Your plants run on twenty different integrations. None of them talk to each other.
One integration per site. One vendor per system. When something breaks, nobody owns the result. There is a better way to run a distributed manufacturing operation.
Proven in environments harder than manufacturing. Trusted by operators where downtime costs €200K–€700K per day.
- Boskalis100+ vessels, live in under two weeks
- Sunrock300 solar sites steered against live market prices
- BPcamera to control action in under 150ms
- Noble20+ rigs on one fleet-wide deployment
TL;DR
- Multi-site manufacturers spend more time integrating than operating. Each plant has its own vendor, its own version, its own logic. Scaling means starting the project again at each new site.
- Control decisions that take more than 10ms need to run locally. Cloud cannot participate in a CNC or robotic control loop. Edge-resident logic runs at the machine and keeps running when the network drops.
- Equipment failures are detectable before they happen. An edge model running continuously catches a developing fault 30 to 50 days before the line stops. A cloud batch job catches it after.
- The EU Cyber Resilience Act requires documented device identity and update history across every connected machine by December 2027. Most manufacturers cannot produce this from a single platform today.
- NIS2 applies to manufacturers in critical supply chains. The incident notification deadline is 24 hours for an early warning, 72 hours for a detailed report. Siloed OT telemetry cannot meet that timeline.
Your plants are running. Your operations are not.
The equipment works. The architecture underneath it does not.
- Each plant runs on its own integration.
- You have 15 plants. You have 15 different ways of getting data from the floor to a system that can use it. Different protocols, different historians, different vendor APIs. Scaling a digital initiative means starting the integration project again at each new site. The vendor delivers the site. Nobody delivers the fleet.
- Control decisions arrive after the window closes.
- A CNC machine runs on a 10ms control loop. A robotic cell reacts in single-digit milliseconds. A cloud-dependent system adding 200 to 800ms of round-trip latency cannot participate in that loop. Getting the right version of the right logic to the right machine, consistently and securely, without a site visit each time, is the infrastructure problem that sits underneath the control-loop problem.
- The fault was there for days. Nobody caught it.
- A bearing approaching failure changes its vibration signature. A motor running hot has been running hot for hours before the temperature trip fires. An edge model running continuously catches the pattern 30 to 50 days before the breakdown. A cloud model sampling every 15 minutes catches it after the line stops. One manufacturer running continuous edge monitoring across 2,500 machines at 12 facilities reduced unplanned downtime by 65%. Industry benchmark: unplanned downtime on a mid-scale line costs €100K to €250K per hour.
- Security and compliance are manual, per site, and incomplete.
- The EU Cyber Resilience Act requires documented device identity, update records, and vulnerability history for every connected machine by December 2027. NIS2 applies to manufacturers in critical supply chains. Most plants were provisioned without formal identity enrollment. Update logs are local, inconsistent, and not centralized. The audit finds no gap in intent. It finds an absence of records.
Manufacturing cost calculator
Downtime exposure
Pre-filled at $150,000 as a conservative mid-point. Editable.
Annual downtime exposure: —
Integration overhead
Pre-filled at 45 days. Editable.
Pre-filled at $1,200 per day. Editable.
Annual integration overhead: —
Enter your figures to see what your current architecture costs each year.
Downtime exposure = lines × downtime hours × cost per hour. Integration overhead = plants × integration days × day rate. Conservative estimates. Adjust for your actual environment. Figures are directional, not audited results.
What your operation can run on one platform
Start with one. The infrastructure is already there for the next.
What you stop buying separately
Edge control
- Edge runtime
- Applications execute at the asset. Control logic runs locally, with or without a cloud connection.
- Hardware-agnostic deployment
- Runs on existing edge hardware. No vendor lock-in, no rip-and-replace.
- Edge buffering
- No data lost during connectivity outages or power interruptions. Data queues locally and sends when the connection returns.
- Fleet and device management
- Provision, configure, monitor, and patch hundreds of edge nodes from one place. No site visits required for routine management.
- OTA updates
- Software updates reach every edge node in the fleet without a site visit.
- Centralized fleet orchestration
- One console shows the health and status of every edge node, application, and device across the fleet.
Security by design
- Certificate-based device identity
- Every device authenticates with a certificate before it connects. No exceptions.
- Network segmentation
- OT and IT traffic stay separated. Boundaries align to the Purdue model and are managed centrally.
- Zero-trust remote access
- Remote access via SSH, HTTPS, or GUI requires MFA approval and is logged. No VPN. No ungoverned entry point.
- Security log monitoring
- Security events across the fleet are monitored continuously. Threats surface as alerts, not post-incident discoveries.
- Device vulnerability management
- Security exposure at device level is assessed continuously. Vulnerabilities are tracked and remediated through the platform.
- Code signing and container security
- Every application deployed to the fleet is signed at source. Unsigned code does not execute.
- NIS2 and EU CRA compliance by design
- Audit-readiness is structural. Certificate-based identity, encrypted communications, access logging, and incident reporting run by default.
Data to control
- Industrial protocol adapters (HDC)
- OPC UA, Modbus, MQTT, CAN bus, NMEA, Siemens S7, REST. Connects to any equipment, any OEM.
