How PRISM uses AI
Read this first
- Fixed rules calculate the risk score. The AI does not.
- The AI runs only when you press "Explain this reading", and only for Elevated or High scores.
- The AI writes a likely cause and a drafted work order. A qualified technician decides what to do.
- If the AI is slow, off or wrong in format, PRISM shows a built-in explanation written by the checks.
- Every sensor reading is simulated. PRISM is a student demo and is not ready for real equipment.
Safety. PRISM supports a qualified technician and does not replace an inspection. Stop the machine and call a qualified maintenance professional for any safety concern.
1. Where AI is used and where it is not
| Part of PRISM | Uses AI? | Detail |
|---|---|---|
| Risk score and band | No | Six rule-based checks. The score is the highest of the six. Limits live in config/prism.php. |
| "Why this score" text | No | Fixed sentence templates written by the checks. |
| Likely cause | Yes, on request | Call 1 in app/Services/Ai/Diagnoser.php. |
| Drafted work order | Yes, on request | Call 2 in app/Services/Ai/WorkOrderStep.php. Code sets the priority from the band. The model does not. |
| Override log | No | Records who kept a machine running after a stop warning, when and why. |
2. What the AI receives
- Sent: the score, the band, the drivers scored at 40 or above, the fact sentences the checks already wrote, and derived metrics. Call 2 also receives the diagnosis from call 1.
- Never sent: text typed by a visitor, names, IP addresses, the scoring rules, or the reading history. The server rebuilds the reading from the scenario and reading number.
- Provider and model: Anthropic's API. The model name is set by the
ANTHROPIC_MODELproperty. The default inconfig/services.phpisclaude-haiku-5-5. - Limits: each call has an 8 second timeout and is not retried. The page shows the token counts the API reports.
Sources: README.md section "AI steps", Privacy Policy section 9.
3. Human oversight
- Every AI answer carries an "AI-GENERATED" label and a reminder that a technician decides. When PRISM shows its built-in explanation instead, the label reads "RULE-BASED, NO AI USED".
- The AI cannot change the score, the band or the action. Those come from the rules.
- PRISM has no tool to act on a machine. It sends no alerts and changes nothing outside its own page.
- When PRISM says to stop and an operator keeps running, the override log records a name, a reason and the time. Someone with the password reviews the log.
- You can rate an AI answer "Helpful" or "Wrong". PRISM stores the rating, the step, the source, the scenario, the reading number and the time. It stores no name, no text and no IP address in that row.
4. Limits and how well the checks work
The four checks built on AI4I limits (tool wear, heat, power and overstrain) were tested on the 10,000 AI4I records. 18 random-failure records were left out. Reproduce the figures with php artisan prism:backtest.
| Band | Records | Failed | Share failed |
|---|---|---|---|
| Low | 7,448 | 6 | 0.1% |
| Elevated | 1,889 | 42 | 2.2% |
| High | 645 | 291 | 45.1% |
- The limits come from AI4I and the test runs on AI4I. The test shows the rules agree with the dataset labels. It does not show how they perform on a real machine.
- AI4I is synthetic data. It was generated to mirror real milling data.
- 354 of the 645 High records did not fail. Some High scores are false alarms.
- 9 of the 339 labeled failures have no failure mode flagged in the dataset. No check can explain a failure with no recorded cause.
- Random failure cannot be predicted from any reading. PRISM does not score it.
- AI4I has no vibration or run-hours column. Those two checks are simulated and are not backtested.
- The AI can be wrong. It sees the score and the fact sentences, not the machine.
Source: README.md section "How the score works".
5. Data, privacy and fairness
- PRISM scores machines. It scores no person and builds no profile of any person.
- The readings are simulated, so PRISM holds no real operational data.
- The only personal data is the name an operator types in the override log. PRISM does not verify it.
- PRISM uses no analytics, advertising or tracking scripts.
- Rate limits protect the AI routes from automated use.
Source: Privacy Policy.
6. PRISM mapped to the NIST AI Risk Management Framework
NIST names four core functions: Govern, Map, Measure and Manage. This table is PRISM's own mapping. NIST has not reviewed or certified PRISM.
| Function | What PRISM does |
|---|---|
| Govern | A named owner (James Moore). Terms, Privacy Policy and FAQ. A password on the override log. Rate limits on the AI routes. |
| Map | A defined scope: one simulated milling machine and a maintenance technician as the user. Known limits listed in section 4. |
| Measure | A repeatable backtest. Automated tests in tests/. Token counts shown on each AI answer. Helpful and Wrong ratings. |
| Manage | A built-in fallback when the AI fails. Code sets the priority. The AI cannot change the score. An override log. Unbuilt features listed as not built. |
Source: NIST AI Risk Management Framework, released January 26, 2023.
7. Fields PRISM draws on
| Field | How PRISM uses it | Source |
|---|---|---|
| Data science | Limits and the backtest come from the AI4I 2020 dataset. | Matzka, S. (2020). AI4I 2020 Predictive Maintenance Dataset. UCI Machine Learning Repository. |
| Mechanical and reliability engineering | Vibration limits (1.4, 2.8 and 4.5 mm/s RMS) are the ISO 10816-3 Group 2 zone boundaries. | ISO 10816-3, cited in config/prism.php |
| Occupational safety | The "Stop the machine" instruction sits beside lockout/tagout practice. PRISM does not lock out or tag out anything. A qualified person follows the plant's procedure. | OSHA 29 CFR 1910.147, Control of Hazardous Energy |
| Human factors and ethics | The score is one number with a plain reason. A person makes the call, and a keep-running choice leaves a record. | Design choices in this app |
| Law and privacy | Terms, Privacy Policy and an AI disclosure. | Terms, Privacy |
8. Accessibility
The goal is WCAG 2.2 Level AA. PRISM has not had an independent audit, and this page does not claim conformance. On October 20, 2026, Lighthouse gave the live pages the author tested, including the dashboard and this page, an accessibility score of 100 in desktop and mobile modes and in both the light and dark themes. The same day, the author walked the dashboard with VoiceOver on macOS and with the keyboard only, in Chrome, and found no issues.
Built in today:
- A skip link and a main landmark on every page.
- A visible focus outline on every control.
- Risk bands shown in words (Low, Elevated, High), not by color alone.
- Each stress bar is a labeled meter with a value and a band, for screen readers.
- The risk chart has a text description and a "View the chart data as a table" control.
- Band changes are announced through a status region. A High score is announced as an alert.
- Pop-ups use the native dialog element, return focus when closed, and close with the Escape key.
- Light and dark themes. PRISM follows your system setting, and a switch in the header overrides it. Your choice is saved in your browser.
- Animations stop when your system asks for reduced motion.
- Pause control for the simulated feed.
- Layouts fit narrow phone screens. At 200% and 400% browser zoom the layout reflows, and the two pop-ups scroll up and down inside the window.
Known gaps:
- The Lighthouse scores are the author's own runs, not an independent audit. The light theme's contrast ratios were calculated (see docs/BRAND.md).
- No independent audit and no test with people who use assistive technology. Only VoiceOver on macOS was tried. Lighthouse checks only a subset of issues.
To report a barrier, write to moorejp@cua.edu.