Enterprise

One policy model across every machine in the group.

Groups do not have a mill problem, they have a variance problem: twelve sites, twelve ways of running a grade change, twelve different break rates. Pulpum makes the operating envelope explicit, comparable and enforceable — while keeping each site's furnish and grade models private.

Talk to sales Security overview

Multi-site fleetGroup policy + site override$700k–$9M ACV

run_8f21c4 · agent graph · PM4 10 nodes · 1 approval gate
01 · orchestrator ingest.grade_target ✓ SUCCEEDED 02 · orchestrator twin.simulate ✓ SUCCEEDED 03 · pulp_stock stock.refine ✓ SUCCEEDED 04 · wetend_chem wetend.dose ✓ SUCCEEDED 05 · form_press form.headbox ✓ SUCCEEDED 06 · form_press press.nip ✓ SUCCEEDED 07 · dry_coat dry.steam ✓ SUCCEEDED 08 · defect_inspect inspect.web ✓ SUCCEEDED 09 · orchestrator approve.human ◆ APPROVAL 10 · quality_conf reel.qualify ✓ SUCCEEDED

Live example: Grade change PM4 · 135 gsm kraftliner → 110 gsm testliner, no break, ≤14 min off-spec

Capabilities

What "enterprise" actually means here

Not a bigger licence. A different set of controls.

Identity

SSO, SCIM, tag-level RBAC

Azure AD, Okta or on-prem LDAP. Roles map to what a person may approve, per machine and per tag — not to a generic admin flag.

Policy

Group policy, site override

The group sets a maximum autonomy level and an approval chain; each site may be more conservative, never less.

Benchmarking

Compare like for like

Break rate, broke, steam per tonne and first-pass quality normalised across machines so the comparison survives a grade mix argument.

Deployment

VPC, on-prem, air-gapped

Mill-edge autonomy survives loss of the control plane. Fully air-gapped operation is supported for sensitive producers.

Model governance

Versioned and gated

Every model promotion is gated on golden datasets and deterministic replay of historical runs, per site.

Support

Named engineering

A dedicated deployment engineer per group and a quarterly model review per machine, with the results in writing.

Run timeline

The same run record, everywhere

A run on PM4 in one mill is legible to an engineer in another. That is the point of a shared operating layer.

run_8f21c4 PM4 · 6.8 m trim · 1,180 m/min SUCCEEDED
  1. 01 ingest.grade_target SUCCEEDED 0.8 s

    Mill Orchestrator — Pulled the 110 gsm testliner spec, customer tolerances and the standing energy budget from mill MES; locked the target envelope for the run.

  2. 02 twin.simulate SUCCEEDED 34 s

    Mill Orchestrator — Simulated 48 candidate transition recipes on the as-run paper-machine twin — forming, press, dryer and calender — and ranked them on off-spec tonnes, break risk and steam.

  3. 03 stock.refine SUCCEEDED 2 m 10 s

    Pulp-and-Stock — Stepped refiner specific edge load 1.9 → 1.4 Ws/m and pushed freeness toward 412 CSF while consistency held at 3.4%.

  4. 04 wetend.dose SUCCEEDED 1 m 26 s

    Wetend-and-Chemistry — Retention aid trimmed to 214 g/t and sizing to 1.1 kg/t against live charge and turbidity; first-pass retention recovered to 78% inside 90 seconds.

  5. 05 form.headbox SUCCEEDED 1 m 05 s

    Form-and-Press — Re-cut the slice profile across 78 actuators and set jet-to-wire to 0.994 to hold formation index through the basis-weight ramp.

  6. 06 press.nip SUCCEEDED 48 s

    Form-and-Press — Nip load reduced 620 → 540 kN/m to protect the lighter web; post-press dryness landed at 47.1%.

  7. 07 dry.steam SUCCEEDED 3 m 18 s

    Dry-and-Coat — Re-phased the steam schedule across 6 dryer groups and rebalanced the hood; reel moisture converged to 7.4% ±0.19 2σ at 6.1% less steam than the standing recipe.

