Twindra
Rehearse the batch before you run it.
Physics-informed, GPU-accelerated twin of a formulation and tooling family: granulation DEM, coating CFD, compression and ejection risk, dissolution surrogate. Predicts…
Physical AI · Oral solid dose autonomy
The tablet plant runs itself. QA decides what gets released.
Pildeon is an agent operating system for oral solid dose manufacturing. Nine agents control blending, granulation, compression, capsule filling and coating; vision, PAT and NIR sense defects and content uniformity in real time; an as-made batch twin rehearses the run first; and every action lands in a validated 21 CFR Part 11 audit trail with a QA reviewer on every release.
Scenario: Run one immediate-release tablet batch through granulation, compression, coating and inspection inside the approved design space, with QA approval before release. A design walkthrough, not a customer record.
Products
Five products, one system
The five products share one plant-edge runtime, one tenant-isolated quality corpus, one Part 11 audit spine and the same three buyers. Each is a land-point into a different wedge workflow, and each one feeds the corpus that makes the others sharper.
Spectryn
Content uniformity and real-time release, in-line.
Fuses NIR and PAT spectra across blending, granulation, drying and compression into calibrated, formulation-specific models that call blend uniformity, content…
Visqa
Every tablet inspected at line speed.
Multi-camera deep models detect and classify chips, cracks, capping and lamination, spots, mottling, twins and print defects at line speed, trained on a cross-plant…
Conforma
Right-first-time release, fully audited.
Ingests every action, sensor state, recommendation and QC result into a time-aligned batch genealogy, drafts deviation investigations and CAPA proposals with mandatory…
Kinetos
Autonomous handling for the tablet plant.
Vision-guided mobile and arm robots dispense, transport, dock and stage IBCs, powders and compression tooling between units, sequenced by the orchestrator for the next…
Run timeline · scenario
One batch, step by step
Every Pildeon run is an ordered, inspectable sequence. This is run_b2c7e1, a design scenario on one immediate-release tablet line: granulation, compression, coating and inspection inside the approved design space, with QA approval before release.
run_b2c7e1
Line 2 · rotary tablet press · scenario
SUCCEEDED
-
01
ingest.batch_record
SUCCEEDED
1.2 s
Plant Orchestrator · Pulled the master batch record, the approved design-space limits for this formulation and tooling family, and the site autonomy policy from MES; locked the target envelope for the run.
-
02
twin.rehearse
SUCCEEDED
41 s
Plant Orchestrator · Twindra simulated 36 candidate setpoint vectors on the as-made batch twin (granulation DEM, compression and ejection risk, coating CFD, dissolution surrogate) and ranked them on predicted content uniformity, capping risk and takt.
-
03
blend.uniformity
SUCCEEDED
6 m 10 s
Blend-and-Dispense · Spectryn scored in-line NIR spectra against the formulation's chemometric model; the blend reached its uniformity end point with confidence bounds inside the site acceptance limit and blending stopped on evidence rather than on a fixed time.
-
04
granulate.dry
SUCCEEDED
3 m 48 s
Granulate-and-Dry · Inlet air temperature and drying airflow trimmed inside the approved window to bring loss-on-drying to the target moisture band for compression; the move was bounded, logged and inside the design space.
-
05
compress.press
SUCCEEDED
2 m 02 s
Compress-and-Fill · Main compression force and feed-frame speed adjusted inside the approved window to hold tablet weight and hardness on target while the twin's capping-risk estimate stayed under the site threshold.
-
06
coat.spray
SUCCEEDED
4 m 25 s
Coat-and-Dry · Spray rate and inlet temperature re-phased against bed temperature and exhaust humidity to hold the film-coat window and avoid twinning and mottling; no excursion from the validated recipe envelope.
-
07
inspect.tablets
SUCCEEDED
continuous
Defect-and-Inspect · Visqa classified chips, cracks, capping, spots, mottling and print defects on six synchronised cameras, within the sub-100 ms design budget, and linked a rising chip rate to coating spray rather than to tooling.
-
08
spectra.release_evidence
SUCCEEDED
38 s
Quality-and-Potency · Spectryn assembled the method-linked evidence chain for content uniformity and moisture with confidence bounds and citations to the validated analytical method, ready for QA review.
-
09
approve.qa
APPROVAL
3 m 14 s
Plant Orchestrator · Batch release is above every autonomy level Pildeon offers. The package was held for the named QA reviewer, who approved it in the review console; the decision, the reviewer identity and the timestamp are in the Part 11 audit trail.
