Case file LS-4
Asset: Filter skid F-220, annual cartridge change
Permit type: Electronic LOTO / confined-space adjacent
Trigger: Planner asked the on-prem maintenance assistant to “summarize isolation steps for the craft brief” from the approved isolation plan PDF
Outcome: Two bleed valves omitted from the craft card; residual pressure found at crack-open; stop-work called; no injury
This is not CMMS prompt injection into tool calls, not HITL timeout auto-approve, not MES free-text hygiene, and not the electronic permit platform overview. It is generative compression of isolation truth—summaries that sound professional while dropping energy-control steps.
What the assistant did
The source plan listed primary block valves, bleeds, lock points, and verification order. The model returned a shorter “field-friendly” list: major blocks, one drain, PPE reminder, “verify zero energy.” The bleed pair on the secondary header—required because the primary path alone left a trapped volume—never appeared. A craft lead who trusted the brief more than the binder almost became the verification method.
Failure modes that repeat
Length bias. Models trained to be helpful compress lists. Isolation plans are not blog outlines; every tagged point is load-bearing.
Synonym collapse. “Isolate feed” can silently merge two valves into one phrase when the P&ID requires both.
Verification erasure. “Prove zero energy” without naming gauges, crack-open points, and expected readings is a slogan, not a step.
Authority confusion. A chat answer sitting next to an ePTW ID looks official. Without a hash or step-count gate against the controlled plan, it is fan fiction with good grammar.
Controls that belong in the workflow
- Forbid free-form summarization as the craft document of record. Allow AI only to retrieve and display the controlled isolation plan version—or to diff a draft against it.
- Hard gate: craft card step count and lock IDs must match the approved plan; mismatch blocks permit issue.
- Require named verification points (gauge IDs, bleed tags) in any generated text; strip generic “verify zero energy” closers.
- Log prompt, source document revision, and output hash next to the permit—same as a procedure MoC trail.
- Dual human check when AI touched isolation language: planner + area authority, not “one person and a confident paragraph.”
Why plants still reach for it
Isolation PDFs are long. Shifts are short. Assistants that “make it readable” feel like safety culture. They are only culture if the readable version is complete. A shorter list that omits a bleed is not simplification. It is a new energy source drawn in invisible ink.
Electronic permit-to-work systems own workflow state and signatures. Interlock bypass audits own temporary that became infrastructure. Maintenance copilots that draft RCA hypotheses still need engineer proof. This case owns LLM summarization as a hazard when the subject is isolation.
Do not let the assistant close the permit narrative. Let it fetch the plan you already approved—and refuse to make that plan shorter than the valves that keep people alive.