Incident Investigation Workstation
Multi-Evidence Investigation
Recovery Window Search

L5 — TripLens

Follow the evidence. Change the outcome.

Why L5?

L5 stands for Listen · Link · Locate · Limit · Learn.

These five principles represent our vision for an intelligent industrial incident response system:

Listen — Detect what is happening. Continuously interpret process signals, controller behavior, sensor readings, and alarm events to recognize emerging abnormalities.
Link — Connect the evidence. Reconstruct relationships between signals, equipment, control loops, and process topology to distinguish meaningful causal patterns from alarm noise.
Locate — Find the initiating failure. Investigate competing hypotheses, identify contradictory evidence, and trace downstream symptoms back toward their likely root causes.
Limit — Contain the consequences. Explore physics-based counterfactual interventions, calculate recovery windows, and identify actions that could prevent an incident from escalating.
Learn — Improve from every incident. Preserve investigation records, compare historical cases, and turn previous failures into reusable operational knowledge.

Together, these five stages transform industrial incident analysis from passive monitoring into evidence-driven decision support.

L5 is the overarching concept; TripLens is its working demonstration.

The name does not refer to Level 5 autonomous control. Our objective is to develop an intelligent investigation layer above existing PLC, DCS, and SCADA systems, where numerical calculations and physical constraints remain independently verifiable.

Inspiration

Industrial incidents rarely begin with a clear explanation. A single equipment malfunction can propagate through interconnected process units, control loops, and sensors, producing hundreds of alarms in a short period of time.

Operators must distinguish root causes from downstream symptoms, identify unreliable measurements, and decide which interventions can still prevent an incident from escalating.

We built TripLens to explore a different approach: instead of merely summarizing alarms, an incident investigation system should reconstruct causal evidence, test competing hypotheses, and calculate how different interventions could change the outcome.

What it does

TripLens is an interactive industrial incident investigation and decision-support workstation.

Its implementation follows the L5 philosophy through a six-stage operational workflow: Detect → Compress → Investigate → Verify → Intervene → Learn.

The current prototype includes:

Multi-incident investigation: 12 simulated fault families, 18 observation channels, and 14 process, energy, control, and feedback connections.
Evidence-driven diagnosis: Competing fault hypotheses are ranked using supporting evidence, contradictory observations, and sensor reliability checks.
Alarm flood compression: Repeated alarms, condition changes, and process groups are separated to reduce information overload.
Counterfactual intervention search: The system evaluates 1,547 intervention branches per incident, including cooling bypasses, feed reduction, backup pumps, and controlled shutdowns.
Recovery-window analysis: Operators can explore how starting the same intervention at different times changes the simulated outcome.
Transparent investigation: Structured tool inputs, numerical results, and evidence behind diagnostic decisions can be inspected.
Incident memory: Completed investigations, operator notes, and historical similarities can be retained locally.
Report generation: Structured root-cause analysis dossiers can be exported as Markdown or JSON.

How we built it

TripLens combines a React and TypeScript frontend with a deterministic Python simulation and investigation engine.

The simulation models interconnected thermal, hydraulic, actuator, and feedback dynamics, including controller limitations, transport delays, equipment degradation, and sensor faults.

The investigation engine analyzes observations without accessing the simulator's hidden fault labels. It evaluates competing explanations and fits candidate models before running counterfactual interventions.

The interface visualizes evidence propagation, incident timelines, alarm histories, controller behavior, and intervention outcomes.

A structured investigation API exposes allowlisted diagnostic tools, while a separate model-compatible adapter provides an integration point for external language-model inference.

Current integration status: The working prototype uses a local deterministic investigation policy. Runtime integration with NVIDIA Nemotron through Nebius Token Factory has not yet been completed.

Challenges we ran into

One major challenge was ensuring that the investigation system did not accidentally use information that would be unavailable to an actual operator.

We separated hidden simulation truth from observed evidence and recomputed diagnostic snapshots using only the observations available at each point in time.

Another challenge was distinguishing genuine physical changes from faulty instrumentation. A pressure transmitter reporting an unsafe value does not necessarily mean that physical pressure has crossed a safety threshold.

We also wanted counterfactual recommendations to be supported by reproducible numerical calculations rather than plausible-looking text.

Accomplishments

The current prototype demonstrates a complete simulated incident investigation workflow.

In one cooling-valve scenario, 312 alarm events are reduced to six conditions and three process groups.

The intervention engine identifies a latest safe simulated cooling-bypass start of +101 seconds, demonstrating how a narrow response window can be represented explicitly.

Internal regression checks cover 36 simulated fault variants and three normal windows. These checks verify behavior within the project's own simulator and are not presented as independent industrial accuracy measurements.

The system also supports CSV replay, structured investigation audits, incident history, and reproducible report exports.

What we learned

The central lesson is that explainability in industrial incident response requires more than a natural-language explanation.

Useful explanations must connect observed signals, competing hypotheses, process topology, controller behavior, and reproducible calculations.

We also found that the timing of an intervention can matter as much as the intervention itself.

The L5 framework helped us organize these capabilities around a coherent objective: listening to the system, linking the evidence, locating the cause, limiting the damage, and learning from the result.

What's next

Our next technical priority is completing and validating NVIDIA Nemotron inference through Nebius Token Factory, using the existing structured tool interface.

Further development includes independent benchmark evaluation, OPC UA and MQTT integrations, broader operating conditions, more complex simultaneous faults, and deployment testing.

Our longer-term vision is to make L5 a reusable investigation architecture for cyber-physical systems, with TripLens as its first industrial application.

TripLens is currently a research and demonstration prototype. Its simulated recovery windows are not guarantees of real-world plant safety, and it does not autonomously operate industrial equipment.

GitHub: https://github.com/dongxuelian2/L5