Infrastructure that runs itself.
BASALT is the control plane for physical operations. It holds a live twin of the whole site, reasons over it with a mesh of specialised agents, rehearses every change in simulation before it touches a machine — and hands the decision back to a person whenever the stakes demand it.
Standing directive · campus one
Increase output by 11% over the next 72 hours without exceeding the energy cap and without increasing safety risk.
The premise
Software that talks is solved. BASALT is built for the part that isn't: perceiving a physical site, reasoning about what happens next, and acting on it — safely, continuously, and with its work shown.
§ 01
Console
You set the goal. It builds the plan.
An operator states an outcome, not a procedure. BASALT expands it into hundreds of candidate plans, plays each one forward in the twin, keeps the ones that satisfy every constraint, and executes the best of them across the fleet. This console runs the real loop shape on recorded campus behaviour.
Directive
Every run leaves an evidence trail: inputs, rejected plans, the constraint that killed each one, and who approved the survivor.
Fig. 2Directive execution. Grey traces are rejected plans; the red trace is the one that survived every constraint.
§ 02
Digital twin
One campus, kept honest in software.
35,000 entities — buildings, cells, machines, robots, breakers, batteries, chillers, racks, pallets, people zones — each with live state, physics and history. The twin is not a picture of the site. It is the surface every agent reasons on, and the sandbox every plan is tried in first.
Hover or focus a building. Bars show current utilisation.
§ 03
Agents
Twelve specialists, one chain of command.
Each agent owns a domain, its own models and its own tools. They negotiate through the twin rather than through a chat window: a proposal is only real once it has been rehearsed and has cleared every other agent's constraints. The executive agent is the one that talks to people.
| Agent | Authority | Remit | Needs a human for |
|---|---|---|---|
| OperationsSupervisory | L3 | Holds the directive and arbitrates between agents. | Any change to the directive itself. |
| ProductionDomain | L3 | Re-sequences lines, cells and orders. | Anything that misses a committed customer date. |
| RoboticsDomain | L3 | Tasks 2,400 robots and autonomous assets. | Introducing a new robot class into a shared human zone. |
| EnergyDomain | L3 | Runs the microgrid against price and cap. | Islanding the campus from the grid. |
| ThermalDomain | L2 | Cooling, heat reuse, envelope. | Setpoint changes outside the agreed band. |
| MaintenanceDomain | L2 | Predicts failure, writes work orders. | Taking a critical asset out of service during a committed run. |
| Supply chainDomain | L2 | Reacts to late or substituted components. | Approving a substitute part. |
| QualityDomain | L2 | Inspects, detects drift, closes the loop. | Releasing a quarantined batch. |
| SafetyGuardian | L4 | Vetoes anything that raises risk to people. | Never overridden by software. Only a person can clear a safety hold. |
| SecurityGuardian | L3 | Segments, isolates, proves integrity. | Anything that stops production to contain a threat. |
| SimulationService | L1 | Rehearses every plan before it is real. | Nothing. It has no authority over the physical site. |
| ExecutiveInterface | L1 | Explains, requests approval, records. | It exists to ask. |
§ 04
The loop
Six steps, running continuously.
The loop is the product. Everything else — models, agents, twin, fleet — exists to keep it turning inside its latency budget.
Observe
180,000 streams, camera and LiDAR perception, controller state and people zones fused into one consistent picture of now.
10 Hz · edge
Simulate
Hundreds of candidate futures rehearsed against physics, traffic, thermal and process models before anything moves.
≤ 40 s · site
Decide
The plan that satisfies every hard constraint and best serves the directive. Rejections are kept with their reason.
≤ 2 s · site
Execute
Broken into machine-level tasks and dispatched to fleets, cells and the grid, with safe states pre-computed.
< 100 ms · edge
Verify
Reality is measured against the rehearsal continuously. Drift outside the envelope pauses the plan, not the plant.
250 ms · edge
Learn
Every deviation corrects the model that predicted it, so the next rehearsal starts closer to the truth.
per run · cloud
§ 05
Autonomy
Autonomy is a dial, not a switch.
Each domain sits at its own level, and moves up only after its predictions have matched reality for long enough to earn it. Nothing is autonomous because it shipped that way.
L0
Observed
The twin watches and reports. No proposals, no actions. This is where every new facility starts.
L1
Advisory
The system proposes plans with full reasoning. A person executes them by hand.
L2
Approved
The system builds and stages the plan; execution begins only after a named operator approves it.
L3
Supervised
Campus one runs hereThe system executes inside a pre-agreed envelope and reports continuously. Any operator can hold, amend or reverse.
L4
Bounded
The system acts without waiting — only where waiting is the greater risk: safety stops, containment, ride-through.
What holds it in
Deterministic fallback
Every cell keeps a controller that runs the process without any AI in the path. Losing the control plane costs optimisation, not production.
Constraint kernel
Hard limits — separation, force, temperature, import cap, permits — are enforced outside the models, and no agent can argue with them.
Rehearsal before reality
No plan reaches hardware that has not been played forward in the twin and cleared by the safety agent.
Evidence by default
Inputs, rejected options, the binding constraint, the approver and the outcome are recorded for every decision, and exportable for audit.
Standards as a floor
IEC 62443 zones and conduits, ISO 10218 and ISO/TS 15066 for collaborative operation, and the NIST AI Risk Management Framework for the agent layer.
§ 06
Architecture
Three tiers, one state.
Latency decides where code runs. Anything that can stop a machine runs metres from it; anything that needs the whole campus runs on site; anything that learns across sites runs in the cloud.
Edge
Perception, control and safety logic on ruggedised nodes next to the machines. Runs headless if the site link drops.
Site
The twin, the agent mesh, the simulation farm and the decision record. Active-active across two compute halls.
Cloud
Model training, cross-site benchmarking, long-horizon planning and the release pipeline that promotes a model only after it beats the incumbent in replay.
§ 07
Deployment
One campus, fourteen facilities, running now.
BASALT was built as a portable autonomy platform and proven on a single hard case: a robotic manufacturing and AI-compute campus with its own microgrid and its own logistics yard.
Bring a site under BASALT.
Deployment starts at L0: we instrument the site, stand up the twin and run it in observation for one production cycle. You see the system predict your plant before it is allowed to touch it.
Typical first phase: twelve weeks from instrumentation to a twin that tracks the site within its verification envelope.