Typed step graphs
Every run is a directed graph of typed steps with an owner, a tool, a duration and a status. Nothing executes outside the graph.
Features
Everything the mill needs to trust a machine that acts.
Autonomy in a paper mill is not a model problem. It is a bounding problem, a latency problem and an evidence problem. These are the features that solve all three.
Live example: Grade change PM4 · 135 gsm kraftliner → 110 gsm testliner, no break, ≤14 min off-spec
Core
The features that make autonomy safe
Every one of these exists because a machine that can move a nip needs more than a good model.
Checked before every write
Autonomy level, tag allow-list, rate and magnitude limits, interlock state and operator presence are evaluated before any setpoint moves.
Simulate, then act
Candidate moves run on the as-run twin first. A move that the twin says raises break risk above the site limit never reaches the DCS.
Lead time, not alarms
Break precursors are surfaced with an estimated lead time and a recommended counter-move, not as another horn in the control room.
Classified, not just detected
Holes, wrinkles, spots, streaks and edge cracks are classified and located on the reel map so the cause can be traced.
Full actuator set
Basis weight, moisture and caliper CD profiles controlled together rather than one at a time against each other.
Every reel, fully traced
Furnish, chemistry, profiles, defects, agent actions and human approvals attached to each reel and exportable.
Append-only and hash-chained
Immutable, timestamped, exportable, and retained on the mill's own storage. Assurance-grade by construction.
Re-run history
Any historical run can be replayed against a new model version before that version is allowed near the machine.
Run timeline
One real run, step by step
Every Pulpum run is an ordered, inspectable sequence. This is run_8f21c4 on PM4 · 6.8 m trim · 1,180 m/min — Completed in 11 m 42 s · 6.2 t off-spec (baseline 9.8 t) · zero breaks.
run_8f21c4
PM4 · 6.8 m trim · 1,180 m/min
SUCCEEDED
-
01
ingest.grade_target
SUCCEEDED
0.8 s
Mill Orchestrator — Pulled the 110 gsm testliner spec, customer tolerances and the standing energy budget from mill MES; locked the target envelope for the run.
-
02
twin.simulate
SUCCEEDED
34 s
Mill Orchestrator — Simulated 48 candidate transition recipes on the as-run paper-machine twin — forming, press, dryer and calender — and ranked them on off-spec tonnes, break risk and steam.
-
03
stock.refine
SUCCEEDED
2 m 10 s
Pulp-and-Stock — Stepped refiner specific edge load 1.9 → 1.4 Ws/m and pushed freeness toward 412 CSF while consistency held at 3.4%.
-
04
wetend.dose
SUCCEEDED
1 m 26 s
Wetend-and-Chemistry — Retention aid trimmed to 214 g/t and sizing to 1.1 kg/t against live charge and turbidity; first-pass retention recovered to 78% inside 90 seconds.
-
05
form.headbox
SUCCEEDED
1 m 05 s
Form-and-Press — Re-cut the slice profile across 78 actuators and set jet-to-wire to 0.994 to hold formation index through the basis-weight ramp.
-
06
press.nip
SUCCEEDED
48 s
Form-and-Press — Nip load reduced 620 → 540 kN/m to protect the lighter web; post-press dryness landed at 47.1%.
-
07
dry.steam
SUCCEEDED
3 m 18 s
Dry-and-Coat — Re-phased the steam schedule across 6 dryer groups and rebalanced the hood; reel moisture converged to 7.4% ±0.19 2σ at 6.1% less steam than the standing recipe.
-
08
inspect.web
SUCCEEDED
continuous
Defect-and-Inspect — 18 line-scan cameras streaming; two edge-crack precursors detected at the drive side and cleared by a 40 kN/m nip trim before either propagated.
-
09
approve.human
APPROVAL
52 s
Mill Orchestrator — Speed ramp 1,180 → 1,245 m/min exceeded the site autonomy threshold. Held for the machine tender; approved by J. Okonkwo at 04:57:12.
