Exotherm during addition — see the trend before the reactor runs away. AI warns; the SIS rules.

The problem

Between “all normal” and the DCS alarm there is a trend zone only the veteran can read today.

In a feed-controlled exothermic reaction, the classic risk is accumulation of unreacted reagent: the feed runs faster than the reaction consumes it, the inventory builds up and, when conversion kicks in, it releases its heat all at once. If that heat exceeds what the jacket can remove, the temperature takes off. The plant is protected — SIS, interlocks, rupture disc — but operationally:

1. The operator sees values, not crossed trends — 78 °C is a calm number; 78 °C climbing at 2 °C/min with the jacket already maxed out is a different story. The DCS shows the first; only the twenty-year veteran reads the second.
2. The alarm fires on the absolute value — by the time temperature reaches the threshold, the room to maneuver is down to scarce minutes, with feed still going in.
3. Every interlock trip costs a batch — the SIS does its job, and that is exactly its purpose, but behind it come the aborted batch, cleaning, downtime and investigation.
4. The close call leaves no usable record — the near miss is told at shift handover and lost; the full curve of what happened is rarely analyzed recipe by recipe.

The safety layer is not the problem — it is the last line, and it is not touched. The gap is earlier: nobody watches the shape of the curve while there is still ample margin to moderate the feed without drama.

How it fits the IRIS system

iLEAN never enters the safety loop — it assists the operator underneath it, read-only.

The architecture is deliberately conservative: iLEAN connects to the DCS/SCADA read-only, writes nothing to the process, operates no valves or pumps and takes part in no safety function. The SIS and the interlocks (IEC 61511, at their SIL level) always rule, exactly as they would without iLEAN. The iLEAN layer is informational: the putty between the data the DCS already has and the decision the operator needs to make with margin.

Connect reads the DCS signals. The agent crosses temperature trend, feed rate and jacket-to-batch delta. Edge alerts the operator with context. The person moderates the feed; the SIS keeps ruling — never the other way round.

The iLEAN pieces applied to exotherm assistance:

• Connect — OPC UA/Modbus read-only from the DCS or SCADA: batch and jacket temperature, feed rate and cumulative feed, pressure, agitation. No writes, outside every control and safety loop.
• Exotherm agent — watches the shape of the curve: rise rate versus dosed feed, jacket-to-batch delta as the remaining-cooling indicator, cumulative feed with no thermal response as the accumulation signature. It compares against the normal behavior of that recipe and warns when the trend bends the wrong way.
• Edge — delivers the warning to the control-room or field operator with full context, and archives the episode's curve tied to the batch: every near miss stays documented for the process team and the next HAZOP.

See the full IRIS architecture →

Before and after

Watching absolute values vs. trend assistance with iLEAN

Aspect	DCS + threshold alarm	With iLEAN (trend assistance)
What the operator sees	Instantaneous temperature value	Trend crossed with feed and jacket-to-batch delta
Accumulation detection	Veteran's experience, if he is on shift	Feed-without-thermal-response pattern, live
Room to moderate the feed	Scarce minutes once the alarm fires	Early warning, with operating margin
Safety layer (SIS, interlocks)	Always rules	Always rules — iLEAN neither touches nor replaces it
Batches aborted by trips	Whatever the year brings	Fewer, because the person moderates before the threshold
Near-miss record	Verbal account at handover	Full curve archived per batch and recipe

Impact estimate

Impact estimate for your plant — to be validated with your numbers.

The block below is an estimate to be validated with the specific data of your plant. We put it forward so the committee has an order of magnitude; we refine it during the diagnostic. The reduction in trips comes from people moderating the feed earlier — never from touching the safety layer.

• Specialty synthesis plant with semi-batch exothermic reactors, DCS/SCADA running and an SIS validated to IEC 61511.
• Pilot on one reactor and its most delicate recipes (read-only Connect + trend patterns validated with the process team). First value expected within a few weeks.
• Indicative payback between 6 and 14 months, depending on the history of batches aborted or downgraded by exotherm episodes and their full cost (product, cleaning, downtime, investigation).
• Hard levers: fewer batches aborted by threshold approaches; every near miss documented with its full curve; the veteran's judgment available on every shift.

And the process safety manager's reasonable doubt

“What if the model is wrong?” — it can be, and that is why the architecture gives it no authority. A false warning costs a two-minute check; a correct one buys the margin that saves the batch. The asymmetry is favorable precisely because iLEAN sits outside the loop: no safety function depends on it. On the anchored task — comparing measured signals against the recipe's pattern — the best models brought error below 1.5% ^[1]. And even so, what is critical is never decided alone: iLEAN warns, the person decides and the SIS rules. The three safety rings exist precisely for this.

^[1] OpenAI paper “Why Language Models Hallucinate”, 2025 — on the reliability of AI in anchored tasks.