-
10
release.genealogy
SUCCEEDED
52 s
Quality-and-Conformance · Conforma wrote the time-aligned batch genealogy (every sensor state, recommendation, approved action, equipment response and QC result) and the cited release package to the immutable audit trail.
Tool calls · scenario
The agent shows its work
Every tool invocation, argument and result is written to an immutable, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the plant or from QA.
- 06:12:04mes.read_batch_record({ line: "L2", product: "IR tablet · family A" })
- 06:12:05ok design space loaded · autonomy policy L2 · QA reviewer assigned
- 06:12:06twin.simulate({ candidates: 36, horizon: "full batch" })
- 06:12:47ok candidate #14 selected · predicted CU inside limit · capping risk under threshold
- 06:12:48policy.evaluate({ candidate: 14, autonomy: "L2" })
- 06:12:48ok 5 setpoint moves inside design space · release held for QA
- 06:12:49nir.score({ probe: "blender-1", model: "cu-famA-v3" })
- 06:18:59ok blend end point reached · confidence bounds inside acceptance limit
- 06:19:00plc.write_setpoint({ tag: "FBD1.INLET_T", within: "design space" })
- 06:22:48ok loss-on-drying in target band · move logged to audit trail
- 06:22:49press.write_setpoint({ tag: "TP2.MAIN_FORCE", within: "design space" })
- 06:24:51ok weight and hardness on target · capping risk under threshold
- 06:24:52vision.stream({ cameras: 6, model: "visqa-defect-v2" })
- 06:27:10chip rate rising on camera 4 · attributed to spray rate, not tooling
- 06:27:11coater.write_setpoint({ tag: "CT1.SPRAY", within: "design space" })
- 06:29:14ok chip rate back to baseline · film window held
- 06:29:15nir.evidence_chain({ attributes: ["cu", "moisture"], method: "validated" })
- 06:29:53ok evidence chain assembled · citations attached
- 06:29:54approval.request({ action: "batch_release", reviewer: "QA" })
- 06:33:08ok approved by the named QA reviewer · identity and timestamp logged
- 06:33:09audit.write_release_package({ batch: "B-240918", genealogy: "full" })
- 06:34:01ok scenario complete · genealogy written · package cited
Reasoning trace
Plan, thought, action, observation, exactly as the orchestrator records it.
GoalRun one immediate-release tablet batch through granulation, co…
Run one immediate-release tablet batch through granulation, compression, coating and inspection inside the approved design space, with QA approval before release.
PlanRehearse on the twin first. Stop blending on NIR evidence rath…
Rehearse on the twin first. Stop blending on NIR evidence rather than on a fixed time. Trim drying, compression and coating only inside the approved design space. Inspect continuously. Hold release for the named QA reviewer, always.
ThoughtThe fixed recipe blends for a set time regardless of what the …
The fixed recipe blends for a set time regardless of what the spectra say. On the twin, the candidate that stops on evidence and trims inlet temperature before compression keeps content uniformity and moisture inside their limits with the lowest predicted capping risk.
Actiontwin.simulate(candidates=36) → candidate #14: evidence-based b…
twin.simulate(candidates=36) → candidate #14: evidence-based blend end point, bounded drying trim, compression force held inside the window, spray rate re-phased to bed temperature.
ObservationEvery candidate that pushed turret speed for takt raised predi…
Every candidate that pushed turret speed for takt raised predicted capping risk above the site threshold and was discarded. Rate is never traded for a quality attribute.
ActionExecute candidate #14 under autonomy level L2: five setpoint m…
Execute candidate #14 under autonomy level L2: five setpoint moves inside the design space, each logged. Batch release routed to QA.
ObservationChip rate rose on camera 4 at 06:27:10. Visqa attributed it to…
Chip rate rose on camera 4 at 06:27:10. Visqa attributed it to coating spray rather than tooling; a bounded spray-rate trim returned it to baseline in about two minutes.
OutcomeScenario complete. Every move inside the approved design space…
Scenario complete. Every move inside the approved design space, the QA approval recorded with identity and timestamp, and the cited release package written by Conforma to the immutable audit trail.
How it works
A batch record becomes a plan becomes a run
Nothing about a Pildeon run is implicit. The goal comes from the master batch record, the plan is rehearsed on the twin, each step is typed and bounded by the approved design space, and the outcome is written to the batch genealogy.
