How a piece of software is allowed to touch a line.
Railira writes to production systems, so the security story is mostly a control story: a bounded action space, a policy engine before every write, named approvers, an append-only audit log the plant owns, hard fallback to the controller and its interlocks, and isolation between tenants and their programs.
- Source evidence it acted on
- Control plans, work instructions and standards it retrieved, with citations
- The approved control-plan envelope and the limit applied
- Confidence and estimated quality and takt impact
- Rollback path
- Responsible approver
- Car and work-package scope
Nothing is written without this record.
An agent that can change a weld sequence needs a leash
Railira writes to production systems. Every capability is scoped, every write is policy-checked against the approved control plan, and every action is written to an append-only audit log the plant owns.
- Bounded action space. Each agent acts only through an explicit tool allow-list, inside per-tool rate and magnitude limits and the approved control-plan envelope for the car type.
- Policy engine before every write. Autonomy level, shift, car type, interlock state and operator presence are evaluated before a recommendation becomes a write to a robot, MES, torque tool or work package.
- Human-in-the-loop gates. Heat-input and weld-sequence changes, schedule release and car release wait for a named approver. High-risk changes remain human-approved until IRIS, plant and OEM acceptance is earned.
- Immutable audit log. Append-only and exportable. Every action records source evidence, the control-plan envelope, confidence, estimated quality and takt impact, rollback path, approver and car scope.
- Hard fallback. Loss of the edge node, the network or a model returns control to the robot, PLC or station's last known-good state. Safety systems and interlocks are never in Railira's path.
- Tenant and program isolation. Designs, control plans, program data, models and memory never cross a customer boundary. On-prem and plant-edge deployment is available for regulated plants.
Compliance posture
| Item | Scope | Status |
|---|---|---|
| SOC 2 Type I and OEM cyber review | Cloud control plane | QUEUED Planned, first 6 months |
| SOC 2 Type II | Cloud control plane | QUEUED Planned, 6 to 12 months |
| SSO and RBAC | Console and approvals | QUEUED Planned, 6 to 12 months |
| IRIS and regulatory assurance packages | Disposition and genealogy evidence | QUEUED Planned, 6 to 12 months; not a certification claim |
| Standards-cited reasoning | Control plans, EN 15085, IRIS / ISO/TS 22163, TSI, AAR, APTA, torque and brake-test procedures | RUNNING In the design, every answer cites its source |
| Per-tenant and program isolation | Designs, control plans, models, memory | RUNNING In the design from day one |
| On-prem and plant-edge deployment | Regulated plants | RUNNING Design option |
What data exists and who can see it
The data strategy from the architecture: car- and work-package-based, labelled from the floor, synthetic only for rare events, governed per tenant.
Sources
- Weld and seam video, robot parameters, control plans and PPAP, material properties and panel geometry
- Metrology scans and carbody measurements, torque telemetry, wiring continuity, brake-test and signaling results
- Coating environmental readings, film-thickness measurements, recipe history
- Line-balance and sequencing data, car genealogy, non-conformance reports, warranty and recall signals, operator approvals
Governance
- Tenant isolation for designs, control plans, program data, models and memory
- OEM cyber-aware controls, model lineage and action replay
- Exportable IRIS and regulatory evidence
- Traceable consent before any cross-plant learning, which is planned and not yet in place
- Synthetic data used only to augment rare events, validated against real distributions
The write path
What has to be true before a recommendation becomes a write.
- A declared tool. The agent can only call tools declared with targets, units, limits and a control-plan envelope.
- A policy decision. Autonomy level, shift, car type, interlock state and operator presence are evaluated.
- A simulated check. Where the agent is configured with verify=twin, the move is simulated before it is written.
- An approval, if required. Heat-input and weld-sequence changes, schedule release and car release wait for the named approver.
- A bounded write. The connector enforces per-tool rate and magnitude limits again at the OT boundary. Safety systems and interlocks are never in Railira's path.
