Large reasoning models for abnormal situation management in safety-critical industrial processes

Published 20 Aug 2026 in eess.SY | (2608.19819v1)

Abstract: Automation operates safety-critical processes inside their design envelope and leaves abnormal situations to human operators. Mismanagement of these situations is a leading contributor to process-safety incidents and a hindrance to achieving autonomy. Here we show that a general-purpose large reasoning model, with no task-specific training and only the information available to an operator, manages abnormal situations at run time through a bounded, programmatically verified action interface. Across 39 abnormal situations and operating-point changes on a plant-wide industrial benchmark process, the reasoning model maintained the plant within all hard constraints in all 39, while basic regulatory control failed in 15. It matched the plant's expert-engineered advanced control and diagnosed the root-cause fault in 15 of 15 safety-critical situations. Three independently developed models spanning a thirty-fold cost range exceeded the baseline. In a fully auditable evaluation, these results demonstrate run-time abnormal situation management without a human in the loop.

Abstract PDF Upgrade to Chat

Authors (1)

Khalid Alhazmi

Summary

The paper demonstrates that a zero-shot large reasoning model stabilized the Tennessee Eastman process in all 39 benchmark episodes, matching an expert reference controller while identifying all 15 safety-critical faults.
The architecture combines operator-style state summaries, bounded actions, programmatic validation, and forward simulation, allowing the model to act above regulatory control without direct actuator access or task-specific training.
The results show reasoning primarily improves diagnosis rather than basic stabilization, while accurate state summaries are crucial: adding target-deviation data reduced quality offset from 4.8 to 0.3 mol%.

A general-purpose large reasoning model (LRM), prompted zero-shot and given only operator-visible information, can manage abnormal situations on a plant-wide chemical process at run time when its authority is confined to a bounded, programmatically verified action interface. On 39 episodes of a frozen benchmark built on the Tennessee Eastman process, the primary configuration stabilized the plant within all hard constraints in every episode where basic regulatory control tripped, matched an expert-engineered advanced control reference on the primary endpoint, and identified the ground-truth fault in all 15 safety-critical episodes (2608.19819). The result is notable less for the model than for the surrounding system: the paper quantifies how much of the achieved safety is attributable to the model's decisions versus its verification layer, and shows—via ablation—that it is almost entirely the former.

The problem: autonomy stops at the design envelope

The paper frames abnormal situation management (ASM) as the residual human function in Bainbridge's division of labor. Regulatory feedback, MPC, and real-time optimization presuppose operation within a validated design envelope; beyond it, automation offers alarm annunciation and safety-instrumented trips that halt production. Halting is not an acceptable resolution for a chemical plant because shutdown forfeits production and concentrates risk in startup/shutdown transients. Prior uses of LLMs in control sit outside the loop—reward synthesis, controller tuning, high-level planning above conventional controllers, diagnosis without authority to act—and attempts to place them inside classical loops remain low-dimensional feasibility demonstrations without stability certificates or constraint guarantees.

The study addresses two gaps identified in a recent assessment of LLMs in process systems engineering: closed-loop performance under disturbance has not been measured on a shared benchmark, and the scope of a model's authority over a physical process has not been specified precisely enough to be quantified.

Architecture: bounded authority above regulatory control

The ASM layer sits above Ricker's decentralized PI regulatory layer on the Tennessee Eastman process (revised Bathelt–Ricker–Jelali implementation), invoked on alarm onset subject to a minimum inter-invocation interval, periodic checks, and a per-episode budget of 12 invocations. Four engineered components surround the model:

Process-state summary generator: converts measured signals into operator-style derived quantities—constraint margins with signed time-to-limit, windowed trend slopes with standard errors, controller diagnostics, material-balance consistency residuals, hold-action projections, and recent actions with predicted-versus-observed convergence flags.
Bounded action interface: setpoint changes within validated ranges, one-way activation of pre-engineered protective components (composition trims, override loops), four pre-audited procedures, no action, or orderly shutdown. Direct actuator manipulation is not representable.
Programmatic validator: static checks (range, rate, cooldown, budget) plus a 6-hour shadow rollout on a nominal model that vetoes actions predicted to trip; rejected proposals return machine-readable reasons and permit one revision.
Forward simulation: a nominal-model what-if tool available to the model for simulate-before-act reasoning, deliberately not given the true disturbance—an "operator's simulator."

The prompt separates a hash-frozen, process-agnostic operating procedure (lexicographic objective ordering placing process safety first) from a Part B generated from the plant configuration, so porting to another process requires regenerating only Part B. No task-specific training, fine-tuning, or demonstrations are used.

Benchmark design

Thirteen scenarios in three classes isolate distinct demands: five no-intervention scenarios (baseline suffices), five safety-gap scenarios (baseline reaches the reactor-pressure interlock on every seed while the reference controller maintains operation), and three quality-gap scenarios (product-grade setpoint changes the baseline cannot track). Severities were calibrated empirically before any language-model experiment, the suite was frozen by content hash and never used for prompt iteration, three paired noise seeds fix measurement-noise realizations across configurations, and all decision transcripts are cached for exact offline replay. The primary endpoint is stabilization within all hard constraints at a 48-h horizon, with interlock trip and orderly shutdown both counting as failure.

Headline results

Under the baseline, the plant remains within constraints in 24 of 39 episodes, tripping in all 15 safety-gap episodes. Claude Sonnet-5 at high reasoning effort stabilizes all 39—a paired difference of +0.385 over baseline (95% CI [+0.22, +0.54]; exact McNemar $p = 6\times10^{-5}$ ), concentrated as +1.00 in the safety-gap class. The reference controller also reaches 39/39, with no discordant pairs against the model, so the primary endpoint does not distinguish them.

