Talk to us
Incident Triage AgentNeIO Vertical Agent
NeIO Incident Triage Agent · by Codvo

From alarm flood to approved first action.

When a critical asset trips, your operators already have the alarms, the live data and the approved procedure, spread across five systems. The agent assembles them into one ranked incident, the right procedure branch and the right person to call. Every step is cited. Nothing is written back to your plant.

See it in action
Site A · Utilities · 03:10:04Listening
Alarms0
Incidents0
Writes to plant0
    CH-02 trip · chilled waterRoot alarm · 61 related alarms grouped · case CHW-02
    P1
    CH-02 trip CHWP-2 low flow Supply temp 9.4 °C AHU-1…4 high temp
    RedundancyStandby CH-03 under maintenance · WO-48812
    Time to consequenceAbout 25 min to hall temperature limit
    BCP-CHW-04 · branch B standby unavailable
    1. Confirm CH-02 trip code on local panel§4.1 p.6
    2. Raise CH-01 setpoint to max load · 78% now§4.2 p.7
    3. Request WO-48812 status from maintenance§4.3 p.7
    4. Start rental chiller connection checklistApp. C
    Escalation matrix rule E-03
    RE
    On-call reliability engineerNotified via Teams and pager · 00:42
    ACK
    Backup: mechanical lead at 10 min · shift handover note drafted
    Advisory only● Read-only · every step cited

    Reads what you already run

    Alarms and eventsHistorian tagsSCADA and DCSBMS and EPMSAsset hierarchyOpen work ordersApproved SOPsBCP checklistsEscalation matricesShift rostersPredictive analytics casesPast incident reports
    NeIO
    agent

    Hands back what your operators use

    Ranked incident queueProcedure checklistsEscalation cardsCited answersShift handover notesIncident reportsAudit logKPI dashboard
    Value for your operators

    Your procedures are approved. Now they arrive with the alarm.

    One chiller trip lights up the historian, the alarm list, the maintenance system and the roster at once. The agent reads them together, so the operator sees one incident instead of 142 alarms.

    01

    One incident, not a flood

    Related alarms are grouped by asset and time, with the probable root alarm on top.

    02

    The right procedure branch

    The approved procedure, and the branch that fits live plant state, standby and open work orders.

    03

    The right person, first time

    Escalation finds the on-shift owner from your matrix and roster at the moment of the alarm.

    04

    Every incident leaves a record

    Each step shown, acknowledged and escalated is logged and becomes the handover note and report.

    See it in action

    One alarm at 03:10. Everything on one panel.

    The agent holds alarms, live values, procedures and the roster as one context. Step through a single incident, from flood to handover.

    NeIO · Incident Triage Agent / Site A utilities (fictional) / Alarm groupingRead-only · 0 writes
    CT-01COOLING TOWERCH-01RUNNING · LEADCH-02TRIPPED 03:10CH-03STANDBYWO-48812 · MAINTCHWP-1CHWP-2CHWP-3AHU-1AHU-2AHU-3AHU-4CHW SUPPLY HEADER · 6.8 °C 9.4 °C
    CH-02Tripped
    CHW supply9.4 °C
    CH-01 load78%
    CH-03Maint
    Flood to incident

    142 alarms, 3 incidents

    Alarms from the last 4 minutes, grouped by asset, process topology and time. The probable root alarm leads each group.

    ■ 61 · CH-02 trip■ 50 · same event, downstream■ 20 · CDA dryer■ 11 · nuisance, shelved
    111
    CH-02 trip · chilled waterRoot: CH-02 compressor fault · 03:10:04
    P1
    20
    CDA dryer D1 dew point driftRoot: D1 regeneration valve · 03:08:51
    P2
    11
    Chattering level alarm CT-01Known nuisance · linked to WO-47930
    P4

    Illustrative interface · site, assets, work orders and procedures are fictional, generated for demonstration

    How it works

    From an alarm to an action you can trust.

    The same five steps run on every incident. Operators only see what needs them.