- A record. The action, its evidence and its outcome are appended to the audit log and the car genealogy.
- A rollback path. Declared rollback conditions return the target to its previous value or the controller to last known-good.
Four levels, set per agent and per tool
A rolling-stock plant does not go from manual to unattended in one step. Railira makes the level explicit, auditable and reversible at any time. The first release runs shadow mode, then assist mode, then bounded autonomy on low-risk actions. Weld parameters, schedule release and car release stay with named humans until acceptance is earned.
| Level | What the agent does | What the human does | Where it sits in a pilot |
|---|---|---|---|
| L1 · Shadow | Reads weld, metrology, torque, coating, wiring, test, robot and MES signals; predicts and recommends; writes nothing | Runs the line as today; compares predictions to inspection and engineer outcomes | Shadow mode; baseline measured from the plant's own records |
| L2 · Assist | Proposes weld-sequence, geometry, coating, torque and sequencing moves with evidence, confidence, envelope and rollback path | Approves each move in the review console | Assist mode; accuracy and ROI proven against the baseline |
| L3 · Bounded | Executes pre-approved low-risk actions: inspection routing, rework priority, kit feeding, robot path variants and parameter adjustments inside approved bounds | Approves heat-input and weld-sequence changes, schedule release and car release | Graduated autonomy, after audited accuracy and ROI and safety gates |
| L4 · Scaled | Supervised weld-parameter adaptation inside pre-approved control-plan envelopes, across lines and plants | Sets the envelope; reviews the shift record and the evaluation results | Planned; after IRIS, plant and OEM acceptance is earned |
One scenario run, step by step
Every Railira run is an ordered, inspectable sequence. This is run_9b4e27: Car 07 of a 4-car metro consist · shell line B · bogie shop · booth 2 · marriage station. Scenario completes in 10 steps with one approval gate. Shell geometry held inside tolerance after a twin-ranked weld sequence, one heat-input change approved by the shift weld engineer, two torque traces routed to rework before brake test, the livery cure window protected in the sequence, marriage interface inside tolerance, car released with full genealogy.
-
01
ingest.order
SUCCEEDED
0.8 s
Plant Orchestrator · Pulled the work packages for car 07 from MES and PLM: aluminium extrusion shell, EN 15085 weld class per joint, control-plan geometry tolerances, bogie torque specifications, livery recipe and cure window, fit-out and marriage sequence. Locked the approved control-plan envelope for the shift.
-
02
takt.sequence
SUCCEEDED
41 s
Line-and-Logistics · Sequenced the shift against live readiness: booth 2 cure window, bogie B-14 readiness, brake-test slot at 13:40, AMR fleet state and kit inventory. The plan moves car 07 marriage behind car 06 to keep the cure window and the test slot.
-
03
twin.simulate
SUCCEEDED
58 s
Train Twin · Simulated 18 candidate weld sequences for the roof-to-sidewall joints on the as-built twin and ranked them on predicted distortion, door-aperture geometry and heat input. Sequence #6 keeps the aperture inside tolerance with 2% less heat input than the standing sequence.
-
04
weld.sequence
SUCCEEDED
3 m 12 s
Weld-and-Structure · Recommended sequence #6 and the matching clamping plan to the shell line. Seam vision and laser-tracker geometry confirmed the roof-to-sidewall joints inside the control-plan tolerance on the first four seams.
-
05
approve.human
APPROVAL
52 s
Plant Orchestrator · Sequence #6 lowers heat input on the roof joints 2% below the standing weld procedure. Heat-input changes stay with a named engineer, so the step was held for the shift weld engineer and approved at 06:12:44 with the twin evidence attached.
-
06
bogie.torque
SUCCEEDED
continuous
Bogie-and-Running-Gear · Press-fit curves and torque traces on bogie B-14 read at the station. Two traction-motor mounting traces fell outside the expected profile and were routed to rework before brake test; the remaining safety-critical joints verified to spec.
