How it works
Built like infrastructure, not a chatbot.
For the technically curious: here’s the architecture underneath PetroBrain — where it runs, how it grounds its answers, where the numbers actually come from, and the hard boundaries it operates within.
The two-tier model
Knowledge in the cloud. Your operations behind your firewall.
PetroBrain splits cleanly in two. General knowledge and public data live in the cloud tier. Everything proprietary — your documents, your historian, your operational data, and the calculation engine — stays on-prem, inside your tenant, behind your OT firewall. Only scoped context and cited answers cross the boundary, and nothing crosses back as control.
Cloud knowledge tier
The reasoning layer, general engineering knowledge, and license-clean public and market data. This is the part that scales and improves — without ever holding your operational data.
On-prem operational tier
Your document index, a read-only historian replica, the calculation engine, and your operational data — all inside your boundary. Read-only into OT, with no path to actuate anything.
Grounding & calculation
Answers grounded in your documents. Numbers from an engine, not a guess.
Grounded in your own documents
PetroBrain retrieves from your actual SOPs, P&IDs, well files and reports, then answers from what it found — and cites it. It isn’t recalling the internet; it’s reading your controlling documents, so the answer reflects your plant, not a generic one.
The model never does the math
Language models are good at language and unreliable at arithmetic. So PetroBrain doesn’t let the model compute. It selects the method; a separate deterministic engine produces the number. Same inputs, same answer, every time — and checkable.
Model selects the method
The reasoning layer picks the right formula or procedure and explains why — grounded in your documents and the relevant standard.
Engine computes the number
The deterministic calculation engine does the arithmetic. The language model never produces the figure itself.
Answer returns with its sources
You get the result, the working, and a citation to the document or standard it came from — ready to verify.
model: select method → engine: compute( inputs ) → answer: result + citationSafety posture
A human is always in the loop — by design, not by policy.
The architecture assumes a person makes the call. That assumption is built into how answers are framed and what the system is allowed to do.
It proposes; you dispose
PetroBrain surfaces the reasoning and the recommendation. The decision — and the accountability — stay with the competent person.
Safety-critical = explicit verify
Anything that touches safety carries an instruction to confirm against the controlling document and a qualified person before acting.
Traceable by design
Every answer is reconstructable: the sources it used and the figures it cited, so a reviewer can audit the path, not just the conclusion.
The boundaries
Says no on purposeWhat PetroBrain does not do.
The limits are the point. A system you can trust in a control room is defined as much by what it refuses to do as by what it can.
Never actuates equipment
There is no control path from PetroBrain into your OT. It reads a historian replica; it cannot write a setpoint, open a valve, or move a single piece of plant.
Never auto-sends or auto-files
It drafts; it does not dispatch. No report is submitted, no message is sent, and no action is taken on your behalf without a person choosing to do it.
Never answers outside the domain
It’s domain-locked to oil & gas. Ask it something off-topic and it declines, rather than guessing in a field where a confident wrong answer is dangerous.
Never invents the math
Numbers come from the deterministic engine, not the model. If it can’t compute or source a figure, it tells you — it doesn’t fabricate one.
See the architecture in action.
We’ll walk your engineering and IT teams through exactly how it grounds, computes, and stays inside the lines — on your stack.