-
10
reel.qualify
SUCCEEDED
1 m 31 s
Quality-and-Conformance — Reel R-24188 released: full genealogy written (furnish, chemistry, CD profiles, defect map, operator actions) and checked against grade spec.
Tool calls
The agent shows its work
Every tool invocation, argument and result is written to an immutable, human-readable log — and every reasoning step is expandable. Nothing about a run is hidden from the mill.
- 04:51:04mes.read_orders({ machine: "PM4", next_grade: "TL-110" })
- 04:51:04ok spec locked · basis 110 g/m² · moisture 7.4% ±0.5
- 04:51:05twin.simulate({ candidates: 48, horizon: "18 min" })
- 04:51:39ok best recipe #31 · est. off-spec 6.4 t · break risk 0.07
- 04:51:40policy.evaluate({ recipe: 31, autonomy: "L3" })
- 04:51:40ok 9 writes permitted · 1 write requires human approval
- 04:51:41dcs.write_setpoint({ tag: "REF4.SEL", from: 1.9, to: 1.4 })
- 04:53:51ok freeness 388 → 412 CSF · consistency 3.4%
- 04:53:52chem.dose({ retention_aid: "214 g/t", sizing: "1.1 kg/t" })
- 04:55:18ok first-pass retention 71% → 78%
- 04:55:19dcs.slice_profile({ actuators: 78, jet_to_wire: 0.994 })
- 04:56:24ok formation index 84 · CD basis 2σ 1.7 g/m²
- 04:56:25vision.stream({ cameras: 18, model: "webdefect-v7" })
- 04:56:41precursor: edge crack risk 0.62 · drive side · 1,412 mm
- 04:56:42dcs.nip_load({ delta: "-40 kN/m", zone: "press-2" })
- 04:56:58ok edge crack risk 0.62 → 0.09 · web stable
- 04:56:59approval.request({ action: "speed_ramp", to: "1245 m/min" })
- 04:57:12ok approved by J. Okonkwo (machine tender) · logged
- 04:58:44mes.log_reel({ reel: "R-24188", genealogy: "full" })
- 05:02:46ok run complete · 11m42s · off-spec 6.2 t · breaks 0
Reasoning trace
Plan → thought → action → observation, exactly as the orchestrator recorded it.
GoalMove PM4 from 135 gsm kraftliner to 110 gsm testliner with zer…
Move PM4 from 135 gsm kraftliner to 110 gsm testliner with zero breaks and under 14 minutes of off-spec production.
PlanSimulate the transition on the twin first. Lead with stock and…
Simulate the transition on the twin first. Lead with stock and chemistry so the furnish is right before the basis weight ramps, then trim forming and press, then re-phase drying. Watch the web continuously; hold the speed ramp for a human.
ThoughtThe standing recipe drops basis weight and speed together. On …
The standing recipe drops basis weight and speed together. On the twin that produces a 3-minute moisture excursion because the dryer section unloads faster than the steam schedule can follow. Sequencing the steam re-phase ahead of the basis-weight ramp removes it.
Actiontwin.simulate(candidates=48) → recipe #31 re-phases steam 40 s…
twin.simulate(candidates=48) → recipe #31 re-phases steam 40 s before the basis-weight ramp and holds nip load until post-press dryness confirms.
ObservationRecipe #31 estimates 6.4 t off-spec against 9.8 t for the stan…
Recipe #31 estimates 6.4 t off-spec against 9.8 t for the standing recipe, with break risk 0.07. Two candidates scored lower on steam but raised break risk above the 0.15 site limit and were discarded.
ActionExecute recipe #31 under autonomy level L3: nine setpoint writ…
Execute recipe #31 under autonomy level L3: nine setpoint writes permitted, speed ramp routed to the machine tender.
ObservationEdge-crack precursor at 1,412 mm drive side at 04:56:41. Nip t…
Edge-crack precursor at 1,412 mm drive side at 04:56:41. Nip trim of −40 kN/m in press-2 cleared it in 16 s without a break.
OutcomeRun complete in 11 m 42 s. 6.2 t off-spec, zero breaks, 6.1% l…
Run complete in 11 m 42 s. 6.2 t off-spec, zero breaks, 6.1% less dryer steam than the standing recipe. Reel R-24188 released with full genealogy.
