You want AI in the pyrophoric catalyst plant — without compromising the SIL or opening the OT to the outside.

The problem

A pyrophoric catalyst is unforgiving — but modern AI cannot be ignored either.

In hydrotreating, isomerization and certain polymerizations, the catalyst in its active state reacts violently with air or moisture. The plant's HAZOP has already identified the critical safety functions, and the SIS, independent of the BPCS, upholds SIL-2 or SIL-3 under IEC 61511. The operation works — and at the same time, two pressures are not going away:

1. The operations manager wants to anticipate the moment of leaving the envelope before the SIS has to close the loop. Every SIS activation means a shutdown of neighboring processes, a slow recovery, and a mark on the record.
2. Management and the CAIO want AI in the plant — but the safety manager and the IT manager raise their hands: “nothing enters the OT network”. And they are right. The Log4j-type vulnerability hit corporate ERPs — it did not hit OT networks, precisely because they were isolated.

The classic false dilemma: either you lock the plant away from AI and lose the anticipation, or you open a crack and one day an AI-equipped attacker finds the zero-day and compromises the SIS. Both options are bad. The good one is not choosing between them — it is separating layers.

How it fits the IRIS system

Three rings: the AI on the outside, the SIS on the inside, the person signs what crosses.

The three-ring architecture is not an invention — it is the formalization of something serious industry always did: isolate the OT network from the outside at all costs. What iLEAN adds is a layer that lets you harness the power of AI without giving up that isolation, raising it to the level today's threats demand.

SIS and safety PLC in ring 1, no internet, no inbound connections. Powerful AI in ring 3. Human validation on whatever crosses into ring 1.

The three layers, applied to a plant with pyrophoric catalyst:

• Ring 1 (inner, sacred) — the OT. This is home to the SIS, the safety PLC, the BPCS, proprietary drivers, the primary database. It has no outbound internet. It accepts no inbound connections. Only a minimal agent reads from a passive mailbox what ring 2 has deposited there, signed and validated. The SIS remains the last guardian — its SIL certification is untouched.
• Ring 2 (middle) — the validation chamber. A pool of agents with limited autonomy verifies, does not create: does the ring 3 proposal square with the plant rules? Did the operator sign it? Is the JSON's cryptographic signature valid? Once validated, it packages and deposits into ring 1's mailbox.
• Ring 3 (outer) — the power. iLEAN Edge at the beds, Connect capturing thermocouple readings, differential pressure, hydrogen and nitrogen flow. Agents that cross-reference the history, the catalyst loading conditions and the turnaround curve to anticipate the deviation 20-30 minutes earlier. Here the AI operates with maximum autonomy — because whatever leaves this ring passes through ring 2 and through the person.

See the full IRIS architecture →

Before and after

Classic isolated SIS vs. SIS with iLEAN's three rings on top

Aspect	Classic isolated SIS	iLEAN's three rings
OT isolation	Rigid air gap — AI stays out	Air gap preserved — AI operates in ring 3
Deviation anticipation	Operator with panels and experience	Agents that cross-reference history and propose 20-30 min earlier
Transport between layers	n/a — there are no layers	Signed file drop, one asymmetric key per plant
Who closes the critical loop	SIS + operator with signature	SIS + operator with signature — unchanged
Traceability of AI proposals	n/a	Every proposal signed, archived, reviewable by an auditor
Compliance	IEC 61511, IEC 62443	Same + AI Act (human oversight in high risk)

Impact estimate

Impact estimate for your plant — to be validated with your numbers.

The block below is an estimate to be validated with the specific data of your plant. We put it forward so the committee has an order of magnitude; we refine it during the diagnostic.

• Chemical plant with pyrophoric catalyst in hydrotreating or isomerization, SIL-2/3 certified SIS, HAZOP/LOPA up to date.
• Three-ring deployment on top of the existing architecture. First value expected within a few weeks: the first documented deviation anticipated, without touching the SIS.
• Expected reduction in SIS activations through anticipated deviations ≥ 30%, with a defensible floor in annual plant hours recovered.
• Indicative payback between 4 and 9 months, depending on the frequency of unplanned shutdowns, the catalyst recovery cost and the opportunity cost of the affected line.
• The hard lever is a single catastrophic shutdown avoided and the consolidated traceability that passes the next Seveso audit without hiring an outside consultant.

And the safety manager's reasonable doubt

“What if a ring 3 agent hallucinates and proposes a dangerous maneuver?” — hallucination is a problem of free generation, not of anchored tasks. The ring 3 proposal is anchored to real plant readings, and before crossing into ring 1 it is validated by ring 2 against plant rules and signed by a person. In anchored tasks, the best models brought error below 1.5% ^[1]. And even so, what is critical is never decided alone: the SIS remains the last guardian, and the operator signs. The three rings are built precisely for this defense-in-depth architecture.

^[1] OpenAI paper “Why Language Models Hallucinate”, 2025 — on the reliability of AI in anchored tasks.