TEP Copilot: reasoning, not reciting

In a plant upset, operators drown in alarms: at Milford Haven in 1994, two operators faced 275 alarms in under 11 minutes. Plants now want AI copilots in that room, but an AI that sounds right and is wrong is one more alarm. TEP Copilot turns an alarm flood into one root-cause card the operator can check. Statistics detect the fault (PCA T²); Gemma-4-31B-IT on AMD Token Factory proposes three ranked causes with sensor evidence; a deterministic gate strikes every claim the data does not support and flags control verbs; a human approves. The model has no write access to the process. After approval, an Evolus agent with a Knowledge Library drafts the work order and shift handover, and an Evolus AI Tool translates it. Does it reason or recite? TEP has been public since 1993, so we tested it as an experiment: 2 public datasets, 2 models, 3 disguise levels, thinking off/on, k=5 samples, comparisons within each fault. - A disguised twin renames every tag and unit: Gemma top-1 stays at 45/100 on the original plant and 44/100 fully disguised. - Two models: Qwen3.8-27B names the top cause more often, but the gate rejects more of its evidence (31% vs 22%, 9 of 12 faults). - Thinking on raises the evidence the gate rejects from 22% to 36% (9 of 12 faults). - The card arrives before the alarm flood in 4 of 4 flooding faults. - FaultExplainer protocol: Gemma 8/11, between GPT-4o (7/11) and o1-preview (9/11). For refinery and chemical-plant control rooms; estimated inference cost $0.00015 per incident. Every result is recomputed by a script from pinned runs; the demo replays them offline.