The orchestrator plans, the agents act, QA releases
A run starts as a goal, becomes a plan, and executes as a graph of typed steps. The active path is always visible, always logged, always reversible. Batch release is never on the autonomous path.
RUNNING APPROVAL SUCCEEDED
Autonomy is graduated, and validated parameters never move without sign-off
Shadow, assist, supervised, bounded. Each site sets the level per agent and per setpoint, inside the design space its own validation approved. Anything outside that space, and every batch release, waits for a named QA reviewer, and the decision lands in the 21 CFR Part 11 audit trail.
Agent roster
Nine agents and an orchestrator
Each agent owns one step of the tablet line, a bounded tool set and a measured quality attribute. They negotiate for shared setpoints through the orchestrator, never directly, and none of them can release a batch.
Blend-and-Dispense
Dispensing, blending, blend and content uniformity
Runs dispensing and blending to a uniformity end point read from in-line NIR, not from a fixed time, so super- and sub-potent zones are caught in the blender rather than in the lab.
dispense.verify_identitynir.scoreblender.write_setpoint
Design target: blend end point called on evidence
Granulate-and-Dry
Wet and dry granulation, particle size, moisture (LOD)
Holds particle size and loss-on-drying inside the approved window by trimming binder addition, inlet air temperature and airflow as the granule responds.
plc.write_setpointnir.moisturetwin.simulate
Design target: moisture held in band before compression
Compress-and-Fill
Tablet weight, hardness, thickness, ejection; capsule fill
Holds tablet weight, hardness, thickness and ejection force on target, and keeps capping, lamination and sticking risk under the site threshold. Runs capsule filling on the same loop.
press.write_setpointpress.read_force_curvetwin.capping_risk
Design target: capping risk under threshold, every tablet
Coat-and-Dry
Film and enteric coating, spray rate, drying
Re-phases spray rate, inlet temperature and drying against bed temperature and exhaust humidity to hold the film window without twinning, mottling or over- and under-coat.
coater.write_setpointcoater.read_bed_tempvision.appearance
Design target: film window held without excursion
Defect-and-Inspect
Chips, cracks, capping, spots, mottling, print defects
Classifies chips, cracks, capping, spots, mottling, twins and print defects on multi-camera streams and links each defect to its likely upstream cause.
vision.streamdefect.attribute_causealarm.raise
Design target: under 100 ms per camera frame group
Product: Visqa
Quality-and-Potency
Dissolution, potency, content uniformity, grade
Turns spectra and process telemetry into content-uniformity, moisture and potency calls with confidence bounds, and builds the evidence chain for real-time release.
nir.evidence_chaindissolution.surrogatespec.check
Design target: under 500 ms fused PAT and NIR risk score
Product: Spectryn
Yield-and-Takt
Yield, rejects, drying and coating energy, line balance
Prices every candidate move in rejects, drying and coating energy and takt, and sequences campaigns and changeovers under the plant's constraints.
cuopt.sequenceenergy.budgetmes.read_campaign
Design target: rate never traded against a quality attribute
Robot-and-Handling
Powder, IBC and tooling movement
Moves powders, IBCs and compression tooling between units just in time for the next takt, verifying material identity and genealogy at every move.
isaac.plan_pathibc.dockgenealogy.verify_move
Design target: zero cross-mix, every move genealogy-checked
Product: Kinetos
Quality-and-Conformance
Right-first-time, deviations, batch genealogy, GMP traceability
Writes the time-aligned batch genealogy, drafts deviation investigations with citations, and assembles the audit-ready release package for QA.
audit.writedeviation.draftrelease.assemble
Design target: cited release package on every batch
Product: Conforma
Plant Orchestrator
Planning, arbitration, QA approval routing
Plans the run, arbitrates between agents competing for the same setpoint, enforces the autonomy level and routes anything above it, including every release, to a human.
plan.composepolicy.evaluateapproval.request
Design rule: 100% of writes policy-checked
Where it pays
Four loops, four quality attributes
Pildeon is not a dashboard. Each agent closes a loop that a tablet plant already measures in rejects, deviations, release days and kilowatt-hours.
Content uniformity
Call the blend end point on evidence, not on the clock
In-line NIR spectra are scored against the formulation's chemometric model as the blender turns. Blending stops when the uniformity end point is reached with confidence, and the same spectra become part of the release evidence instead of waiting hours for the lab.
