Each agent owns one step of the line, a bounded tool set and a measured quality attribute. They negotiate for shared setpoints through the plant orchestrator, and none of them can move outside the approved design space or release a batch.
Scenario: Run one immediate-release tablet batch through granulation, compression, coating and inspection inside the approved design space, with QA approval before release. A design walkthrough, not a customer record.
Products map onto agents: Spectryn is the spectral sense of Blend-and-Dispense and Quality-and-Potency, Visqa is Defect-and-Inspect, Conforma is Quality-and-Conformance, Kinetos is Robot-and-Handling, and Twindra is the twin every agent rehearses on.
Dispensing, blending, blend and content uniformity
Runs dispensing and blending to a uniformity end point read from in-line NIR, not from a fixed time, so super- and sub-potent zones are caught in the blender rather than in the lab.
Design target: blend end point called on evidence
Wet and dry granulation, particle size, moisture (LOD)
Holds particle size and loss-on-drying inside the approved window by trimming binder addition, inlet air temperature and airflow as the granule responds.
Design target: moisture held in band before compression
Tablet weight, hardness, thickness, ejection; capsule fill
Holds tablet weight, hardness, thickness and ejection force on target, and keeps capping, lamination and sticking risk under the site threshold. Runs capsule filling on the same loop.
Design target: capping risk under threshold, every tablet
Film and enteric coating, spray rate, drying
Re-phases spray rate, inlet temperature and drying against bed temperature and exhaust humidity to hold the film window without twinning, mottling or over- and under-coat.
Design target: film window held without excursion
Chips, cracks, capping, spots, mottling, print defects
Classifies chips, cracks, capping, spots, mottling, twins and print defects on multi-camera streams and links each defect to its likely upstream cause.
Design target: under 100 ms per camera frame group
Product: Visqa
Dissolution, potency, content uniformity, grade
Turns spectra and process telemetry into content-uniformity, moisture and potency calls with confidence bounds, and builds the evidence chain for real-time release.
Design target: under 500 ms fused PAT and NIR risk score
Product: Spectryn
Yield, rejects, drying and coating energy, line balance
Prices every candidate move in rejects, drying and coating energy and takt, and sequences campaigns and changeovers under the plant's constraints.
Design target: rate never traded against a quality attribute
Powder, IBC and tooling movement
Moves powders, IBCs and compression tooling between units just in time for the next takt, verifying material identity and genealogy at every move.
Design target: zero cross-mix, every move genealogy-checked
Product: Kinetos
Right-first-time, deviations, batch genealogy, GMP traceability
Writes the time-aligned batch genealogy, drafts deviation investigations with citations, and assembles the audit-ready release package for QA.
Design target: cited release package on every batch
Product: Conforma
Planning, arbitration, QA approval routing
Plans the run, arbitrates between agents competing for the same setpoint, enforces the autonomy level and routes anything above it, including every release, to a human.
Design rule: 100% of writes policy-checked
Seven agents and the orchestrator appear in this one scenario batch. The timeline shows who acted, what tool they called and how long the step took.
Plant Orchestrator · Pulled the master batch record, the approved design-space limits for this formulation and tooling family, and the site autonomy policy from MES; locked the target envelope for the run.
Plant Orchestrator · Twindra simulated 36 candidate setpoint vectors on the as-made batch twin (granulation DEM, compression and ejection risk, coating CFD, dissolution surrogate) and ranked them on predicted content uniformity, capping risk and takt.
Blend-and-Dispense · Spectryn scored in-line NIR spectra against the formulation's chemometric model; the blend reached its uniformity end point with confidence bounds inside the site acceptance limit and blending stopped on evidence rather than on a fixed time.
Granulate-and-Dry · Inlet air temperature and drying airflow trimmed inside the approved window to bring loss-on-drying to the target moisture band for compression; the move was bounded, logged and inside the design space.
Compress-and-Fill · Main compression force and feed-frame speed adjusted inside the approved window to hold tablet weight and hardness on target while the twin's capping-risk estimate stayed under the site threshold.
