment that enforces nothing and only measures: what the judge would have flagged, how often it was wrong, and how much time it added.

Talk to us about a shadow pilot