    01Knowledge packTeach it your plant once

    Load your approved SOPs, BCP checklists, escalation matrix and asset list. The agent proposes incident cases, alarm-to-case mappings and procedure branches, and your subject-matter experts approve them in a sign-off flow. Nothing reaches an operator without an approved source behind it.

    No custom code per siteContent your SMEs own
    02ListenSubscribed at the moment of the alarm

    Read-only connections to alarms, historians, SCADA, DCS and BMS, the asset model, the maintenance system, predictive cases and the roster, over OPC UA, MQTT, Modbus, BACnet or vendor APIs. Every value carries its source and its age, so stale data is flagged rather than used.

    Read-only by designFreshness on every field
    03TriageOne incident, ranked

    Related alarms are grouped by asset, process topology and time, and the probable root alarm is surfaced. Each incident is scored on safety, redundancy left, production impact and time to consequence, then checked against open work orders and active incidents. A pattern that matches no known case is flagged as unrecognised, with the closest past incidents.

    Root alarm on topDuplicates linked
    04RespondProcedure, branch and person

    The agent selects the applicable approved procedure and the branch that fits live plant state. The checklist, live values, citations and escalation contact arrive together on one panel in your operations centre. Follow-up questions are answered only from the approved documents.

    Verbatim stepsCite or decline
    05LearnEvery incident makes the next one faster

    Every presentation, acknowledgement and escalation is logged append-only. Handover notes and incident reports are drafted from that record, operator feedback is captured, and gold-set evaluation catches regressions before they reach a shift.

    Every decision auditedReplayable on demand
    Proof you can check

    Accuracy measured on your own incidents.

    Before go-live, the agent is tested against a gold set built from your incident cases, and it has to clear every gate.

    Acceptance gatesIllustrative layout

    Six gates, on your gold set

    Each gate has a threshold agreed before the pilot starts.

    Case classificationtarget 95%
    Procedure selectiontarget 95%
    Branch resolutiontarget 95%
    Citation fidelitytarget 100%
    Fail-safetarget 100%
    Zero write-backtarget 100%

    Bars show the acceptance thresholds only. Your pilot reports measured values on your own incidents.

    1. Every step cites its sourceClick a citation and the approved procedure opens at that page.
    2. It says "not in the approved procedures"When nothing supports an answer, it declines rather than guessing.
    3. No write path to your plantAdvisory by architecture, not by setting. It never issues a command.Verified independently during acceptance
    4. Stale data is flaggedEvery live value shows its age. A missing value stops the branch instead of being assumed.
    5. Operators stay in commandThe agent assembles. Your people acknowledge, act and escalate.
    Who it's for

    Same agent, different reasons to say yes.

    Operations centres, data-centre teams, process plants and OEM partners each start with the incidents that hurt most.

    Central operations centres

    Utility, facilities and reliability teams running chillers, cooling water, compressed air and power

    Top concerns

    Night-shift coverageBCP complianceEscalation delays

    In a pilotYour top incident cases live on one panel, with procedure branches and escalation from your own matrix.

    Data-centre operators

    Critical-facility and MEP engineers running live halls

    Top concerns

    Cooling and power tripsSLA exposureRunbook drift

    In a pilotCooling and power alarms grouped into incidents, ranked by redundancy left, with your emergency procedures cited step by step.

    Oil, gas and chemicals

    Control-room operators, shift supervisors and process safety teams

    Top concerns

    Alarm floodsUpset responseHandover quality

    In a pilotUpset scenarios on one unit triaged to the right procedure, with a shift handover drafted automatically.

    OEM and platform partners

    Control-system and operations-platform vendors delivering operations-centre programmes

    Top concerns

    Air-gapped deliveryRepeatable onboardingClient-owned content

    In a pilotThe agent embedded in your platform as a panel, under your prime contract, on a single GPU node.

    Capabilities

    Twelve capabilities. One agent.

    Everything it takes to go from an alarm to a cited first action, before, during and after the incident.