Coat-and-Dry · Spray rate and inlet temperature re-phased against bed temperature and exhaust humidity to hold the film-coat window and avoid twinning and mottling; no excursion from the validated recipe envelope.
Defect-and-Inspect · Visqa classified chips, cracks, capping, spots, mottling and print defects on six synchronised cameras, within the sub-100 ms design budget, and linked a rising chip rate to coating spray rather than to tooling.
Quality-and-Potency · Spectryn assembled the method-linked evidence chain for content uniformity and moisture with confidence bounds and citations to the validated analytical method, ready for QA review.
Plant Orchestrator · Batch release is above every autonomy level Pildeon offers. The package was held for the named QA reviewer, who approved it in the review console; the decision, the reviewer identity and the timestamp are in the Part 11 audit trail.
Quality-and-Conformance · Conforma wrote the time-aligned batch genealogy (every sensor state, recommendation, approved action, equipment response and QC result) and the cited release package to the immutable audit trail.
Two agents will want the same setpoint. The orchestrator arbitrates on the run goal and the quality attributes, not on who asked first, and the handoff is logged like any other step.
Yield-and-Takt wants more turret speed to recover takt lost to an upstream changeover.
Quality-and-Potency wants turret speed held: the twin's content-uniformity and capping-risk estimates rise with dwell time lost.
A quality attribute outranks takt under every Pildeon run goal. Quality-and-Potency wins the setpoint; the takt request is declined and the reason recorded.
Yield-and-Takt recovers the schedule by re-sequencing the next changeover with cuOpt instead of pushing the press.
Tool calls are typed, bounded and logged. The stream below is the scenario run's call log; the reasoning trace beside it is what the orchestrator records between calls.
Plan, thought, action, observation, exactly as the orchestrator records it.
Run one immediate-release tablet batch through granulation, compression, coating and inspection inside the approved design space, with QA approval before release.
Rehearse on the twin first. Stop blending on NIR evidence rather than on a fixed time. Trim drying, compression and coating only inside the approved design space. Inspect continuously. Hold release for the named QA reviewer, always.
The fixed recipe blends for a set time regardless of what the spectra say. On the twin, the candidate that stops on evidence and trims inlet temperature before compression keeps content uniformity and moisture inside their limits with the lowest predicted capping risk.
twin.simulate(candidates=36) → candidate #14: evidence-based blend end point, bounded drying trim, compression force held inside the window, spray rate re-phased to bed temperature.
Every candidate that pushed turret speed for takt raised predicted capping risk above the site threshold and was discarded. Rate is never traded for a quality attribute.
Execute candidate #14 under autonomy level L2: five setpoint moves inside the design space, each logged. Batch release routed to QA.
Chip rate rose on camera 4 at 06:27:10. Visqa attributed it to coating spray rather than tooling; a bounded spray-rate trim returned it to baseline in about two minutes.
Scenario complete. Every move inside the approved design space, the QA approval recorded with identity and timestamp, and the cited release package written by Conforma to the immutable audit trail.
A tool declares what it can touch, the limits it must respect and the autonomy level at which it may be called. The registry is versioned and change-controlled.
| Tool | Owner | Touches | Bound by | Min. level |
|---|---|---|---|---|
| press.write_setpoint | Compress-and-Fill | Main force, feed-frame speed, turret speed | Approved design space per family and tooling | L2+ |
| coater.write_setpoint | Coat-and-Dry | Spray rate, inlet temperature, airflow | Approved design space | L2+ |
| plc.write_setpoint | Granulate-and-Dry | Binder addition, inlet temperature, airflow | Approved design space | L2+ |
| blender.write_setpoint | Blend-and-Dispense | Blend time end point, speed | Evidence-based end point only | L2+ |
| nir.score / nir.evidence_chain | Quality-and-Potency | Read-only spectra | Validated method per attribute | L0+ |
| vision.stream | Defect-and-Inspect | Read-only frames | Per-product model card | L0+ |
| isaac.plan_path / ibc.dock | Robot-and-Handling | Material movement | Genealogy check before every move | L2+ |
| deviation.draft / release.assemble | Quality-and-Conformance | Drafts, never decides | Mandatory citations | L0+ |
| approval.request | Orchestrator | Routes to a named reviewer | Every release, every out-of-space move | always |
Bounded industrial agents, not open-ended chat. Each has an allowed action set, a process window, a reviewer path and an immutable audit record.