In depth
Three features worth the detail
The ones mills ask about in the second meeting.
Latency
Perception has to be local
A cloud round trip is three orders of magnitude too slow for a web moving 20 metres per second. Pulpum classifies at the machine and only ships summaries, frames of interest and training data upstream.
- 8–24 cameras synchronised per machine
- Sub-100 ms defect classification
- Sub-250 ms break-risk update
- Local buffer survives network loss
edge.perception SUCCEEDED
| Signal | Before | With Pulpum |
|---|---|---|
| Classification latency | 1.4 s (cloud) | 82 ms |
| Risk update rate | 5 s | 240 ms |
| Network dependency | hard | none |
Evidence
The log is the product
Crews do not trust autonomy because it is accurate. They trust it because they can scroll back and see exactly why it did what it did, with a timestamp and a named approver.
- Request, reasoning, limits and result per step
- Human approvals recorded with the approver's name
- Rejected recommendations retained as training data
- Hash-chained and exportable
audit.write SUCCEEDED
| Signal | Before | With Pulpum |
|---|---|---|
| Actions logged | partial | 100% |
| Reasoning captured | none | per step |
| Export format | — | JSON + CSV |
Rehearsal
Nothing new happens live
A grade change that has never been run is run first on the twin. Recipes are ranked on off-spec tonnes, break risk and steam, and anything above the site risk limit is discarded before a human ever sees it.
- 10–100 candidates per transition
- Ranked on three objectives, hard risk limit
- Chosen recipe executed step by step
- Twin corrected against every real run
twin.simulate SUCCEEDED
| Signal | Before | With Pulpum |
|---|---|---|
| Candidates evaluated | 1 | 48 |
| Off-spec tonnes | 9.8 | 6.2 |
| Transition time | 19 m 05 s | 11 m 42 s |
Multi-agent handoff
Agents negotiate, they do not collide
Two agents will want the same actuator. The orchestrator arbitrates on the run goal, not on who asked first — and the handoff is logged like any other step.
Contested move: press-2 nip load
-
01form_press.request(nip −0 kN/m) SUCCEEDED0.2 s
Form-and-Press wants to hold nip load to protect post-press dryness.
-
02defect_inspect.request(nip −40 kN/m) SUCCEEDED0.2 s
Defect-and-Inspect wants to reduce nip load to clear an edge-crack precursor.
-
03orchestrator.arbitrate SUCCEEDED0.4 s
Break risk 0.62 outranks a 0.4-point dryness loss under the run goal "zero breaks". Defect-and-Inspect wins the actuator for 120 s.
-
04form_press.handoff(returned) SUCCEEDED120 s
Actuator returned; Form-and-Press recovers dryness with vacuum instead. Post-press dryness lands at 47.1%.
Arbitration rules
- Run goal first. Every request is scored against the declared goal, not the requesting agent's local objective.
- Safety and breaks outrank quality. A break costs hours; a profile excursion costs minutes.
- Time-boxed ownership. An agent holds a contested actuator for a bounded window, then must re-justify.
- Everything is logged. The losing request, the score and the reason all appear in the run record.
- Deadlocks escalate to a human rather than resolving by timeout.
Autonomy
Four levels, set per agent and per tag
A mill does not go from manual to unattended in one step. Pulpum makes the level explicit, auditable and reversible at any time.
| Level | What the agent does | What the human does | Typical time to reach |
|---|---|---|---|
| L1 · Advisory | Recommends setpoints and explains why | Enters every change manually | Week 1 |
| L2 · Supervised | Proposes a write; it executes on approval | Approves each write in the HMI | Week 3–6 |
| L3 · Bounded | Writes inside tag, rate and magnitude limits | Approves ramps and grade releases | Month 2–4 |
| L4 · Unattended | Runs the envelope without prompting | Sets the envelope; reviews the shift record | Month 6+ [ASPIRATIONAL] |
At a glance
The run, in six tiles
The same run, summarised the way a shift lead would want it on the wall.