  8. 08 inspect.web SUCCEEDED continuous

    Defect-and-Inspect — 18 line-scan cameras streaming; two edge-crack precursors detected at the drive side and cleared by a 40 kN/m nip trim before either propagated.

  9. 09 approve.human APPROVAL 52 s

    Mill Orchestrator — Speed ramp 1,180 → 1,245 m/min exceeded the site autonomy threshold. Held for the machine tender; approved by J. Okonkwo at 04:57:12.

  10. 10 reel.qualify SUCCEEDED 1 m 31 s

    Quality-and-Conformance — Reel R-24188 released: full genealogy written (furnish, chemistry, CD profiles, defect map, operator actions) and checked against grade spec.

Autonomy

Four levels, set per agent and per tag

A mill does not go from manual to unattended in one step. Pulpum makes the level explicit, auditable and reversible at any time.

Autonomy levels and the human role at each
LevelWhat the agent doesWhat the human doesTypical time to reach
L1 · AdvisoryRecommends setpoints and explains whyEnters every change manuallyWeek 1
L2 · SupervisedProposes a write; it executes on approvalApproves each write in the HMIWeek 3–6
L3 · BoundedWrites inside tag, rate and magnitude limitsApproves ramps and grade releasesMonth 2–4
L4 · UnattendedRuns the envelope without promptingSets the envelope; reviews the shift recordMonth 6+ [ASPIRATIONAL]
Rollout

A typical group rollout

Sequenced so that the second mill is faster than the first and the twelfth is routine. [ASPIRATIONAL — programme structure]

A typical group rollout
PhaseScopeDurationGate
Pilot1 machine, 1 workflow90–120 daysBaseline improvement agreed by the site
Reference millAll machines, all modules2 quartersBreak rate and steam per tonne at target
Wave 13–4 mills2–3 quartersGroup policy ratified; approval chains live
Wave 2Remaining sites3–4 quartersCross-mill benchmarking in the group report
Steady stateFleet operationsOngoingQuarterly model review per machine
Tool calls

Auditable at group level

Every mill writes to the same append-only record format, so group audit is a query rather than a project.

tool-call stream · run_8f21c4
  1. 04:51:04mes.read_orders({ machine: "PM4", next_grade: "TL-110" })
  2. 04:51:04ok spec locked · basis 110 g/m² · moisture 7.4% ±0.5
  3. 04:51:05twin.simulate({ candidates: 48, horizon: "18 min" })
  4. 04:51:39ok best recipe #31 · est. off-spec 6.4 t · break risk 0.07
  5. 04:51:40policy.evaluate({ recipe: 31, autonomy: "L3" })
  6. 04:51:40ok 9 writes permitted · 1 write requires human approval
  7. 04:51:41dcs.write_setpoint({ tag: "REF4.SEL", from: 1.9, to: 1.4 })
  8. 04:53:51ok freeness 388 → 412 CSF · consistency 3.4%
  9. 04:53:52chem.dose({ retention_aid: "214 g/t", sizing: "1.1 kg/t" })
  10. 04:55:18ok first-pass retention 71% → 78%
  11. 04:55:19dcs.slice_profile({ actuators: 78, jet_to_wire: 0.994 })
  12. 04:56:24ok formation index 84 · CD basis 2σ 1.7 g/m²
  13. 04:56:25vision.stream({ cameras: 18, model: "webdefect-v7" })
  14. 04:56:41precursor: edge crack risk 0.62 · drive side · 1,412 mm
  15. 04:56:42dcs.nip_load({ delta: "-40 kN/m", zone: "press-2" })
  16. 04:56:58ok edge crack risk 0.62 → 0.09 · web stable
  17. 04:56:59approval.request({ action: "speed_ramp", to: "1245 m/min" })
  18. 04:57:12ok approved by J. Okonkwo (machine tender) · logged
  19. 04:58:44mes.log_reel({ reel: "R-24188", genealogy: "full" })
  20. 05:02:46ok run complete · 11m42s · off-spec 6.2 t · breaks 0

Reasoning trace

Plan → thought → action → observation, exactly as the orchestrator recorded it.