- Multi-point NIR and PAT fusion across blend, granulation, drying, compression
- Confidence bounds and citations to the validated method
- Evidence chain built for real-time release testing
agent.quality_potency SUCCEEDED
| Signal | Fixed recipe today | Under Pildeon |
|---|---|---|
| Blend end point | Fixed time | On NIR evidence |
| Content-uniformity call | After the batch, in the lab | In line, with confidence bounds |
| Release evidence | Assembled by hand | Method-linked chain, cited |
Compression faults
Keep capping and lamination under the threshold before the press hears them
Press force curves, fill depth and ejection force are read continuously and scored against the twin's capping-risk estimate. The agent trims main compression force and feed-frame speed inside the approved window, and never trades rate against a quality attribute.
- Force-curve and fill-depth anomaly detection on the press
- Weight, hardness and thickness held on target
- Turret speed capped by predicted capping risk
agent.compress_fill SUCCEEDED
| Signal | Fixed recipe today | Under Pildeon |
|---|---|---|
| Capping and lamination | Found at inspection or in QC | Risk scored on the press |
| Compression force | Set per recipe | Trimmed inside the design space |
| Rate vs quality | Operator judgement | Quality attribute always wins |
Rejects and defects
Inspect every tablet and point at the cause
Multi-camera vision classifies chips, cracks, capping, spots, mottling, twins and print defects at line speed, trained on a cross-plant corpus augmented with synthetic rare faults. Each defect is linked back to compression force, coating spray or tooling wear and handed to the control agents.
- Low false-reject classification from a real plus synthetic corpus
- Defect-to-cause attribution feeding the control loop
- Every reviewed image trains the fleet
agent.defect_inspect SUCCEEDED
| Signal | Fixed recipe today | Under Pildeon |
|---|---|---|
| Inspection | Rule-based thresholds per product | Learned classifier, per-product model card |
| Rare defects | Too sparse to learn | Synthetic rare-fault augmentation |
| Defect signal | End-of-line reject bin | Closed-loop quality signal |
Release time
Release on a cited package, not a paper hunt
Every action, sensor state, recommendation and QC result lands in a time-aligned batch genealogy. Deviation investigations are drafted with citations to cGMP, GAMP 5, Part 11, ICH and the site's own SOPs, and the release package is assembled for QA to review and sign.
- Time-aligned genealogy across agents, MES, LIMS and historians
- Deviation drafting and CAPA proposals with mandatory citations
- Immutable Part 11 audit trail, QA reviewer always in the loop
agent.quality_conf SUCCEEDED
| Signal | Fixed recipe today | Under Pildeon |
|---|---|---|
| Investigation | Multi-day hunt through PDFs | Drafted from the genealogy, cited |
| Release package | Assembled by QA by hand | Assembled for QA to review |
| Audit trail | Scattered across systems | One immutable Part 11 spine |
Multi-agent handoff
Agents negotiate, they do not collide
Two agents will want the same setpoint. The orchestrator arbitrates on the run goal and the quality attributes, not on who asked first, and the handoff is logged like any other step.
Contested move: turret speed on tablet press 2
-
01yield_takt.request(turret +4%) SUCCEEDED0.2 s
Yield-and-Takt wants more turret speed to recover takt lost to an upstream changeover.
-
02quality_potency.request(hold) SUCCEEDED0.2 s
Quality-and-Potency wants turret speed held: the twin's content-uniformity and capping-risk estimates rise with dwell time lost.
-
03orchestrator.arbitrate SUCCEEDED0.4 s
A quality attribute outranks takt under every Pildeon run goal. Quality-and-Potency wins the setpoint; the takt request is declined and the reason recorded.
-
04yield_takt.replan(campaign) SUCCEEDED6 s
Yield-and-Takt recovers the schedule by re-sequencing the next changeover with cuOpt instead of pushing the press.
Arbitration rules
- Quality attributes first. Content uniformity, potency, dissolution and defect rate outrank yield, energy and takt in every arbitration.
- The design space is a wall, not a target. No agent can request a move outside the limits the site's validation approved.
- Time-boxed ownership. An agent holds a contested setpoint for a bounded window, then must re-justify.
- Everything is logged. The losing request, the score and the reason all appear in the batch genealogy.
- Deadlocks escalate to a human rather than resolving by timeout.