Every agent is accountable for a measured attribute: uniformity, moisture, weight and hardness, film, defect rate, potency, yield, movement, genealogy.
An agent's capability is the tool set it is given, not the instructions it is told. Tools carry units, limits and the design space.
Any proposed setpoint vector is simulated on the twin before it is proposed, and the prediction is logged alongside the outcome.
Recommendations and investigation drafts must cite a validated source: a method, a standard, an SOP, a record. Citation checks run on every output.
In every arbitration a quality attribute wins over yield, energy or takt. The orchestrator enforces it; agents cannot override it.
No agent can release a batch, change a validated parameter or move outside the design space. Those paths always end at a named QA reviewer.
A tablet plant does not go from fixed recipes to autonomy in one step, and validated parameters never change without sign-off. Pildeon makes the level explicit, auditable and reversible at any time.
| Level | What the agent does | What the human does | Typical time to reach |
|---|---|---|---|
| L0 · Shadow | Observes, scores and predicts; writes nothing | Runs the line as today; compares predictions to QC results | Weeks 1 to 6 of a design partnership |
| L1 · Assist | Recommends setpoint moves and explains why | Process engineer enters the move; QA reviews the log | After shadow-mode accuracy is shown |
| L2 · Supervised | Proposes a bounded move; it executes on approval | Approves each move in the review console | After assist-mode ROI is shown |
| L3 · Bounded | Moves low-risk compression, coating and inspection setpoints inside the approved design space | Handles exceptions; approves every release | After validation and change-control review |
There is no unattended level. Batch release and any move outside the approved design space always wait for a named QA reviewer, and every model or prompt change runs under GxP change control.
Where each wedge workflow starts and which agents it brings.
The highest-reject step on most lines. Compress-and-Fill holds weight and hardness while Visqa inspects every tablet, and both write to the same batch genealogy.
Spectryn scores NIR spectra in line, calls the blend end point on evidence, and builds the method-linked chain a site needs for real-time release testing.
Coat-and-Dry re-phases spray rate and inlet temperature against bed temperature to hold the film window, with Visqa watching appearance and mottling.
Twindra fits a formulation- and tooling-specific twin and rehearses the design space before the first validation batch is pressed.
The Pildeon SDK is typed Python. Tools are declared with schemas, units and design-space limits; the policy engine enforces them at call time, and every change to a tool or a limit is a change-control event.
# Bound the compression agent to tablet press 2's approved design space.
from pildeon import Agent, Tool, DesignSpace, Autonomy
force = Tool(
name="press.write_setpoint",
tags=["TP2.MAIN_FORCE", "TP2.FEED_FRAME_SPEED"],
limits=DesignSpace.approved("family-A", "tooling-D"),
)
compress = Agent(
id="agent.compress_fill",
goal="weight, hardness on target; capping risk under threshold",
tools=[force, Tool("press.read_force_curve", read_only=True)],
# supervised: each move executes on approval
autonomy=Autonomy.L2,
# rehearse on the twin before every proposal
verify="twin",
# every call lands in the Part 11 audit trail
audit="part11",
)
run = compress.start(line="L2", batch="B-240918")
for step in run.stream():
print(step.name, step.status, step.duration)Latency and scale targets the agents are engineered against. Stated as targets until a design partner's QC data measures them.
Training corpus targets across design partners: 10M+ tablet and coating images, 50k+ NIR and PAT spectra, 100k+ process time-series windows, 5k+ labelled deviation investigations. Targets, not holdings.
Pildeon has no customer quotes to show yet, and will not invent any. These are the questions the three buyers in an OSD plant ask in the first meeting, and the answer each gets.
"What does this do to my reject rate, my deviation count and my release time, and how will you prove it on my line rather than on a slide?"
Site or manufacturing director · economic buyerAnswer: shadow mode first, baseline captured before any autonomous action, a written ROI target before a paid pilot.
