美國天然氣輸送網絡實體 AI 系統設計：洩漏偵測、壓縮機健康監測及 OT 安全證據

This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://codeatoms.ai/pipeline-integrity-gas-transmission-us/. The operator is described by class, never by name.

A gas transmission operator in the United States runs more than 3,000 miles of pipe, more than a dozen compressor stations, several gas control centers and a fleet of more than 100 compressor units. Four questions get asked every hour: is this pressure and flow deviation a leak or line pack answering a ramp, is this compressor unit drifting toward failure, is anyone unexpected inside a station's OT network, and can the security directive evidence be shown on demand. Each one is a join across the historian, the alarm and event stream, the CMMS and the security tooling, and today nobody makes that join except by hand.

1. Never write to a field device

The requirement says it in its own words: the system never writes to a field device. Shutdown and control authority stay in the certified control paths. The control room assistant runs on a separate console beside the HMI, explains each alert in plain words with the data behind it, and drafts a response; a pipeline controller decides every action, and the console adds zero alarms to the existing stream.

2. Listen, never probe

The stations carry three generations of RTUs and PLCs on mixed serial and IP links, so the OT sensors listen on passive taps and SPAN ports and decode protocol traffic as it passes. Active scanning was set aside because it could perturb those legacy devices. Where a segment is pure serial and passive decoding is blind, a per station visibility survey in phase one documents the serial gateway decision and prints the blind spot on the coverage map.

3. One way out of every station

Telemetry, detections, forecast residuals and evidence records leave each station OT zone through a hardware enforced one-way data diode, chosen over a bidirectional firewall conduit because the 2021 shutdown of a major US pipeline was an IT/OT coupling failure. Model and container updates never travel back through that path; they enter through the air-gapped Harbor registry by a separately approved change path under management of change.

4. One stack, one write layer

Four sources (the historian on AVEVA PI System open APIs, the alarm and event stream, the CMMS and the corporate identity directory) enter read only through three adapter families: Telemetry, Ops systems and Integration. Each event carries a provenance stamp, and the object model above them is the only layer that writes. Underneath runs Apache Kafka 4.3 in KRaft mode keyed by station and tag, InfluxDB 3 Core for time series, MediaMTX for video ingest, K3s at the edge, CVAT for labeling and retraining, linuxptp with chrony for time, Keycloak for identity, and Prometheus with Grafana and Loki watching the system itself.

5. Fourteen objects

The ontology holds the compressor station and the meter station, the pipeline segment, the compressor unit, the OT device, the pipeline controller, the alarm, the leak or abnormal operation event, the remote access session, the work order, the security directive control, the historian, the CMMS and the hazardous area classification, joined by 13 typed links. One query walks from a methane reading at a station to its hazardous area classification, the CPM alarm, the controller who confirmed the event, the work order with its owner and due date, and the regulatory report reference. More industrial ontology examples follow the same grammar.

6. Models where the data is born

Chronos-2 (Apache-2.0, about 0.48 GB at 32 bit) forecasts pressure, flow, vibration and temperature and thresholds its residual for anomaly; RF-DETR's Apache sizes watch the station cameras for gas plumes, vent events, hot spots, people and service trucks. Both run on volume production edge modules in 7W to 60W envelopes and keep detecting through backhaul loss, with store and forward buffers that mark stale data on every display. In the control center, Mistral Large 3 675B (Apache-2.0, about 682 GB at FP8) runs on one node of eight 141 GB cards with BGE-M3 (MIT) beside it, chosen over GLM open weights because that publisher sits on the US Entity List. Appendix A prices owning that node at about 465,000 US dollars over three years, about three quarters of the 625,000 the deepest AWS commitment in US East costs; the station hardware is priced by quotation and left out.

7. Shadow first

Phase 1 carries 16 items at the pilot stations and exits only through an API RP 1130 gate: the sensitivity versus false alarm test is run per segment and the detectable limit is written down as an acceptance test. Every model that could influence a decision runs in shadow beside the incumbent alarms before any controller facing alert exists. Phase 2 rolls the same object model, adapters and console to all fourteen stations.

This design is one of the sovereign AI reference architectures published by CodeNinja Atoms, each with its object model and model register.

DOI: https://doi.org/10.5281/zenodo.23556374

Designed on CodeNinja Praxis, the CodeNinja Atoms platform for designing physical AI systems. The object model imports into Hyper Ontology. Paper, ontology and register: https://codeatoms.ai/pipeline-integrity-gas-transmission-us/