- Data transformation and dynamic filtering
- Data is structured and filtered at the asset. Only relevant changes transmit. Bandwidth use drops without losing fidelity.
- Triggers and events engine
- Configurable logic fires a control action the moment a data condition is met. No human relay, no cloud round-trip.
- Local AI inference
- AI models run at the asset. Inference executes in under 150ms with no cloud hop.
- Cloud Fanout
- One structured data source at the edge feeds multiple cloud destinations simultaneously: Kafka, Azure Data Explorer, TimescaleDB, cold storage.
Your expertise, running at the edge
- CI/CD pipelines to the edge
- Development teams push application updates through a governed pipeline with security scanning at every stage.
- Sandboxed execution environment
- Each application runs in isolation. A problem in one application cannot affect another or reach the underlying OS.
- Containerized application store and staged rollouts
- Applications deploy through a governed catalog. Rollouts progress through test, pilot, and production stages before reaching the full fleet.
- Multi-tenant governance and role-based access
- Each organization's data and applications stay in their own tenant. Access to every function is governed by role.
- Centralized fleet orchestration (application layer)
- Customer-deployed applications are monitored and managed across the full fleet from one console.
What your operation looks like when one vendor owns the full stack
Edge control, not cloud dependency
A CNC machine runs on a 10ms cycle. A robotic cell reacting to a zone breach cannot wait for a cloud response. Control logic at the machine means the decision happens in the time the process requires, whether the network is up or not.
Proof from a harder environment: Sunrock moved curtailment decisions to the asset across 300 solar farms. If it holds on an offshore rig or a remote solar farm, it holds on a factory floor.
Security by design
Certificate-based device identity and zero-trust access governance are in the Helin runtime by default. NIS2 incident records, EU CRA documentation, and access logs are generated continuously. The audit package exists in real time, not assembled in the weeks before each review.
Boskalis built this across 100+ vessels on the same architecture.
AI that acts, not AI that advises
Most industrial AI stops at the recommendation. Helin closes the loop. Red Zone Manager detects a zone intrusion and triggers a physical response in under 150ms — camera feed to control action, no cloud hop. Outcome cited by the operating company: human lives saved.
The same architecture applies to any automated response that cannot wait for a human relay.
Your expertise, running at the edge
Domain knowledge that lives in a cloud application or a single-site tool can be deployed to the asset without a new infrastructure project. Development teams bring the application logic. Helin handles the runtime, security, deployment pipeline, and fleet operations underneath it.
Put an application on your line without starting another integration project.
If your plants are running different versions of the same logic, your OT security audit gets assembled manually before each review, or your predictive maintenance pilot never made it past the first site — we have seen this before.
What you get versus what you're assembling today
| Capability | Helin | Point-solution stack |
|---|---|---|
| Control logic deployment | Containerized, centrally governed OTA | Per-site, per-vendor integration |
| Device identity | Certificate-based (X.509, TPM 2.0) at enrollment | Inconsistent, not centralized |
| Remote access governance | Zero-trust, policy-governed, logged | Per-site VPN, multiple vendors |
| Predictive maintenance | Edge-resident, continuous, offline-capable | Cloud batch inference, 15-min cycles |
| Compliance record | Automated, real-time, exportable | Manual assembly before each audit |
| Update governance | Governed OTA, central confirmation, rollback | Manual, per-site, version drift |
| Responsible party | One platform, one party | Five vendors, integration risk on you |
Specifications
| Deployment model | On-premises edge hardware or customer-supplied compute. No cloud dependency on the control loop. |
|---|---|
| Supported protocols | OPC UA, Modbus, MQTT, CAN bus, NMEA, Siemens S7, REST |
| Hardware compatibility | Any Linux-capable hardware. No proprietary hardware required. |
| Security architecture | X.509 / TPM 2.0 device identity, TLS encrypted communications, zero-trust access governance |
| Update governance | OTA with central version tracking, rollback capability, and confirmation logging |
| Control loop latency | Sub-150ms on AI inference. No cloud hop. |
| Compliance coverage | NIS2, EU Cyber Resilience Act, IEC 62443, ATEX |
| Applications | Red Zone Manager, Smart Grid Manager, Remote CCTV Manager, plus customer-built containerized applications |
Frequently asked questions
What this is not
Not an MES or production planning system
Helin is not an MES or production planning system.
Not a cloud analytics platform
Helin is not a cloud analytics platform that surfaces insights for a human to act on.
Not a different deployment at every plant
Helin is not a deployment that works differently at the next plant.
Not a separate OT security layer
Helin is not an OT security tool layered on top of a separate operational platform.
Not a vision AI point product
Helin is not a vision AI point product scoped to one use case.
Not a systems integrator
Helin is not a systems integrator delivering custom integration per site on time and materials.
Not for single-site or low-complexity operations
Helin is not built for single-site or low-complexity manufacturing operations.
Edge intelligence, once a month.
Field notes from industrial operations running control at the asset: deployment patterns, compliance changes, and what we learn on site. No product marketing.