    Before · Set up

    01

    Knowledge pack

    Approved SOPs, BCP checklists, escalation matrix and asset list, signed off by your SMEs.

    02

    Proposed mappings

    Incident cases, alarm-to-case mappings and branches proposed for review, not built by hand.

    03

    Connects to what you run

    Major OEM control, historian and maintenance systems over standard industrial protocols, read-only.

    During · Triage and respond

    04

    Flood grouping

    Related alarms grouped into one incident, with the probable root alarm on top.

    05

    Priority ranking

    Scored on safety, redundancy left, production impact and time to consequence.

    06

    Procedure and branch

    The approved procedure and the branch that fits live plant state.

    After · Escalate and answer

    07

    Escalation routing

    The on-shift owner from your matrix and roster, notified on Teams, SMS or pager.

    08

    Cited answers

    Follow-up questions answered from approved documents only, or declined.

    09

    Handover and reports

    Shift handover notes and incident reports drafted from the record.

    Always on · Govern

    10

    Audit trail

    Every step shown, acknowledged and escalated, append-only and replayable.

    11

    Evaluation harness

    Gold-set gates and regression checks before any change goes live.

    12

    Deploy anywhere

    Air-gapped, on-premises, private cloud or containerised, with local models.

    Fits your landscape

    Works with your OEMs. Runs where you need it.

    The agent reads from the major control, historian and maintenance platforms you already run, over standard industrial protocols, and never writes back.

    OPC UAOPC DA / HDAMQTT · Sparkplug BModbus TCPBACnetREST and vendor historian APIsSQL and file dropsTeams · SMS · pagerITSM and CMMS connectors
    Air-gappedFully disconnected

    One on-prem GPU node with local open models. No outbound connection beyond named interfaces.

    On-premisesInside your OT/IT boundary

    Bare metal or virtual machines in your data centre, behind your DMZ.

    ContainerisedKubernetes or OpenShift

    Packaged containers for your existing platform, with signed offline bundles.

    Private cloudYour cloud tenancy

    Multi-site deployments in your own cloud account, under your keys.

    Privacy & security. Runs on NeIO inside your boundary, under NeIO Govern controls: read-only connectors, no write path to any plant system, single sign-on, role-based access, a tamper-evident audit log and locally served models.

    FAQ

    Questions we hear most.

    Does it control or change anything in our plant?

    No. The agent has no write path to any control, plant or enterprise system. It reads, assembles and presents. Your operators decide and act.

    Which systems and protocols does it work with?

    The major OEM control, SCADA, DCS, BMS, historian and maintenance platforms. It connects over standard industrial protocols such as OPC UA, MQTT, Modbus and BACnet, or through vendor APIs, and every connection is read-only. Each new source is accepted against a nine-point interface checklist covering schema, authentication, mapping, event timing and rate limits.

    Does it write new procedures?

    No. It presents only what your teams have approved, quoted word for word with a link to the source. Authoring stays with your subject-matter experts.

    What happens when it is not sure?

    If an alarm pattern matches no known case, it says so and shows the closest past incidents. If live data is missing or stale, it stops at that branch and says why instead of guessing.

    Can it run without internet access?

    Yes. It runs fully air-gapped on a single on-prem GPU node with locally served open models. It can also run on-premises on your own servers, as containers on Kubernetes or OpenShift, or in your private cloud.

    Where do operators see it?

    As a panel inside your existing operations-centre or HMI web screens, as a standalone web app, or as notifications in Teams, SMS or pager.

    How do we start?

    Start with a focused set of your own incidents.

    1. Share. Pick your top 5–10 incident types and send the approved procedures and escalation matrix.
    2. Configure. We load your knowledge pack and connect read-only to your alarms and historian.
    3. Shadow. The agent runs alongside your shift. Your SMEs review its triage and procedures on live and replayed incidents.
    4. Decide. Review the acceptance gates on your own gold set, then agree what to roll out next.
    Let's talk

    See it on your own incidents.

    Bring your top incident types and one procedure set, and we will show you the triage, the branch and the cited steps, in your environment.