![\"LLM](\"https://wiki.aspotomasyon.com/assets/diagrams/llm-rag-industrial-documentation-safe-deployment.svg\")
A plant documentation assistant is safe only when it cites controlled revisions, respects source permissions, and stays read-only and advisory, which a fixed test set must prove.
Maintenance and operations teams often need to find the right procedure, the right revision, and the history of a recurring fault in the middle of a shift. A retrieval-augmented generation (RAG) assistant can answer those questions in plain language. It retrieves passages from controlled documents and asks a language model to draft an answer from them. The benefit is speed. The risk is an answer that sounds correct, cites nothing, or relies on a superseded procedure.
This article describes how to deploy such an assistant for plant documentation. It covers the document corpus, permissions, citation rules, evaluation, human review, logging, and the security risks that arise when a language model reads text it does not control. It assumes the assistant is advisory only and has no write path to control systems. For the wider set of use cases, see AI and machine learning in manufacturing.
A RAG system has three steps. It converts a question into a search over an index of document passages. It returns the most relevant passages together with their source identifiers. Then a language model writes an answer limited to those passages. The model does not learn your plant from the question. The answer is only as good as the passages it receives, so the retrieval step decides most of the outcome.
Retrieval keeps answers current because the index can be rebuilt when a controlled document changes. It does not guarantee correctness. A passage can be retrieved and still be the wrong revision, a draft, or a fragment without its context. For that reason the design puts most of its effort into the corpus, the permissions, and the answer contract rather than into the choice of model.
Index only documents the site controls. A document is eligible when it has an owner, a revision, an effective date, and a status such as approved or superseded. Drafts, personal copies, and scanned pages with poor text recognition cause most early errors. Keep superseded revisions out of the answer index, or mark them so the assistant can decline to rely on them.
| Document type | Common failure | Metadata required before indexing |
|---|---|---|
| Standard operating procedure | An old revision answers the question | Document number, revision, effective date, approver, superseded flag |
| Equipment manual | A manual for a different model or variant | Equipment tag or model, manual revision, language |
| Maintenance work order history | Free text with abbreviations and no context | Asset tag, work order date, failure code, closure status |
| Piping and instrument diagram | An image with no reliable machine-readable text | Drawing number, revision, tag list, extracted text checked by a person |
| Engineering change record | The change is not linked to the document it changed | Change number, affected document IDs, approval date |
The assistant must never show a passage that the requesting user could not open in the source system. Carry permission labels from the document management system into the index, and filter retrieval by the identity of the user who asks. A filter applied only to the displayed answer is not enough, because the model may already have used restricted text to write the answer. Refresh permissions when source permissions change, not only on a fixed schedule. Name an owner for each permission label, following the approach in manufacturing data governance.
Hallucination means generating content that the sources do not support. The OWASP Top 10 for LLM Applications lists misinformation as a core risk. The NIST AI Risk Management Framework (AI RMF 1.0) offers a useful vocabulary for these controls. NIST notes on its page that the framework is being revised, so check the current version before you cite it. The control itself is an answer contract. Every factual statement cites a document number, revision, and section. When no retrieved passage supports an answer, the assistant says so and returns the closest sources for a person to check, rather than guessing.
The assistant should answer questions, point to sources, and draft text for a person to review. It must not hold credentials or a network path that lets it change set points, modes, alarm limits, interlock settings, or work orders in any system that drives a process. Actions of that kind go through the site's management-of-change and authorization procedures. OWASP lists excessive agency, meaning more permission or autonomy than a task needs, as a separate risk, so restrict the assistant's tools to read operations and keep it off the control network.
Bypass, override, and safety-function decisions are outside the assistant's scope. Design, validation, and bypass decisions for safety functions belong with qualified functional-safety engineers working to the applicable standard. A language model must not be the basis for those decisions.
Retrieved passages and work order text are untrusted input. Any document or note can contain text that attempts to override the assistant's instructions. OWASP lists prompt injection first among its risks for LLM applications, and sensitive information disclosure as another. Defensive measures include keeping system instructions separate from retrieved text, keeping secrets out of prompts, filtering output for restricted identifiers, and treating every procedure the assistant describes as draft text until a person verifies it against the source.
Log each interaction for audit: the user, time, query, retrieved document IDs and revisions, the answer, and reviewer feedback. Apply the site's retention and privacy rules to the logs, because maintenance questions can reveal sensitive process details. The logs also feed the security review described in OT security architecture: defense in depth.
Test each release against the same question set. Each question records the expected source document and revision and an acceptable answer shape. Reviewers score the citation, not only the fluency of the text. A change to the model, the prompt, the document chunking, or the corpus triggers a full rerun. Any answer that will guide physical work needs a qualified person's review before use.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
It can, if the design controls access. Index only documents the user is allowed to open in the source system, use the requesting user's identity for each retrieval, and keep the index in the same security zone as its sources. Test with an account that lacks access, and log every retrieval for audit.
Fine-tuning does not keep a link from each answer to the specific controlled revision, and removing a superseded procedure from a trained model is hard. Retrieval keeps the citation to a document that can be checked. Many teams start with retrieval and consider training only after the corpus and the evaluation set are stable.
Require a citation for every factual statement, and make the assistant refuse when no retrieved passage supports the answer. Score a fixed question set that includes questions the corpus cannot answer, and treat any unsupported answer as a failure. Human review remains necessary for any answer used to perform work.
It should not. Design the assistant as read-only and advisory, with no write path to control, alarm, or safety systems. Any process change goes through the site management-of-change and authorization procedures, and decisions about safety functions belong with qualified functional-safety engineers.
Prompt injection is text that tries to override the instructions given to a language model. It matters for plant documents because any document, work order, or note can contain such text. Keep retrieved text separate from instructions, restrict tool access, and never let retrieved text trigger an action without human approval.
Browse the related technical library or follow an ASP project guide to plan the implementation sequence.
![\"An](\"https://wiki.aspotomasyon.com/assets/diagrams/digital-transformation-context.svg\"){kind=spacer}
Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results.