-
07
coat.cure
SUCCEEDED
continuous
Coat-and-Livery · Booth 2 humidity and temperature, film thickness and flash time watched through the livery pass. One masking misalignment on the door band flagged by booth vision before the second coat; the cure window held and handed to the sequence as a hard constraint.
-
08
marry.align
SUCCEEDED
2 m 05 s
Marry-and-Couple · Carbody and bogie scans compared against target interface geometry before the lift. Fit-out readiness confirmed by Fitout-and-Interior for doors and glazing. Marriage guided inside tolerance; coupler and gangway checks verified and written to the twin.
-
09
inspect.fuse
SUCCEEDED
continuous
Quality-and-Anomaly · Weld and coating vision, in-line metrology, torque, wiring continuity and brake-test results fused at the edge across the car. Every finding localised to station, work package and shift, with the two torque reworks and the masking flag already closed.
-
10
car.release
SUCCEEDED
1 m 30 s
Conformance · Car 07 released: genealogy written (weld records per joint, geometry scans, torque traces, coating recipe and cure record, fit-out checks, marriage interface, approvals, test results) and dispositioned against the control plan and IRIS / ISO/TS 22163 criteria with cited evidence for the quality engineer's sign-off.
What the audit log looks like
Every tool invocation, argument and result is written to an append-only, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the plant.
- 05:58:02mes.read_workpackages({ car: "07", consist: "M4-118", shift: "A" })
- 05:58:03ok 142 work packages · control plan locked · EN 15085 classes mapped
- 05:58:04cuopt.sequence({ shift: "A", constraints: ["cure_window", "test_slot", "bogie_ready"] })
- 05:58:45ok plan released · car 07 marriage after car 06 · test slot 13:40 held
- 05:58:46twin.simulate({ joints: "roof-sidewall", candidates: 18 })
- 05:59:44ok best sequence #6 · aperture dev 0.6 mm · heat input −2%
- 05:59:45policy.evaluate({ sequence: 6, autonomy: "L2+" })
- 05:59:45ok 6 recommendations permitted · heat_input requires human approval
- 05:59:46weld.set_sequence({ line: "B", seq: 6, clamping: "plan-6" })
- 06:02:58ok 4 seams inside tolerance · tracker dev 0.5 mm
- 06:02:59approval.request({ action: "heat_input", delta: "-2%", joints: "roof" })
- 06:12:44ok approved by shift weld engineer · twin evidence attached · logged
- 06:12:45torque.read_trace({ bogie: "B-14", joints: "all" })
- 07:40:12trace out of profile · traction-motor mount M3, M4 · bogie B-14
- 07:40:13rework.route({ bogie: "B-14", joints: ["M3", "M4"], before: "brake_test" })
- 07:40:13ok routed · brake test slot held
- 08:05:00cure.window({ booth: 2, recipe: "livery-M4" })
- 08:31:20masking misalignment · door band · booth 2 · before coat 2
- 08:31:21ok masking corrected · cure window held · constraint sent to sequence
- 11:10:02scan.compare({ car: "07", bogie: "B-14" })
- 11:12:07ok interface inside tolerance · fit-out ready · marriage guided
- 11:12:08sensors.fuse({ car: "07", streams: ["vision", "metrology", "torque", "wiring"] })
- 13:58:40genealogy.write({ car: "07", packets: "full" })
- 14:00:10ok scenario complete · 10 steps · car 07 released
Reasoning trace
Plan, thought, action, observation, exactly as the orchestrator would record it.
GoalBuild car 07 through shell welding, bogie assembly, livery, fi…
Build car 07 through shell welding, bogie assembly, livery, fit-out and marriage on the shift plan, inside the control plan, with every safety-critical joint to spec and the cure window protected.
PlanSequence the shift first, so the cure window and the brake-tes…
Sequence the shift first, so the cure window and the brake-test slot are protected. Simulate the roof-to-sidewall weld sequence on the twin before the first seam. Read every torque trace at the station. Fuse inspection continuously. Hold any heat-input change for a human.