Configuration

In-constraint

Trips

Diagnosis acc. (any inv.)

Actions/episode

Cost/episode (US

)</th> </tr> </thead><tbody><tr> <td>Baseline</td> <td>0.615</td> <td>15</td> <td>—</td> <td>—</td> <td>—</td> </tr> <tr> <td>Reference controller</td> <td>1.000</td> <td>0</td> <td>—</td> <td>—</td> <td>—</td> </tr> <tr> <td>Sonnet-5, high effort</td> <td>1.000</td> <td>0</td> <td>0.846</td> <td>2.54</td> <td>2.32</td> </tr> <tr> <td>Sonnet-5, low effort</td> <td>0.974</td> <td>1</td> <td>0.821</td> <td>2.82</td> <td>1.31</td> </tr> <tr> <td>GLM-5.2</td> <td>0.949</td> <td>2</td> <td>0.769</td> <td>3.64</td> <td>0.67</td> </tr> <tr> <td>DeepSeek-V4-Flash</td> <td>1.000</td> <td>0</td> <td>0.744</td> <td>1.85</td> <td>0.07</td> </tr> </tbody></table></div> <p>Three independently developed models across a thirty-fold cost range exceed the baseline under identical architecture, prompt, and interface, and none is distinguishable from the reference on the primary endpoint. The least expensive configuration matches the most expensive, indicating the outcome rests on the surrounding system rather than a particular model.</p> <h2 class='paper-heading' id='reasoning-effort-and-diagnosis'>Reasoning effort and diagnosis</h2> <p>On the most demanding safety-gap scenario (reactant-composition disturbance at elevated production), Sonnet-5 at low effort misdiagnosed valve stiction, activated the wrong protective component, and tripped; the same model at high effort, on the identical scenario and seed, diagnosed the composition imbalance correctly, activated the trims, and staged production cuts anticipating the induced inventory transient. The paper reports this honestly as a single discordant pair (

n = 39

; McNemar

p = 1.0$) with an identified mechanism, not an estimated effect size.

Diagnosis is what separates the model from a rule table. A scripted supervisor given the same summary, interface, and validator reaches the same in-constraint outcome but identifies the cause in only 2 of 15 safety-gap episodes, versus 15 of 15 for the model. The endpoint is thus reachable without reasoning; the demonstrated contribution of reasoning lies in diagnosis accuracy. The model also operates more conservatively than the economics-tuned reference, holding larger pressure margins while running reactant feed roughly 19% lower—a safety-over-throughput default consistent with the layer's function.

The summary content determines capability

A controlled finding concerns the interface between the plant and the model. Because the process-state summary reported hard-constraint margins but presented operating targets only as setpoints beside measurements, the model failed to correct a grade-reduction scenario on any seed, settling 13.6 mol% off target. Adding a single derived field—the deviation of each commanded operating target from its delivered value, reported in the same form as constraint margins—led the model to activate the trims on all 9 quality episodes and reduced mean steady-state grade offset from 4.8 to 0.3 mol%, matching the reference. Safety outcomes were unchanged. This is a clean demonstration that which conditions a model can act on is set by the content of its state representation.

Failures and the verification ablation

Three of 156 model-supervised episodes ended in a trip, each by a distinct mechanism: diagnostic error under reduced reasoning, unnecessary intervention on a self-correcting disturbance (GLM-5.2 destabilizing vessel inventories through interventions where withholding action was correct), and revision away from a correct initial diagnosis. No failure involved a validator-rejected action, and each was confined to one scenario. Notably, interventions were proposed in 42 of 60 no-intervention episodes but proved consequential in only one.

The central methodological contribution is the verification ablation. Re-running the primary configuration with the shadow-simulation veto removed, then with no validator at all, still yields 39/39 in-constraint episodes; in the three episodes where the validator had rejected proposals, applying the original proposal unchanged produced the same outcome. Across the campaign the veto never fired and static checks rejected only three marginally out-of-range proposals. With that qualification, the reported decisions are the model's own—the performance does not depend on the verification layer, though the layer remains the mechanism bounding the consequences of an incorrect decision.

Limitations

The evaluation is entirely in simulation; the sim-to-real gap for this kind of control is unquantified in any published study. The nominal forward simulation can certify as safe an action that later contributes to a trip because it lacks the true disturbance—a residual failure mode that would persist in deployment and is precisely the regime where human plant familiarity matters most. No comparison with human operators is made. Trajectory-level verification is absent: two failures developed through sequences of individually admissible actions that per-action checking did not flag. Abnormal situations unaddressed by any pre-engineered component are not represented, so the outcome-level result demonstrates maintenance of constraints given a library of protective components, with reasoning's contribution confined to diagnosis. At near-ceiling in-constraint fractions, the protocol cannot separate the model configurations from one another. No formal guarantee or SIL claim is made; generalization beyond a single process is supported in principle by the prompt's structure but not demonstrated; and the cost comparison spans list prices across providers rather than a controlled frontier.

Conclusion

This work demonstrates run-time abnormal situation management without a human in the loop on a plant-wide benchmark, using a general-purpose reasoning model whose authority is bounded by construction and whose decisions survive removal of their verification. It contradicts the position that LLMs are too stochastic for use in or above a safety-critical loop, extends evidence for inference-time computation to a metric of physical safety, and supplies a replayable closed-loop benchmark and evaluation protocol where none existed. The open questions are concrete: whether the architecture transfers to a second process family, whether harder scenario families can separate model configurations, and how trajectory-level verification should be designed to catch failures that accumulate across individually admissible actions.

Markdown Report Issue