GoalMove PM4 from 135 gsm kraftliner to 110 gsm testliner with zer…

Move PM4 from 135 gsm kraftliner to 110 gsm testliner with zero breaks and under 14 minutes of off-spec production.

PlanSimulate the transition on the twin first. Lead with stock and…

Simulate the transition on the twin first. Lead with stock and chemistry so the furnish is right before the basis weight ramps, then trim forming and press, then re-phase drying. Watch the web continuously; hold the speed ramp for a human.

ThoughtThe standing recipe drops basis weight and speed together. On …

The standing recipe drops basis weight and speed together. On the twin that produces a 3-minute moisture excursion because the dryer section unloads faster than the steam schedule can follow. Sequencing the steam re-phase ahead of the basis-weight ramp removes it.

Actiontwin.simulate(candidates=48) → recipe #31 re-phases steam 40 s…

twin.simulate(candidates=48) → recipe #31 re-phases steam 40 s before the basis-weight ramp and holds nip load until post-press dryness confirms.

ObservationRecipe #31 estimates 6.4 t off-spec against 9.8 t for the stan…

Recipe #31 estimates 6.4 t off-spec against 9.8 t for the standing recipe, with break risk 0.07. Two candidates scored lower on steam but raised break risk above the 0.15 site limit and were discarded.

ActionExecute recipe #31 under autonomy level L3: nine setpoint writ…

Execute recipe #31 under autonomy level L3: nine setpoint writes permitted, speed ramp routed to the machine tender.

ObservationEdge-crack precursor at 1,412 mm drive side at 04:56:41. Nip t…

Edge-crack precursor at 1,412 mm drive side at 04:56:41. Nip trim of −40 kN/m in press-2 cleared it in 16 s without a break.

OutcomeRun complete in 11 m 42 s. 6.2 t off-spec, zero breaks, 6.1% l…

Run complete in 11 m 42 s. 6.2 t off-spec, zero breaks, 6.1% less dryer steam than the standing recipe. Reel R-24188 released with full genealogy.

Governance

Autonomy needs an owner

The most common failure in industrial AI is not a bad model — it is that nobody agreed who may change the envelope. Pulpum forces that decision into configuration.

What the group controls

  • Maximum autonomy level per agent and per tag class
  • Who may approve a ramp, a grade release or an envelope change
  • Which model versions are permitted in production
  • Retention period and export format for the audit log
  • Data residency, tenancy and on-prem boundaries
  • Spend and compute limits per site
Guardrails

An agent that can move a nip needs a leash

Pulpum writes to production equipment. Every capability is scoped, every write is policy-checked, and every action is written to an append-only audit log the mill owns.

  • Bounded action space. Each agent can only write to an explicit tag allow-list, inside per-tag rate and magnitude limits.
  • Policy engine before every write. Autonomy level, shift, grade, interlock state and operator presence are all evaluated before a setpoint moves.
  • Human-in-the-loop gates. Anything above the site threshold — speed ramps, grade releases, safety-adjacent moves — waits for a named approver.
  • Immutable audit log. Append-only, hash-chained, exportable, and retained on the mill's own storage.
  • Hard fallback. Loss of the edge node, the network or the model returns control to the DCS's last known-good state within one scan cycle.
  • Tenant and IP isolation. Furnish recipes, grade models and defect libraries never cross a customer boundary. On-prem deployment available.

Compliance posture

StandardScopeStatus
SOC 2 Type IICloud control plane RUNNING In progress [ASPIRATIONAL]
ISO 27001Company-wide ISMS QUEUED Planned [ASPIRATIONAL]
IEC 62443Mill-edge OT security RUNNING Design-aligned
GDPROperator data SUCCEEDED Compliant
ISO 9001 / FSCQuality + chain of custody records SUCCEEDED Supported

Read the security overview

Multi-agent handoff

Agents negotiate, they do not collide

Two agents will want the same actuator. The orchestrator arbitrates on the run goal, not on who asked first — and the handoff is logged like any other step.