The orchestrator plans, the agents act
A run starts as a goal, becomes a plan, and executes as a graph of typed steps. The active path is always visible, always logged, always reversible.
RUNNING APPROVAL SUCCEEDED
Autonomy is a dial, not a switch
L1 advisory, L2 supervised writes, L3 bounded autonomy, L4 unattended within an envelope. Each site sets the level per agent, per tag, per shift — and every write above the threshold waits for a named approver.
Measured
Feature impact
Composite pilot figures [ASPIRATIONAL].
11 m 42 s
Grade change on PM4 · baseline 19 m 05 s
6.2 t
Off-spec tonnes per transition · baseline 9.8 t
68%
Web breaks predicted more than 90 s early
7.9%
Less dryer steam per tonne of paper
Figures are design targets and pilot-scoped results [ASPIRATIONAL]. Every number is reproduced from the mill's own reel genealogy, not our telemetry.
Developers
Define an agent, bound it, run it
The Pulpum SDK is typed Python. Tools are declared with schemas and limits; the policy engine enforces them at call time — not in a review meeting.
What you get
- Typed tool definitions with unit-aware ranges and rate limits
- Deterministic replay of any historical run against a new model
- Local twin harness so a recipe is simulated before it is shipped
- Autonomy policy as code, versioned and reviewed like any other change
# Bound the dryer agent to six steam groups on PM4.
from pulpum import Agent, Tool, Limit, Autonomy
steam = Tool(
name="dcs.steam_schedule",
tags=["PM4.DRY.G1..G6.PRESS_SP"],
limits=[Limit(max_step="0.15 bar", per="30s")],
)
dryer = Agent(
id="agent.dry_coat",
goal="reel moisture 7.4% +/-0.5, min steam",
tools=[steam, Tool("qcs.read_moisture", read_only=True)],
# bounded writes; humans still gate ramps
autonomy=Autonomy.L3,
# simulate on the twin before every write
verify="twin",
)
run = dryer.start(machine="PM4", grade="TL-110")
for step in run.stream():
print(step.name, step.status, step.duration)
CLI
Start a run from anywhere
The same run engine, the same policy checks, the same audit trail — from the terminal, the HMI or the SDK.
$ pulpum run "grade change PM4 to TL-110" --autonomy L3
→ plan composed 10 steps · 1 approval gate
→ twin.simulate 48 candidates · best #31 · risk 0.07
→ policy.evaluate 9 writes permitted · 1 held for human
→ executing stock.refine ... ok 2m10s
→ executing wetend.dose .... ok 1m26s
→ executing form.headbox ... ok 1m05s
→ executing dry.steam ...... ok 3m18s
! approval required speed_ramp 1180 → 1245 m/min
→ approved J. Okonkwo · machine tender · 04:57:12
→ run complete 11m42s · off-spec 6.2 t · breaks 0
$ pulpum runs show run_8f21c4 --format genealogy
From the control room
What machine tenders say
Autonomy earns trust one shift at a time. These are design-partner quotes from pilot deployments [ASPIRATIONAL].
"The first thing that convinced the crew wasn't the control — it was the log. You can scroll back and see exactly why it dropped the nip. Nobody argues with a timestamp."
Machine tender · PM4 · Nordkraft Mills
"We had two people who could do a clean 135-to-110 transition. One retired in March. The twin now does the sequencing and the second one supervises it."
Production manager · Aurora Board
"Break prediction was the wedge. Ninety seconds of warning is the difference between a nip trim and four hours of threading."
Process engineer · Ternvik Paper
Integrations
It speaks mill, not cloud
Pulpum reads and writes through the systems already on the floor. No rip-and-replace, no parallel historian, no new HMI to learn.