ThoughtThe standing weld procedure runs the roof joints hot enough to…
The standing weld procedure runs the roof joints hot enough to guarantee penetration on a cold fixture. With the clamping plan from the twin the same penetration holds at 2% less heat input and the door aperture stays inside tolerance, because the distortion is sequenced out rather than reworked out.
Actiontwin.simulate(candidates=18) returns sequence #6: roof joints …
twin.simulate(candidates=18) returns sequence #6: roof joints re-ordered, clamping plan 6, heat input down 2% on the roof joints.
ObservationSequence #6 predicts door-aperture deviation 0.6 mm against a …
Sequence #6 predicts door-aperture deviation 0.6 mm against a 1.5 mm tolerance. Three candidates scored lower on heat input but pushed predicted sidewall distortion past the limit and were discarded.
ActionRecommend sequence #6 to the shell line; six recommendations p…
Recommend sequence #6 to the shell line; six recommendations permitted; the heat-input change routed to the shift weld engineer with the twin evidence.
ObservationTwo traction-motor mounting traces on bogie B-14 fell outside …
Two traction-motor mounting traces on bogie B-14 fell outside the expected profile at 07:40:12. Routed to rework before brake test; the slot held. One masking misalignment on the door band flagged in booth 2 before the second coat.
OutcomeScenario complete. Shell inside tolerance, bogie joints to spe…
Scenario complete. Shell inside tolerance, bogie joints to spec after rework, livery inside the cure window, marriage interface inside tolerance. Car 07 released with full genealogy.
Standardise autonomy across the network
One policy model, one audit trail, one benchmark across every process in every plant, with the carbody, coating, torque and takt models kept private to each site and program.
- SSO and role-based access down to the tool level, planned for the 6 to 12 month release
- Network-wide autonomy policy with per-site override and approval chains
- Cross-plant benchmarking on first-time-through, rework, PPM, delivery risk and takt
- On-prem and plant-edge deployment for regulated and OEM cyber-reviewed plants
- Edge autonomy that survives control-plane loss by returning to the controller's last known-good state
- Dedicated deployment engineer and quarterly model review per plant
Straight answers
The questions plant directors, body and coating engineers and quality leads ask in the first meeting.
Only within an explicit tool allow-list with per-tool rate and magnitude limits, inside the approved control-plan envelope, and only at the autonomy level your plant has set. Design partners start in shadow mode, where Railira writes nothing. Heat-input and weld-sequence changes, schedule release and car release stay with a named approver.
Control returns to the robot, PLC or station's last known-good state. Railira is a supervisory layer on top of the controllers, safety systems and interlocks you already run, never a replacement for them, so an outage degrades the line to its current way of running, not to a stop.
Recommendations start from the control plan, the work instructions and the twin in the first weeks. Weld, geometry, coating and torque prediction improve as line history and labelled outcomes accumulate per car type. Onboarding is sized at 100 to 500 GPU-hours per plant and 50,000 to 250,000 synthetic images or scan variants per program, all design targets.
Only if you choose cloud training. Designs, control plans, program data, process models and quality records are isolated per tenant and never used to train another customer's models. Fully on-prem deployment at the plant edge is available for regulated plants, and cross-plant learning is planned and waits on data-rights agreements.
You are, the same as with any control strategy, which is why every write is policy-checked, bounded, logged and reversible, and why anything above your risk threshold waits for a named approver. The audit log records the request, the evidence, the envelope applied and the human decision.
A paid pilot on one process or line area, scoped to a single wedge with a success metric written into the order form: weld or coating rework reduction, geometry escapes, torque escapes, line stoppage minutes or first-time-through. It starts in shadow mode against a baseline from your own records, moves to assist mode when the engineer is satisfied, and expands only after the number moves.
Send us your security questionnaire
We answer plainly, including where an item is planned rather than done.