Contested move: press-2 nip load

  1. 01form_press.request(nip −0 kN/m) SUCCEEDED0.2 s

    Form-and-Press wants to hold nip load to protect post-press dryness.

  2. 02defect_inspect.request(nip −40 kN/m) SUCCEEDED0.2 s

    Defect-and-Inspect wants to reduce nip load to clear an edge-crack precursor.

  3. 03orchestrator.arbitrate SUCCEEDED0.4 s

    Break risk 0.62 outranks a 0.4-point dryness loss under the run goal "zero breaks". Defect-and-Inspect wins the actuator for 120 s.

  4. 04form_press.handoff(returned) SUCCEEDED120 s

    Actuator returned; Form-and-Press recovers dryness with vacuum instead. Post-press dryness lands at 47.1%.

Arbitration rules

  • Run goal first. Every request is scored against the declared goal, not the requesting agent's local objective.
  • Safety and breaks outrank quality. A break costs hours; a profile excursion costs minutes.
  • Time-boxed ownership. An agent holds a contested actuator for a bounded window, then must re-justify.
  • Everything is logged. The losing request, the score and the reason all appear in the run record.
  • Deadlocks escalate to a human rather than resolving by timeout.

See the agent roster

Measured

Group-scale targets

Modelled across a 12-mill group [ASPIRATIONAL].

12 Mills on one policy model
99.5% Control-plane SLA
0 Cross-tenant model leakage by construction
1 Audit format across the fleet

Figures are design targets and pilot-scoped results [ASPIRATIONAL]. Every number is reproduced from the mill's own reel genealogy, not our telemetry.

Integrations

It speaks mill, not cloud

Pulpum reads and writes through the systems already on the floor. No rip-and-replace, no parallel historian, no new HMI to learn.

QCS

Valmet IQ, ABB 800xA QCS, Honeywell Experion MX

Profiles, scans, lab results

DCS

ABB 800xA, Valmet DNA, Honeywell Experion, Siemens PCS 7

Setpoint reads and guarded writes

Web inspection

WIS/WMS line-scan, IR and transmission cameras

Frames, defect maps, break replays

Mill MES

SAP PP/QM, ABB cpmPlus, custom historians

Orders, grades, reel genealogy

Historian

OSIsoft PI, Aspen IP.21, InfluxDB

Time-series backfill and replay

Robotics

NVIDIA Isaac, winder and wrapper PLCs

Reel, roll and clamp-truck motion

Identity

Azure AD, Okta, on-prem LDAP

SSO, RBAC, named approvers

Edge

NVIDIA Jetson Orin, IGX, on-prem GPU

Sub-100 ms inference at the machine

See all integrations

From the control room

What machine tenders say

Autonomy earns trust one shift at a time. These are design-partner quotes from pilot deployments [ASPIRATIONAL].

"The first thing that convinced the crew wasn't the control — it was the log. You can scroll back and see exactly why it dropped the nip. Nobody argues with a timestamp."

Machine tender · PM4 · Nordkraft Mills

"We had two people who could do a clean 135-to-110 transition. One retired in March. The twin now does the sequencing and the second one supervises it."

Production manager · Aurora Board

"Break prediction was the wedge. Ninety seconds of warning is the difference between a nip trim and four hours of threading."

Process engineer · Ternvik Paper
FAQ

Straight answers

The questions mill managers and process engineers actually ask in the first meeting.

Yes. Grade models, furnish recipes and defect libraries are scoped to the site by default. A group can opt to share benchmark metrics without sharing the underlying models.

Get started

Standardise the way your group runs paper

We will map your machine fleet, pick the reference mill, and agree the baseline before any contract is signed.

Talk to sales See pricing