Autonomy
Four levels, set per agent and per setpoint
A tablet plant does not go from fixed recipes to autonomy in one step, and validated parameters never change without sign-off. Pildeon makes the level explicit, auditable and reversible at any time.
| Level | What the agent does | What the human does | Typical time to reach |
|---|---|---|---|
| L0 · Shadow | Observes, scores and predicts; writes nothing | Runs the line as today; compares predictions to QC results | Weeks 1 to 6 of a design partnership |
| L1 · Assist | Recommends setpoint moves and explains why | Process engineer enters the move; QA reviews the log | After shadow-mode accuracy is shown |
| L2 · Supervised | Proposes a bounded move; it executes on approval | Approves each move in the review console | After assist-mode ROI is shown |
| L3 · Bounded | Moves low-risk compression, coating and inspection setpoints inside the approved design space | Handles exceptions; approves every release | After validation and change-control review |
There is no unattended level. Batch release and any move outside the approved design space always wait for a named QA reviewer, and every model or prompt change runs under GxP change control.
Design targets
Design targets, stated as targets
Pildeon is pre-launch. These are the latency and scale targets the platform is engineered against. None is a shipped result, and each will be measured against a design partner's own QC data.
<100 ms
Defect inference per camera frame group, on the plant edge
<500 ms
Fused PAT, NIR and process risk score
<2 s
Validated recommendation generation
100k+
Synthetic rare-fault scenarios per formulation family
Training corpus targets across design partners: 10M+ tablet and coating images, 50k+ NIR and PAT spectra, 100k+ process time-series windows, 5k+ labelled deviation investigations. Targets, not holdings.
Use cases
Where plants start
Most sites pick one of these wedges, instrument it in shadow mode, baseline rejects, deviations, yield, energy and release time, and only then convert to a paid validated pilot.
Compression QUEUED
Tablet-compression control plus defect inspection
The highest-reject step on most lines. Compress-and-Fill holds weight and hardness while Visqa inspects every tablet, and both write to the same batch genealogy.
Blend release QUEUED
Content uniformity and PAT-based blend release
Spectryn scores NIR spectra in line, calls the blend end point on evidence, and builds the method-linked chain a site needs for real-time release testing.
Coating QUEUED
Coating-process optimisation
Coat-and-Dry re-phases spray rate and inlet temperature against bed temperature to hold the film window, with Visqa watching appearance and mottling.
Tech transfer QUEUED
Rehearse a new product or tooling family on the twin
Twindra fits a formulation- and tooling-specific twin and rehearses the design space before the first validation batch is pressed.
Accelerated computing
Physical AI, at the press
Tablets leave a rotary press by the hundreds of thousands an hour. Perception has to be local, deterministic and fast, so Pildeon runs GPU inference on the plant edge and keeps training, simulation and optimisation on DGX, HGX or OVX, on-prem where the data cannot leave the plant.
Edge perception
Multi-camera chip, crack, spot and print inspection and NIR and PAT fusion on the plant edge. Design targets: under 100 ms per camera frame group, under 500 ms for a fused risk score.
Validated model serving
Vision, spectral, time-series and process-reasoning models behind one orchestrator, versioned, tenant-isolated, with bounded actions and audit schemas enforced at the serving layer.
Training and fine-tuning
Defect vision, coating appearance, NIR and PAT chemometrics, press and coater time-series models and process-window models, trained under GxP change control.
As-made batch twin
GPU-accelerated DEM granulation, CFD coating spray and drying, compression and ejection risk and a dissolution surrogate. Design target: nightly design-space sweeps per formulation family.
Synthetic rare faults
Capping, lamination, sticking, mottling, segregation and print-defect scenarios generated for class balance, always labelled synthetic and evaluated apart from real GMP evidence.
Optimisation and handling
Campaign and changeover sequencing, drying and coating energy allocation and line balancing with cuOpt; sim-first IBC and tooling handling policies trained and rehearsed with Isaac.
Developers
Define an agent, bound it, run it
The Pildeon SDK is typed Python. Tools are declared with schemas, units and design-space limits; the policy engine enforces them at call time, and every change to a tool or a limit is a change-control event.
