ForemanYour AI foreman.
Software that reads your machines' control logic, learns what normal looks like, and tells you what's actually wrong. Connected read-only, and provably so.
Running today on Siemens, Beckhoff, CODESYS and Unitronics hardware. No writes. No control. No cameras. Just the logic.
Downtime is expensive. Diagnosis is what makes it long.
Your HMI tells you what tripped. It has never once told you why.
A stopped line burns money by the hour, and most of those hours go to finding the fault, not fixing it. The crew on shift starts from an alarm that points at the wrong place, then works backwards through cabinets, manuals and call-backs to the integrator. Sometimes for days. The veteran who could shortcut that hunt is retiring, everywhere.
Alarms fire late, and at the wrong station
Fixed thresholds trip when damage is already done, and they point at the station where the symptom landed, not the component where the fault began. The hunt starts in the wrong place.
The logic is a black box
The one document that fully describes your machine, its control program, is unreadable to everyone except the integrator who wrote it, years ago. When you need him, you wait for him.
Vendors only see their own boxes
The drive vendor sees drives. The MES sees orders. Nobody sees the causal chain that crosses cabinets, which is where real faults live.
It doesn't watch your machine. It understands it.
Condition-monitoring tools bolt sensors on and guess from vibration. Foreman starts from the one source of truth that already exists: the PLC program itself.
Connect, read-only
A small industrial gateway joins the machine network and reads live values from the PLC. Nothing is installed on the PLC, and nothing is ever written to it.
Connection profiles: OPC UA (a scoped server interface exposing only the agreed tags) or Modbus TCP restricted to a single read-only function code (see below).
Read the actual program
Foreman parses your machine's real control code (the ladder, the SCL, the function blocks) and builds a causal graph of how every output depends on every input.
This is the difference. It doesn't correlate signals; it knows this valve is commanded by this block because of this sensor, because it read the code that says so.
Learn normal. Explain faults.
It learns your machine's healthy behaviour (cycle times, step dwells, signal envelopes), then explains deviations in plain language, tracing them through the logic to the root cause.
Judgements come from trained statistics over completed cycles, never from one startled sample. That is what keeps false alarms rare.
Read-only. Provable, not promised.
Every vendor says “don't worry, it's read-only.” We think a declaration is worth exactly what it costs to write. So the maximum-assurance Foreman profile is designed so that your own engineer can prove it, without trusting our software, or us.
One function code, defined read-only
The gateway speaks Modbus TCP using a single function code: FC04, Read Input Registers. The public Modbus specification defines that register space as read-only; no write function for it exists. That's a property of an open standard, not of our configuration.
Nothing writable is mapped
The monitored tags are mapped only into the input-register table: no coils, no holding registers. A write request has no addressable target. You hold the project file; you can open it and check.
Your firewall, your rules
An industrial firewall with Modbus deep-packet inspection, bought, owned and configured by you from a vendor unrelated to us, permits exactly one flow: gateway → PLC, port 502, FC04 only. Everything else is dropped and logged.
The five-check verification: run by your engineer, not ours
- V1 · Inspect the mapOpen the PLC project you hold: confirm nothing writable is mapped.
- V2 · Inspect the rulesReview the firewall ruleset: one flow, one function code, default deny.
- V3 · Watch the wirePassive capture on a mirror port: filter for any non-read frame. The count is zero.
- V4 · Try to break itAttempt a write from our gateway's own address, and watch the firewall drop and log it.
- V5 · Standing tripwireThe write-attempt alarm stays armed permanently. Not a test. A property.
The acceptance criterion isn't our signature. It's a procedure your engineer can run, and could fail us on.
Five hours before the first alarm, at the right component.
Our benchmark line is a four-station cup fill-and-seal machine: 3,790 lines of real PLC code, six drives, twelve valves, 269 live tags. We seed it with a fault every maintenance veteran will recognise (a coolant-pump bearing beginning to wear) and let physics do the rest:
| Elapsed | What happens | Who sees it |
|---|---|---|
| 0:15 | Coolant flow leaves its learned envelope, at unchanged pump speed | Foreman flags P-01 |
| 1:50 | Cooling valve pinned at 100% for five minutes | Foreman: chain confirmed |
| 5:00 | First HMI alarm: “Station 4 reject rate high”. The wrong station. | HMI |
| 5:35 | Fixed low-flow limit finally trips | HMI |
| 5:45 | Pump overcurrent: drive trips, line stops | HMI |
The sealer is provably innocent
The first alarm blames station 4, so that's where your fitter would start. Foreman shows seal force, platen temperature, dwell and film tension all sitting in their healthy distributions, and clears the sealer explicitly. The diagnosis points upstream, across two cabinets, at a pump bearing, with the causal chain spelled out.
