Skip to content

Industrial technology

← All analysis

Sector · AI · 28 Jul 2026

Model card REJECTED: soft sensor CV-17 never cleared the plant gate

Training windows, leakage, and override authority decide whether a soft sensor is a measurement or a rumor—industrial AI model card, not unsupervised drift essays, not semantic catalogs, not write-path red-teams.

Model card REJECTED: soft sensor CV-17 never cleared the plant gate

MODEL CARD — CV-17 Soft Sensor (Composition proxy)

Status: REJECTED for closed-loop use
Site: continuous unit (anonymized)
Review board: process · reliability · data · OT security

This page is the card. Not a pitch deck.

1. Intended use (claimed)

Infer composition CV-17 between lab samples to trim a setpoint.
Human-on-the-loop promised. Code path allowed writes.

2. Training data

| Field | Claim | Audit | | --- | --- | --- | | Window | 18 months | Included 6 weeks of bad analyzer | | Labels | Lab GC | Lab lagged 14–36 h; backfilled loosely | | Sampling | 1 min | Historian compression present (see H-19 lessons) | | Leakage | None claimed | Setpoint in feature list — leakage |

Reject reason R1: target leakage via controller setpoint feature.

3. Metrics (offline)

R² looked excellent. It always does when the model smells the setpoint.

Holdout without setpoint feature: collapse.
Reject reason R2: vanity metrics.

Model card printout stamped REJECTED in red

A high R² with leakage is a confession, not a credential.

4. Operating envelope

Not stated for grade changes, startup, or analyzer cal.
Reject reason R3: no envelope → no plant gate.

5. Monitoring & fallback

No residual monitor vs lab. No automatic disable on lab disagreement.
Reject reason R4: unmonitored soft sensors become silent operators.

6. Authority

Proposed: model may nudge PID within ±2%.
Safety review: ±2% continuous can walk past intent (see write-path F-01 pattern).
Reject reason R5: write authority without gated clamps + ack.

7. Allowed residual use (conditional)

Advisory trend only, watermarked, no OPC write, after:

  • Setpoint removed from features
  • Compression-aware training export
  • Envelope + lab residual monitor
  • New card review

Until then: REJECTED.

Soft sensor advisory plot marked read-only on an operator screen

Read-only is a status. Closed-loop is a privilege.

Adjacent fences

Unsupervised drift owns unlabeled hypotheses. Semantic catalogs own meaning. Write-path red-teams own dangerous actuation classes. Soft-sensor closed-loop essays own successful patterns—this card owns a failure to clear the gate. Do not promote a leaked R².

Sign-off

Process ____ Data ____ OT ____ Reliability ____

All four required for any future resubmission. Verbal “it looks good” is not a signature.

More in this sector