What you get
- Typed tool definitions with unit-aware ranges bound to the approved design space
- Deterministic replay of any historical batch against a new model version
- Local twin harness so a setpoint vector is rehearsed before it is shipped
- Autonomy policy as code, versioned, reviewed and change-controlled like any other GxP change
# Bound the compression agent to tablet press 2's approved design space.
from pildeon import Agent, Tool, DesignSpace, Autonomy
force = Tool(
name="press.write_setpoint",
tags=["TP2.MAIN_FORCE", "TP2.FEED_FRAME_SPEED"],
limits=DesignSpace.approved("family-A", "tooling-D"),
)
compress = Agent(
id="agent.compress_fill",
goal="weight, hardness on target; capping risk under threshold",
tools=[force, Tool("press.read_force_curve", read_only=True)],
# supervised: each move executes on approval
autonomy=Autonomy.L2,
# rehearse on the twin before every proposal
verify="twin",
# every call lands in the Part 11 audit trail
audit="part11",
)
run = compress.start(line="L2", batch="B-240918")
for step in run.stream():
print(step.name, step.status, step.duration)
CLI
Start a run from anywhere
The same run engine, the same policy checks, the same audit trail, from the terminal, the review console or the SDK.
$ pildeon run "batch B-240918 on L2" --autonomy L2
→ plan composed 10 steps · 1 QA approval gate
→ twin.simulate 36 candidates · best #14 · capping risk under threshold
→ policy.evaluate 5 moves inside design space · release held for QA
→ executing blend.uniformity .... ok 6m10s
→ executing granulate.dry ...... ok 3m48s
→ executing compress.press ..... ok 2m02s
→ executing coat.spray ......... ok 4m25s
! approval required batch_release · QA reviewer
→ approved named QA reviewer · identity + timestamp logged
→ run complete genealogy written · release package cited
$ pildeon runs show run_b2c7e1 --format genealogy
Pricing
Priced per line, per plant, per group
Land on one validated workflow with a measurable baseline. Expand by line, module, site and autonomy level. Outcome components are available on yield, rejects, deviations and energy.
Compression or coating control or inspection AI for one line. For OSD makers validating ROI on the wedge.
- One line, one agent module
- Validated plant-edge inference node
- Equipment, PAT and MES read; bounded write inside the design space
- Run log, Part 11 audit trail, batch genealogy
- Business-hours support
The whole loop: blend and dispense, granulate and dry, compress and fill, coat and dry, defect, quality and potency, yield and takt, robotic handling and the batch twin.
- All nine agents and the orchestrator
- Visqa inspection on every compression and coating line
- Spectryn content uniformity and release evidence
- Kinetos robotic IBC and tooling handling
- Twindra as-made batch twin and campaign sequencing
- Conforma genealogy, deviation drafting and release packages
Pharma and CDMO groups standardising on Pildeon across sites, with custom formulation, tooling and tolerance models.
- Multi-site validated plant-edge fleet
- Custom formulation, tooling and tolerance models
- Validated on-prem deployment, air-gapped option
- Group autonomy policy and approval chains
- SLAs, SSO and RBAC, dedicated engineer
Annual prepay discounts run 15 to 20% depending on term; the toggle shows 15%. Usage metering applies above plan limits. Multi-year enterprise agreements carry usage ramps.
The first meeting
What each stakeholder asks first
Pildeon has no customer quotes to show yet, and will not invent any. These are the questions the three buyers in an OSD plant ask in the first meeting, and the answer each gets.
"What does this do to my reject rate, my deviation count and my release time, and how will you prove it on my line rather than on a slide?"
Site or manufacturing director · economic buyerAnswer: shadow mode first, baseline captured before any autonomous action, a written ROI target before a paid pilot.
"Will it ever move a setpoint outside the design space we validated, and can I see why it recommended every move it made?"
Formulation or process engineer (MSAT) · championAnswer: no, by construction. Every recommendation carries its reasoning trace and its citation.
"Where is the Part 11 audit trail, who signs the release, and what happens to my validated state when the model changes?"
QA, quality and compliance lead · approverAnswer: an immutable audit spine, a named QA reviewer on every release, and every model change under GxP change control.
Integrations
It speaks tablet plant, not cloud
Pildeon reads and writes through the systems already on the floor: presses, coaters, granulators, PAT probes, MES, LIMS and historians. No rip-and-replace, no parallel historian. Connectors are built with design partners against their stacks; the vendors listed are the ones common in OSD plants.