Same symptom, opposite cause. Caught.
A clogged strainer produces the identical downstream story. But bearing wear shows pressure down with current up; a clog shows pressure up with current down. Two failures, one symptom, opposite signatures, and different spare parts. Foreman tells them apart. A threshold never will.
Under the hood. We insist you look.
You're going to audit this anyway, so here is what Foreman actually does, in the language of the people who will be doing the auditing.
Native connectors, one ingest core
Each vendor front-end speaks the protocol the PLC already offers: OPC UA against a scoped server interface (Siemens, CODESYS), ADS notifications (Beckhoff TwinCAT), Modbus TCP restricted to FC04 (Unitronics and Schneider profiles). All of them feed one shared recording core. The vendor front-end carries no clock logic and no interpretation; it moves samples.
Program ingest is offline, from the vendor's own project format: the TIA Portal XML export, the TwinCAT 3 project, the CODESYS project (including Schneider EcoStruxure Machine Expert), the UniLogic project file, the Studio 5000 L5X. We read what your integrator actually wrote, not a manually maintained tag list.
Commissioning rule: before any model is trained, a per-machine probe measures the wire itself: sampling cadence, timestamp behaviour, subscription limits. Measured, never assumed from a datasheet.
The logic graph
The program (SCL, Structured Text, ladder) is parsed into its blocks, tasks and variables, then compiled into a causal graph: which block writes which output, gated by which condition, reading which input. Every diagnosis is a walk on that graph, not a correlation between time series.
For scale: our benchmark machine's 3,790 lines of SCL compile to 29 blocks and 269 published tags, with every write, read, gate and call edge resolved.
The standing test: we maintain the same reference machine on two vendor stacks in parallel and require the two graphs to match field-for-field on every code change. If cross-vendor translation drifts, our CI fails, before a customer ever sees it.
Time is evidence, treated like it
A publish cycle that batches two samples into one packet will collapse a dwell measurement to zero if you stamp on receive. The ingest layer runs a hybrid clock (epoch anchored at the gateway, spacing taken from the device's source timestamps, drift re-anchored continuously), so a 100 ms sample spacing survives a 200 ms publish floor intact.
Verdicts ride medians over completed cycles, never a single extreme: one burst straddling a publish boundary is not allowed to vouch for a machine.
At commissioning: a twenty-second clock probe decides how that specific CPU's timestamps will be treated. Per machine, per firmware, measured.
A golden model, not a threshold file
Training learns your machine's healthy geometry: per-step dwell bands, per-cycle extremes, duty cycles of intermittent signals, time between parts. A conveyor sampled two scans into its ramp is not “abnormal feedback”: the model knows that step's trained band and judges the transient against the statistic, not the instant.
The watch process also knows the difference between a state it observed forming and one it inherited mid-cycle at startup, so a restart cannot fabricate events. And “is it fixed?” is answered by grading the completed cycles since the event against the golden model, not by whether an alarm happens to be quiet.
Design consequence: alarms that merely advise are separated from alarms that stop, so the line keeps running, and keeps being diagnosed, while you decide.
| Live connection | OPC UA · Beckhoff ADS · Modbus TCP (FC04-only profile) · read-only in every profile |
|---|---|
| Program ingest (offline) | TIA Portal export · TwinCAT 3 project · CODESYS / Machine Expert project · UniLogic project · Studio 5000 L5X |
| Sampling | down to 100 ms live sampling (vendor/CPU dependent) · reference programs modelled to their 20 ms scan |
| PLC footprint | zero code installed · zero logic modified · optional scoped read-only interface (configuration, in your project, under your version control) |
| Deployment | industrial edge gateway on the machine network · connection work sized to a normal maintenance window |
| Verification | clock probe + read-only V1–V5 protocol at commissioning · wire captures retained as evidence |
One foreman. All your vendors.
