Technical Summary: From Detection to Action – Using LLM Agents for Fault-Tolerant Control

Problem Statement

Despite advancements in automation, process industry operations often rely heavily on human expertise for decision-making under unforeseen conditions, particularly when data is limited or system behavior deviates from expected patterns. Process plants face challenges such as tightly coupled energy and material flows, subtle state-dependent fault symptoms, and alarm floods that overwhelm operators. Existing Artificial Intelligence (AI) approaches, such as Reinforcement Learning (RL), face barriers to adoption including low sample efficiency, limited generalizability, and the need for carefully designed reward functions. Furthermore, while Large Language Models (LLMs) offer potential for end-to-end orchestration, their deployment in safety-critical Fault-Tolerant Control (FTC) is hindered by three specific gaps:

1. Grounding: Plant knowledge is fragmented across heterogeneous artifacts (P&IDs, interlock lists, maintenance records), and text-only retrieval often fails to capture the complex relationships needed for corrective actions.
2. Assurance: Proposed actions often lack auditable traces and explicit feasibility checks against interlocks, operating envelopes, and process physics before execution.
3. Timeliness/Robustness: Recovery must operate under hybrid dynamics and partial observability, where delayed or incorrect actions can be unsafe.

Methodology

The authors propose an agentic LLM framework for active FTC that transforms fault detection outputs into constraint-aware recovery actions. The framework operates across two spaces: a Physical Space (the process plant and safety systems) and a Virtual Space (containing an Agent Layer and a Tool Layer).

1. Tool Layer

The Tool Layer provides the necessary infrastructure for the agents:

• Digital Process Plant Twin (DPPT): An executable tool stack containing plant data, physics/data-driven models, and simulation services. It supports condition monitoring and pre-execution validation of corrective actions.
• Graph Retrieval-Augmented Generation (Graph RAG): To address the grounding gap, the authors utilize an ontology-based knowledge graph built on the CPSMod ontology. This integrates heterogeneous engineering artifacts into a machine-interpretable representation. The ontology combines five standard-based Ontology Design Patterns (ODPs) covering structure (VDI 2206), function and flows (VDI 3682), discrete behavior (UML State Machine), continuous behavior (OpenMath), and fault diagnosis (DIN 17359). Agents use SPARQL queries to retrieve relation-aware, multi-hop context linking equipment, control logic, operating modes, and fault semantics.

2. Agent Layer

The framework decomposes operator duties into a multi-agent workflow involving six specialized agents:

• Monitoring Agent: A deterministic/data-driven component that detects faults by comparing process values against statistical baselines or data-driven models.
• Planning Agent: An LLM-based agent that retrieves relevant system functions and state-machine behaviors from the knowledge graph. It traverses the state-machine graph to propose minimal-risk recovery paths from the current faulty state to a target operational state.
• Action Agent: An LLM-based agent that synthesizes specific corrective control actions (discrete commands or continuous setpoint adaptations) based on the selected path and the plant's actuation capabilities. It ensures actions respect interlocks, limits, and rate constraints.
• Simulation Agent: Invokes the DPPT simulation service to test whether the proposed actions can drive the system to a valid state without violating dynamics or constraints.
• Validation Agent: A deterministic agent that evaluates simulation outputs against safety criteria (interlocks, envelopes, recovery time, loop performance) to approve or reject the action set.
• Reprompting Agent: Coordinates an iterative refinement loop. If validation fails, it generates structured feedback (e.g., "envelope breach," "unmet guard") and reprompts the Planning or Action Agent to refine the plan.

If no acceptable plan is found within a bounded time window, control is handed to a safety fallback system.

Key Contributions

The paper makes three primary contributions to address the identified gaps:

1. Relation-Aware Grounding: The use of an ontology and Graph RAG enables multi-hop retrieval of actionable dependencies, linking equipment, control logic, and fault semantics, thereby grounding LLM agents in specific plant knowledge.
2. Safety Assurance via Validation: The framework enforces safety through minimal, explainable recovery plans that undergo deterministic pre-execution validation (interlocks, envelopes, dynamic feasibility) and maintain an auditable decision trace via a multi-agent workflow.
3. Bounded-Latency Operation: The system supports operation under time constraints through tool-assisted monitoring, constrained action generation, and a safety fallback mechanism if a valid plan cannot be synthesized in time.

Experimental Results

The framework was evaluated on two benchmarks: a discrete Mixing Module and a continuous Continuous Stirred-Tank Reactor (CSTR). Two lightweight LLMs were tested: GPT-4.1-mini and GPT-4o-mini.

Mixing Module (Discrete Control)

• GPT-4.1-mini achieved a 100% success rate across 60 runs (10 per fault scenario), with 100% action correctness and precision. It required no corrective reprompts.
• GPT-4o-mini achieved an 85% success rate (51/60 runs). Failures were concentrated in pump_degradation (50% success) and sensor_fault (60% success). Analysis showed that while GPT-4o-mini correctly identified necessary actuators (100% recall), it occasionally activated unnecessary ones (lower precision) or selected incorrect bypass paths during planning.
• Latency: Mean wall-clock time was 32.7s for GPT-4.1-mini and 40.7s for GPT-4o-mini.

CSTR (Continuous Control)

• GPT-4.1-mini achieved a 93.3% success rate (28/30 runs). It successfully handled fouling, pump_degrade, and cool_stuck_closed scenarios, often requiring reprompting to converge on safe setpoints.
• GPT-4o-mini achieved a 76.7% success rate (23/30 runs). It struggled significantly with the cool_stuck_closed scenario (4/10 success), frequently hitting the reprompt limit due to repeated proposals that failed to satisfy recovery requirements.
• Performance: GPT-4.1-mini demonstrated lower per-call action latency (2.1s vs. 2.7s) and comparable token consumption.

Significance and Claims

The paper claims to demonstrate a practical pathway from fault detection to validated corrective action for both discrete and continuous FTC tasks. The authors assert that:

• Semantically grounded agents can derive valid recovery decisions within latency budgets compatible with process dynamics (seconds to tens of seconds), making them suitable for supervisory and batch control but not hard real-time systems.
• Graph RAG is a viable mechanism for contextualizing dispersed plant knowledge, allowing agents to reason about fault-dependent constraints without explicit enumeration of all fault scenarios.
• Simulation-based validation effectively filters out infeasible actions, and reprompting can correct transient decision errors, though it cannot compensate for systematic reasoning failures or unmodeled faults.

The authors maintain a modest stance, noting that the framework is "feasibility-first" rather than "optimality-first." They acknowledge limitations regarding the effort required to construct knowledge graphs, the inability to simulate truly novel faults without prior characterization, and the current reliance on cloud-hosted models for research, which would require on-premise deployment and IT/OT segmentation for industrial use. The work does not claim to replace human operators entirely but rather to provide a robust, autonomous decision-support layer for active FTC.