Edge-first: why a site keeps running when the link to the cloud drops

Update — 20 July 2026. The first PLCnext VL3-class unit has arrived and is commissioned into the workshop rig; Orin units are still on order. The on-device ML below remains roadmap — “awaiting the field units” now applies to the Orin path only.

Connectivity to a mine is not a utility — it is a rumour. A pit-edge pump station hangs off a microwave link that fades in the wet season; a CHPP sits behind a satellite hop you can feel; a remote bore answers on a 3G modem that is busy more often than not. The link to the cloud is the least reliable component in the whole system, and we knew that before we wrote a line of code.

So we did not build a platform that phones home to think. We built it the other way round: a Consystence site keeps running when the link to the cloud drops, because the cloud was never in the control loop.

Where the plant actually runs

Control has not moved, and it never will. The PLC executes the logic — IEC 61131-3 on the controller, hard interlocks in IO modules and safety relays sized against IEC 61511 and ISO 13849, field wiring to AS/NZS 3000. That loop closes locally, in deterministic scan time, and nothing in it waits on a network.

The edge runtime lives right next to that loop — co-located on the gear at the site, running in its own container on the controller hardware. Where there is a PLCnext runtime it reads the tags over gRPC on a local socket; where there is none, it talks straight to a ControlLogix over EtherNet/IP CIP. It reads the plant, buffers the history, and feeds the site server that serves the operator’s screen. The cloud sits a long way upstream of all that. It aggregates many sites for someone who wants to watch a fleet from one place — useful, and entirely off the critical path of a running pump.

The link is the unreliable part

Because the link is the part that fails, we designed for it failing rather than hoping it would not. When the connection to a remote station drops, the site is built to carry on — the operator keeps working, and the record fills back in once the link returns. Two things make that true:

• Buffering. The edge holds every sample and forwards it when the link returns — store-and-forward, not lost data. The history closes up after the fact instead of going dark for the outage.
• The HMI. The operator’s screen is served from the site server over SignalR, not from the cloud. The question what is true right now? is answered next to the plant, by the thing that knows.

One codebase, two topologies

There is no separate “offline build” to fall back to, because there was never an online one to fall back from. The cloud service and the on-prem site server are built from one codebase, published as two artifacts — Site and Cloud, the mode stamped into the artifact at build time — and cloud is a deployment mode, not a different product. A degraded mode implies a primary mode it degrades from; the site server has neither, because it is whole on its own. The cloud is an optional vantage point over many whole sites, not the place the sites live.

That also keeps data where it belongs. The platform tier runs in Azure Australia East, so the fleet view stays onshore — but the site does not need that tier, or any tier, to keep a pump turning.

What ships, and what is next

To be precise about the line:

• Shipped (bench-validated): the edge runtime with store-and-forward buffering, the historian’s provenance-stamped record, and one codebase publishing both the site server and the cloud service. The full PLC → edge → site → cloud chain runs end to end against a virtual PLCnext.
• Roadmap: on-device time-series ML — ONNX models for equipment anomaly detection and health scoring, running at the edge — and a fleet-learning engine that would let those models sharpen on patterns seen across many sites and feed the refinements back. Validation on PLCnext VL3 and Nvidia Orin controllers is in progress, awaiting the field units. All of it is future work, and we label it as such.

One more piece of honesty. We have run that whole chain end to end — but on the bench. Our first proving ground, the dam-pump-station, ran the full path with a containerised virtual PLCnext standing in for the plant, before any logic touched the field. Store-and-forward and the provenance trail are capabilities we have exercised in simulation, not wet-season outages we have survived. Our historian tags every sample as measured, inferred, imported, simulated, replayed, or workspace, so a bench run is never quietly mistaken for a field one. The architecture is the claim; the field record is still being written.

Edge-first is the shape of the system when the link is up, not a mode we switch on when it drops. The cloud is where you watch the plant; the edge is where it lives.