Bot-written shift reports and alarm summaries, offline

1. Export, don't connect

Export the last 12 hours of the historian (CSV) and the alarm journal from the historian replica in the DMZ. The bot reads files; it doesn't need a live connection at all.

2. Trim the data first

Local models have limited context. Pre-aggregate with a script: min/max/mean per tag per hour, plus every alarm event. Let code do the math; let the model do the words.

import pandas as pd
df = pd.read_csv("hist.csv", parse_dates=["ts"])
agg = df.groupby(["tag", pd.Grouper(key="ts", freq="1h")])["value"].agg(["min","max","mean"]).round(2)
agg.to_csv("hourly.csv")

3. Use a fixed report template

Same headings every shift makes errors easy to spot:

Write the shift handover from hourly.csv and alarms.csv.
Sections: 1) Safety/environmental events 2) Alarms by count, top 5, with tags
3) Equipment out of normal range 4) Open items for next shift.
Rules: cite tag + time for every fact. No speculation about causes unless labeled "possible".
If data is missing for a period, say so.

Send it to the local server from lesson 2 with a short Python or curl call.

4. A person reviews and signs

The outgoing supervisor edits and signs. The signed version is the record; the raw bot draft is kept in the audit log for comparison.

5. Measure it

For a month, have supervisors mark each bot draft: correct / minor fix / wrong. If "wrong" isn't near zero, fix the data pipeline or the prompt before relying on it.

Where these facts come from

• ISA/IEC 62443 series: zones, conduits and security levels for industrial automation
• NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) security
• CISA: Industrial Control Systems: advisories and recommended practices
• Modbus Organization specifications: function codes and the TCP transport
• OPC Foundation: OPC UA specifications and security modes
• llama.cpp on GitHub: building and running local GGUF models on Linux

Checked Oct 29, 2026. Tutorials are educational. Follow your site's safety procedures, management-of-change process and the equipment maker's manual. Never test against live production equipment without authorization.