Machines from different decades and different vendors, one diagnostic layer. Foreman reads each vendor's native project format and speaks each one's native protocol.
Siemens
S7-1200 / S7-1500, TIA Portal. Live today on physical S7-1200 hardware over OPC UA, with the program read from the TIA project export.
Beckhoff
TwinCAT 3, live over ADS. Structured Text parsed directly from the project.
CODESYS
The runtime behind machines from 500+ device makers. Our benchmark machine runs on it: the project is parsed natively, live over its certified OPC UA server or Modbus TCP.
Unitronics
UniStream / UniLogic. Project-file reader for ladder and tags; Modbus TCP read-only connection profile.
Allen-Bradley
ControlLogix / CompactLogix via Studio 5000 L5X project export.
Schneider
Modicon machine controllers (M241 / M251 / M262, EcoStruxure Machine Expert) are CODESYS-based and read through the same toolchain. Modbus TCP read-only profile, on the protocol Schneider created.
The pilot: one site, five endpoints, fixed price.
No enterprise rollout, no open-ended integration project. We scope it in one site visit, quote it as a fixed price, and you judge the result on your own machines.
What you get
- Up to five monitored endpoints (machines and supporting assets), connected read-only
- Your control programs read and modelled; baseline behaviour learned from your real cycles
- A live dashboard your team can question in plain language
- The read-only verification protocol, executed with your engineer
- A findings report at the end of the pilot period, including anything we find in the logic itself
Then, per machine, monthly:
Standard
Monitoring, diagnosis, dashboard and alerting for every connected unit.
Full-Care
Everything in Standard, plus hardware care, an annual on-site visit, priority response and a yearly model retrain.
Why “your AI foreman”?
Every plant used to have one. The person who walked the floor at six in the morning, knew every machine's sound, and noticed the pump that ran a little hot before anyone else did. When something broke, he didn't read you an error code. He told you what happened, why, and what to do about it.
That person is retiring, everywhere, and taking thirty years of listening with him. Foreman is our answer: not a dashboard with more numbers, but a foreman who has actually read the machine's logic, and answers to yours.
Built by Segev Technologies
Foreman is a GoMachines.AI product, engineered by Segev Technologies, a Tel-Aviv R&D firm that has spent two decades building electronics, firmware, motion control and AI for robots and precision systems, for clients including Israel Aerospace Industries, Applied Materials, Elbit, Siemens, Mitsubishi Electric and HP.
We are machine builders. We didn't learn factories from a dataset.
Straight answers.
Can it ever write to my PLC?
In the maximum-assurance profile, no. And not because we promise: the connection uses a protocol function that the public Modbus specification defines as read-only, your PLC maps nothing writable, and your own firewall drops anything else. You verify all three yourself, with the five-check procedure above. In the OPC UA profile, the server interface is scoped to the agreed tags and configured read-only in your project, which you also hold.
Does it change anything on the machine?
No software is installed on the PLC and no program logic is modified. Depending on the profile, a small configuration step on the PLC side may be needed (for example, mapping the monitored tags to a read-only interface), done together with your team, in your project, under your version control.
What about our production data?
Your control programs and process data are treated as confidential engineering material, covered by NDA. Where the data lives (on-premises or cloud) is agreed per site during scoping.
Is this another condition-monitoring sensor kit?
No. Foreman starts from your machine's control program, not from add-on sensors. It reads the logic, builds the causal graph, and interprets the signals your machine already produces. That's why its diagnosis can say which component, not just something is vibrating.
How disruptive is installation?
Typically a gateway in or beside the cabinet, a network connection, and the read-only configuration, scoped so that connection work fits in a normal maintenance window. Learning your machine's baseline then happens from normal production, without test runs.
Our machines are from four different vendors and three decades. Really?
That's the design goal. One platform reads Siemens, Beckhoff, CODESYS, Schneider, Unitronics and Allen-Bradley natively (project files and protocols), so your team gets one place to ask, whatever is bolted to the floor. Additional vendors are quoted per project.
Your machines already explain themselves.
In a language nobody reads.
Let's connect five endpoints and show you what they've been saying.
Request a pilotForeman · a GoMachines.AI product · engineered by Segev Technologies · Tel Aviv · segevtech.com