A Transaction Science Platform

Industrial PaaS,
on receipts.

Every joule, every tonne, every emission, every alert — backed by a signed receipt over the sensor data and the math that produced it. The control plane stays deterministic. Inference advises; receipts settle.

Auditable emissions Joules per tonne API health
Plant signals flowing into a signed receipt A simplified process unit on the left — distillation column, flare stack, heat exchanger, pump — instrumented with four sensor bubbles. Dashed signal lines converge into an on-prem agent in the middle, which emits a verifiable receipt envelope on the right. TI 101 PI 102 AI 104 FI 103 on-prem agent sign · hash · ship rcpt:rp-019e… Process unit + sensors Signed at the edge Verifiable receipt

Capabilities

Substrate, not a dashboard.

CONNECT

Historian, DCS, CMMS connectors

OPC UA, MQTT Sparkplug, OSIsoft PI bridge, Honeywell PHD, AVEVA, Yokogawa Exaquantum. CMMS in: Maximo, SAP PM. LIMS in. Plant-floor on-prem agent runs inside the OT zone; cloud sees only signed deltas.

ASSET

ISA-95 asset graph

Every tag mapped to a physical asset and a position in the unit / area / site / enterprise hierarchy. Imported from P&IDs and existing context, or authored. The graph is the addressable surface the API queries against.

RECEIPT

Receipt-stamped time series

Every sample, every aggregate, every alert, every computed report carries a signed JWP receipt with the input data range, the model identity, and the bytes that produced the number. Audit time is read time.

JOULES

Joules per tonne, natively

Energy intensity is a first-class query, not a downstream report. kWh, MJ, BTU, m³ gas — normalized to joules; tonnes pulled from production tags; the ratio is queryable in real time with provenance attached.

ESG

Auditable emissions accounting

Scope 1, scope 2, methane LDAR, fugitive estimates — each emission number is a function of receipted sensor readings and a versioned emissions-factor table. Re-run any historical report; get the same number.

ADVISE

Inference as advice

Anomaly, failure-mode, optimization, set-point models run alongside the control plane and emit advisories with receipts. Operators see why. The DCS keeps control; the model never closes the loop without a human.

Receipts

Audit time is read time.

A receipt is a signed envelope over the inputs, the math, and the result. Sample receipts cover raw tag reads. Aggregate receipts cover hourly / daily / batch roll-ups, citing the sample receipts that fed them. Report receipts cover an emissions number or an energy-intensity figure, citing the aggregates. The chain is verifiable end-to-end.

When the regulator, the underwriter, the customer, or your own audit committee asks “how was this number computed?” — the answer is a chain of receipts, not a spreadsheet.

Receipts are the unit of trust on the platform. Every capability above produces them; every API call returns them.

Standards

SOTA-current protocols, not bespoke ones.

OPC UA

plantos-opcua

IEC 62541 — the OT lingua franca for tag access

MQTT Sparkplug B

plantos-sparkplug

Eclipse standard for unified namespace + state model

ISA-95

plantos-isa95

ANSI/ISA-95 enterprise–control hierarchy

OSIsoft PI

plantos-pi

Pi Web API + AF Element bridge (read-only by default)

IEC 62443

plantos-agent

Zone + conduit posture for the on-prem agent

JWP

jwp

Joule Wire Protocol — every operation signs a receipt

API

Pull what you need.

# Tag time-series, with sample receipts
GET  /api/v1/plant/tags/{asset}/{tag}?from=...&to=...

# Aggregated energy intensity, with chained receipts
GET  /api/v1/plant/energy/intensity/{asset}?window=24h

# Scope-1 / scope-2 / methane emission for a site over a window
GET  /api/v1/plant/emissions/{site}?from=...&to=...&scope=1

# Verify a receipt chain end-to-end
POST /api/v1/plant/verify     <- { receipt_id }

Every response carries a x-jwp-receipt header. Same for streaming. Receipts are content-addressed and verifiable offline.

Thesis

Plants are deterministic. The reporting around them isn’t.

A refinery, a smelter, a power plant, a cement line — the physical control regime is already deterministic. PID loops, MPC, DCS interlocks. The decisions that matter are made in milliseconds by hardware that does not negotiate.

What is not deterministic is everything around it: the historian readings, the alarm log, the maintenance work order, the emissions report, the energy-intensity claim, the insurance attestation, the customer scope-3 disclosure. The numbers travel on trust and arrive in spreadsheets.

PlantOS is the substrate that puts a receipt on every one of those numbers. The control plane stays where it is. The reporting plane becomes verifiable.

Request PlantOS access