Valmet IQ, ABB 800xA QCS, Honeywell Experion MX
Profiles, scans, lab results
ABB 800xA, Valmet DNA, Honeywell Experion, Siemens PCS 7
Setpoint reads and guarded writes
WIS/WMS line-scan, IR and transmission cameras
Frames, defect maps, break replays
SAP PP/QM, ABB cpmPlus, custom historians
Orders, grades, reel genealogy
OSIsoft PI, Aspen IP.21, InfluxDB
Time-series backfill and replay
NVIDIA Isaac, winder and wrapper PLCs
Reel, roll and clamp-truck motion
Azure AD, Okta, on-prem LDAP
SSO, RBAC, named approvers
NVIDIA Jetson Orin, IGX, on-prem GPU
Sub-100 ms inference at the machine
Guardrails
An agent that can move a nip needs a leash
Pulpum writes to production equipment. Every capability is scoped, every write is policy-checked, and every action is written to an append-only audit log the mill owns.
- Bounded action space. Each agent can only write to an explicit tag allow-list, inside per-tag rate and magnitude limits.
- Policy engine before every write. Autonomy level, shift, grade, interlock state and operator presence are all evaluated before a setpoint moves.
- Human-in-the-loop gates. Anything above the site threshold — speed ramps, grade releases, safety-adjacent moves — waits for a named approver.
- Immutable audit log. Append-only, hash-chained, exportable, and retained on the mill's own storage.
- Hard fallback. Loss of the edge node, the network or the model returns control to the DCS's last known-good state within one scan cycle.
- Tenant and IP isolation. Furnish recipes, grade models and defect libraries never cross a customer boundary. On-prem deployment available.
Compliance posture
| Standard | Scope | Status |
|---|---|---|
| SOC 2 Type II | Cloud control plane | RUNNING In progress [ASPIRATIONAL] |
| ISO 27001 | Company-wide ISMS | QUEUED Planned [ASPIRATIONAL] |
| IEC 62443 | Mill-edge OT security | RUNNING Design-aligned |
| GDPR | Operator data | SUCCEEDED Compliant |
| ISO 9001 / FSC | Quality + chain of custody records | SUCCEEDED Supported |
Enterprise
Standardise autonomy across the group
One policy model, one audit trail, one benchmark across every machine in every mill — with the grade and furnish models kept private to each site.
- SSO, SCIM and role-based access down to the tag level
- Group-wide autonomy policy with per-site override and approval chains
- Cross-mill benchmarking on broke, breaks, steam and first-pass quality
- VPC, on-prem and fully air-gapped mill-edge deployment options
- 99.5% control-plane SLA; edge autonomy survives control-plane loss
- Dedicated deployment engineer and quarterly model review per site
FAQ
Straight answers
The questions mill managers and process engineers actually ask in the first meeting.
Yes, but only within an explicit tag allow-list with per-tag rate and magnitude limits, and only at the autonomy level your site has set. Level 1 is advisory-only: Pulpum recommends and a human enters everything. Most mills spend their first weeks there before enabling supervised writes.
Control returns to the DCS last known-good state within one scan cycle. Pulpum is designed as a supervisory layer on top of your existing control system, never as a replacement for it, so a Pulpum outage degrades the mill to its current way of running — not to a stop.
Break prediction and defect classification typically need 8 to 12 weeks of QCS, DCS and inspection history per grade family, plus labelled break events. Advisory recommendations start in week one from the physics-based twin, and improve as mill-specific history accumulates.
Only if you choose cloud training. Recipes, grade models and defect libraries are tenant-isolated and never used to train another customer's models. A fully on-prem deployment with an air-gapped mill edge is available for sensitive producers.
You are, the same as with any control strategy — which is why every write is policy-checked, bounded, logged and reversible, and why anything above your risk threshold waits for a named approver. The audit log records the request, the reasoning, the limits applied and the human decision.
A 90 to 120 day mill-edge deployment on one paper machine, scoped to a single workflow with a pre-agreed baseline [ASPIRATIONAL]. Weeks 1–3 are connection and shadow-mode observation; weeks 4–8 advisory; weeks 9+ supervised or bounded writes if the mill is satisfied with the recommendations.
Get started
See these features on your machine
Start with one paper machine and one measurable baseline. A 90-day mill-edge pilot on break prediction, drying energy or moisture profile shows the number before you commit further.