By Muhammad Umar. This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://codeatoms.ai/cement-kiln-control-saudi-arabia/. The DOI is assigned on release. The operator is described by class, never by name.
A cement company in Saudi Arabia runs several integrated plants, each with a preheater and precalciner kiln line of several thousand tonnes of clinker a day. When a new alternative fuel lot drifts the burning zone over a shift, the control room operator needs the likely cause, the recovery moves that worked in matching past upsets, and the setpoint adjustments with their expected effect on thermal energy per tonne. The historian holds the tags, the laboratory system holds the clinker quality, the fuel records hold the calorific value behind the drift, the shell scanner holds the physical sign of burning zone trouble, the maintenance system holds the refractory history, and the shift log holds what the last crew tried. Reconstructing one upset's story from them is hand work, and the practice that joins them lives in people's heads and leaves with them.
1. Advisory above the controller, never inside it
The agents ride above the incumbent model predictive controller rather than replacing or re-tuning it, so one control path survives and operators keep authority. The seven systems of record are bound read only, closed loop writes are excluded by the scope boundary, and the single write path in the whole design is a named person confirming, rejecting or annotating a draft. The one crossing toward the control network is the Lidi with Eurydice one way transfer stack, a data diode that makes a return path physically absent rather than merely blocked, and it fails closed: when the link, the power or the update path fails, the diode stops, the adapters buffer, the agents pause their drafts, and the kiln's control path is untouched.
2. Three adapter families on one backbone
Seven sources feed the design: the distributed control system and its historian, the laboratory system, the fuel and alternative fuel feed records, the kiln shell scanner, the maintenance management system, the shift log and the production reporting system. Three adapter families carry them, each owning its source contract: the integration adapter for the operational systems, the telemetry adapter for the streaming tag flow, and the ops systems adapter for logs, work orders and reports. A schema change at a source surfaces as a contract failure rather than silent corruption, every record is validated and stamped with provenance and receipt time, and both clocks align to the plant time source through Chrony, because a join between the historian and the laboratory system is only as good as their shared clock.
Apache Kafka 4.3 with KRaft is the event backbone. Tag streams are partitioned by tag name so the sequence of any one variable is never reordered, and delivery is at least once, made effectively once by idempotent writes keyed on each source's sequence numbers, so a replay after a fault cannot double apply an operator action or a lab value. The ontology lives in Hyper Ontology v0.9 over TimescaleDB as a governed projection over the systems of record, never a copy; a shadow data lake was set aside because copies drift and no document store joins an upset to the moves that cured it.
3. Sixteen objects, one walk
The object model holds sixteen objects: kiln line, equipment, tag, setpoint, recipe, raw meal lot, fuel lot, clinker sample and quality result, upset, operator action, shell scan, work order, shift, and the control room operator, shift supervisor and production manager. One query walks a path no single system holds: ask for every upset that began during a fuel lot change and was followed by a clinker sample back in specification, and the model traverses upset to fuel lot to operator action to sample in one step, where a document store would need the question known in advance and the join written by hand. Twelve objects are anchored in a named system of record; the upset and the three people are anchored in the model itself, because no system of record holds an upset whole or holds a person at all. The human loop lives in the status vocabularies: an upset walks from open through cause drafted and cause confirmed to recovered and closed, and only a person moves it.
4. One node, sized by arithmetic
GLM 5.3 files 753 billion parameters. At FP8, one byte per parameter, the weights occupy 753 GB, and the 1.2 planning factor, which reserves room for the KV cache and activations, brings the requirement to 904 GB. One node of eight accelerators of the 141 GB high bandwidth memory class offers 1,128 GB, which leaves 375 GB beside the weights, so the work surface never needs a second node. The node runs in the company's own data centre in the country, with vLLM serving under K3s and an air gapped Harbor registry for updates, and it is a 4A090 class item for a D:3 and D:4 destination, so an export licence determination comes before the order, with two nodes of the 80 GB class as the fallback shape. A third party model service was rejected outright, because nothing about the plants leaves the country.
The two small models need no frontier hardware. Chronos-2 (Apache-2.0, about 0.24 GB) forecasts the stable band on the streaming tags and its residuals raise the drift trigger; BGE-M3 (MIT, about 1.1 GB at FP16) embeds past upsets, shift logs and maintenance history in Arabic and English. Both run on the plant GPU server on one or two PCIe cards, because anything with a physical deadline runs beside the stream, and only drafts, citations and questions travel to the frontier node.
5. Three agents, named staff
The upset agent drafts a cause and recovery for the control room operator to confirm, the setpoint agent drafts adjustments after a fuel lot change for the shift supervisor to approve while that lot is still feeding the burner, and the shift agent drafts the handover with its energy and quality comparison for the production manager. Drafts run in shadow before anyone approves them. Nothing is trained; every confirmation or rejection is kept as the memory the next shift reads, so the system improves without a single weight changing, and a plant can audit a decision record where it could never audit drifting weights. The sector precedent that read 4.1 percent in a continuous month and 2.2 percent under a controlled comparison sets the honesty bar for what the gate may claim.
Appendix A prices the node at about 570,000 US dollars to own over three years (542,000 to 594,000: server, support and power at the national commercial electricity tariff). Renting the same eight cards around the clock on the deepest three year commitment in AWS Middle East (UAE) is about 751,000, so ownership costs about three quarters of it, and on demand is about 2.00 million, against which ownership costs a little over a quarter. Renting is a price reference only: the AWS price files list no Saudi region on the day read, and every rented option would carry the tag stream, the laboratory results, the fuel records and the decision record across the border, which the design's own rule forbids.
The rollout is two phases carrying 17 scope items (16, then 1) against 18 requirements, each closed by a gate, never a date: one kiln line at one plant for one quarter, gated on the setpoint agent's drafts flowing to a named approver and a controlled on and off comparison of thermal energy per tonne of clinker, in the units the national energy efficiency program itself collects. Further lines and plants follow on that evidence.
Made with CodeNinja Praxis, the CodeNinja Atoms platform for designing physical AI systems. The object model imports into Hyper Ontology. Paper, ontology and register: https://codeatoms.ai/cement-kiln-control-saudi-arabia/
One of the CodeNinja Atoms worked examples of a self-improving AI system: a system that senses an operation, reasons over typed objects, acts through a named person and improves from what those people confirm, published with its object model as hyper-ontology/1 JSON under CC BY 4.0.
Top comments (0)