"Will it ever move a setpoint outside the design space we validated, and can I see why it recommended every move it made?"
Formulation or process engineer (MSAT) · championAnswer: no, by construction. Every recommendation carries its reasoning trace and its citation.
"Where is the Part 11 audit trail, who signs the release, and what happens to my validated state when the model changes?"
QA, quality and compliance lead · approverAnswer: an immutable audit spine, a named QA reviewer on every release, and every model change under GxP change control.
Pildeon reads and writes through the systems already on the floor: presses, coaters, granulators, PAT probes, MES, LIMS and historians. No rip-and-replace, no parallel historian. Connectors are built with design partners against their stacks; the vendors listed are the ones common in OSD plants.
GEA, Glatt, Syntegon, Freund-Vector, L.B. Bohle
Blender, granulator and fluid-bed telemetry; bounded setpoint writes
Fette Compacting, Korsch, IMA, Syntegon, MG2
Force curves, fill depth, ejection force; bounded setpoint writes
GEA, Glatt, O'Hara, Thomas, Freund
Spray, inlet, bed temperature, exhaust humidity; bounded writes
Bruker, Sartorius, Viavi probes and analysers
Spectra across blend, granulation, drying and compression
Line cameras and existing inspection systems
Frames, defect maps, reviewed images
Körber Werum PAS-X, Rockwell, Siemens Opcenter
Master batch records, campaigns, batch genealogy
Site LIMS, OSIsoft PI and equivalent historians
QC results, time-series backfill and replay
Azure AD, Okta, LDAP · NVIDIA Jetson and on-prem GPU
SSO, RBAC, named approvers · inference at the line
Pildeon writes to production equipment in a GMP plant. Every capability is scoped to the approved design space, every write is policy-checked, every action is written to an immutable Part 11 audit trail the site owns, and no agent can release a batch.
| Standard | Scope | Status |
|---|---|---|
| 21 CFR Part 11 | Audit trail, e-signatures, records | RUNNING Designed in from day one |
| GAMP 5 | Validation package for the platform | RUNNING In progress, planned for the first design partners |
| cGMP · ICH Q8 to Q13 | Design space, QbD, continuous manufacturing | RUNNING Design-aligned; site validation decides |
| SOC 2 Type I | Cloud control plane | QUEUED Planned, first six months |
| SOC 2 Type II | Cloud control plane | QUEUED Planned, months six to twelve |
| Data residency | Validated on-prem, air-gapped option | SUCCEEDED Available by design |
One policy model, one audit spine, one benchmark across every line in every plant, with formulation and tooling models kept private to each site.
The questions site directors, MSAT engineers and QA leads actually ask in the first meeting.
Yes, but only inside an explicit setpoint allow-list bounded by the design space your validation approved, and only at the autonomy level your site has set. Level 0 is shadow mode: Pildeon observes and predicts and writes nothing. Most sites spend their first weeks there.
No. The approved design space is a wall the policy engine enforces at call time. A move outside it, or a change to a validated parameter, is a change-control event that waits for QA sign-off. No autonomy level removes that gate.
A named QA reviewer, every time. Pildeon assembles the evidence chain and the cited release package; the reviewer approves or rejects it in the review console, and the decision, identity and timestamp land in the Part 11 audit trail.
The line returns to the equipment's own last known-good recipe. Pildeon is a supervisory layer on top of your existing control systems, never a replacement, so an outage degrades the line to the way it runs today, not to a stop.
Only if you choose cloud training. Formulations, recipes, spectra and defect libraries are tenant-isolated and never used to train another customer's models. Validated on-prem deployment with an air-gapped plant edge is available.
Shadow mode on one wedge workflow first, with baseline rejects, deviations, yield, energy and release time captured before any autonomous action. Assist mode once prediction accuracy is shown against QC results. A paid validated pilot only when there is a written ROI target. Timelines depend on the site's validation and change-control calendar.
Shadow mode first. The agent predicts; your QC results judge it; nothing moves until you say so.
↑↓ navigate↵ openesc close