GEA, Glatt, Syntegon, Freund-Vector, L.B. Bohle
Blender, granulator and fluid-bed telemetry; bounded setpoint writes
Fette Compacting, Korsch, IMA, Syntegon, MG2
Force curves, fill depth, ejection force; bounded setpoint writes
GEA, Glatt, O'Hara, Thomas, Freund
Spray, inlet, bed temperature, exhaust humidity; bounded writes
Bruker, Sartorius, Viavi probes and analysers
Spectra across blend, granulation, drying and compression
Line cameras and existing inspection systems
Frames, defect maps, reviewed images
Körber Werum PAS-X, Rockwell, Siemens Opcenter
Master batch records, campaigns, batch genealogy
Site LIMS, OSIsoft PI and equivalent historians
QC results, time-series backfill and replay
Azure AD, Okta, LDAP · NVIDIA Jetson and on-prem GPU
SSO, RBAC, named approvers · inference at the line
Guardrails
An agent that can move a compression force needs a leash
Pildeon writes to production equipment in a GMP plant. Every capability is scoped to the approved design space, every write is policy-checked, every action is written to an immutable Part 11 audit trail the site owns, and no agent can release a batch.
- Bounded action space. Each agent can only write to an explicit setpoint allow-list, inside the limits the site's validation approved.
- Policy engine before every write. Autonomy level, design-space limits, batch state, model version and reviewer assignment are all evaluated before a setpoint moves.
- Human-in-the-loop gates. Batch release, any move outside the design space and any change to a validated parameter wait for a named QA reviewer.
- Immutable audit trail. Append-only, hash-chained, exportable, retained on the site's own storage, with reviewer identity and timestamp on every decision.
- Hard fallback. Loss of the edge node, the network or the model returns the line to the equipment's last known-good recipe.
- Tenant and IP isolation. Formulations, recipes and models never cross a customer boundary. Validated on-prem deployment is available for regulated producers.
Compliance posture
| Standard | Scope | Status |
|---|---|---|
| 21 CFR Part 11 | Audit trail, e-signatures, records | RUNNING Designed in from day one |
| GAMP 5 | Validation package for the platform | RUNNING In progress, planned for the first design partners |
| cGMP · ICH Q8 to Q13 | Design space, QbD, continuous manufacturing | RUNNING Design-aligned; site validation decides |
| SOC 2 Type I | Cloud control plane | QUEUED Planned, first six months |
| SOC 2 Type II | Cloud control plane | QUEUED Planned, months six to twelve |
| Data residency | Validated on-prem, air-gapped option | SUCCEEDED Available by design |
Enterprise
Standardise validated autonomy across the group
One policy model, one audit spine, one benchmark across every line in every plant, with formulation and tooling models kept private to each site.
- SSO, RBAC and named approvers down to the setpoint level
- Group autonomy policy with per-site override and approval chains
- Cross-plant benchmarking on yield, rejects, deviations and energy
- Validated on-prem and air-gapped plant-edge deployment options
- Validation packages and change-control records as first-class deliverables
- Dedicated deployment engineer and quarterly model review per site
FAQ
Straight answers
The questions site directors, MSAT engineers and QA leads actually ask in the first meeting.
Yes, but only inside an explicit setpoint allow-list bounded by the design space your validation approved, and only at the autonomy level your site has set. Level 0 is shadow mode: Pildeon observes and predicts and writes nothing. Most sites spend their first weeks there.
No. The approved design space is a wall the policy engine enforces at call time. A move outside it, or a change to a validated parameter, is a change-control event that waits for QA sign-off. No autonomy level removes that gate.
A named QA reviewer, every time. Pildeon assembles the evidence chain and the cited release package; the reviewer approves or rejects it in the review console, and the decision, identity and timestamp land in the Part 11 audit trail.
The line returns to the equipment's own last known-good recipe. Pildeon is a supervisory layer on top of your existing control systems, never a replacement, so an outage degrades the line to the way it runs today, not to a stop.
Only if you choose cloud training. Formulations, recipes, spectra and defect libraries are tenant-isolated and never used to train another customer's models. Validated on-prem deployment with an air-gapped plant edge is available.
Shadow mode on one wedge workflow first, with baseline rejects, deviations, yield, energy and release time captured before any autonomous action. Assist mode once prediction accuracy is shown against QC results. A paid validated pilot only when there is a written ROI target. Timelines depend on the site's validation and change-control calendar.
Get started
Bring autonomy to one line first
Start with one compression, coating or granulation line and one measurable baseline. Shadow mode shows the prediction accuracy against your own QC results before anything moves.