Air-Gapped Rig-Edge WITSML Telemetry with Local Small Language Models (SLMs)

A drilling engineer built an air-gapped edge intelligence stack that runs deterministic physics filters and quantized small language models (7B or 3B, via Ollama or llama.cpp) directly on rig-site hardware to triage WITSML/WITS telemetry, avoiding the 600–1200 ms satellite round-trip latency of cloud inference. The two-tier design uses a Rust/Python physics worker for flow-differential and standpipe-pressure checks, then passes a structured JSON context window to a local SLM for sub-second anomaly triage and root-cause classification, with asynchronous delta sync to headquarters only when connectivity allows.

Originally published with interactive math formulas and diagrams at eng.kcklayton.com https://eng.kcklayton.com/blog/rig-edge-witsml-local-slm-telemetry/ Drilling rigs—whether stationed offshore in deepwater or operating across remote onshore basins—share a common operational reality: high-latency, bandwidth-constrained, and intermittent satellite connectivity VSAT . Round-trip satellite pings routinely exceed $600\text{ to }1200\text{ ms}$, with atmospheric attenuation or antenna line-of-sight blockage causing frequent dropouts. When a high-pressure gas influx kick enters the wellbore, or when a bottom-hole assembly BHA experiences catastrophic stick-slip oscillation, seconds count. Routing real-time sensor telemetry to a remote cloud datacenter for LLM inference or anomaly classification introduces unacceptable operational latency and single-point-of-failure exposure. To solve this, our drilling architecture decouples real-time rig surveillance into an Air-Gapped Edge Intelligence Stack running local deterministic filters and quantized Small Language Models SLMs directly on rig-site hardware. Modern drilling rigs generate high-frequency telemetry across dozens of channels via the WITSML Wellsite Information Transfer Standard Markup Language and WITS Wellsite Information Transfer Specification standards: flowchart TD subgraph RigFloor "Rig Floor & PWD Instrumentation" Sensors "Rig Sensors Flow, SPP, Pit, Hookload " PWD "Downhole MWD / PWD Telemetry" end subgraph RigEdge "Edge Server Rig Doghouse / Rig Server Room " WITSMLAgent "WITSML Edge Agent<br/ 1-sec Poller & In-Memory Ring Buffer " MathEngine "Deterministic Physics Filters<br/ Flow In/Out Differential, Pit Rate " LocalSLM "Local SLM Inference Engine<br/ Ollama / llama.cpp - Qwen / Mistral " RigDisplay "Local Rig Doghouse Alarm & HMI" end subgraph RemoteCloud "Corporate Headquarters / Real-Time Operations Center RTOC " CloudMesh "Event-Driven Telemetry Mesh" RemoteDashboard "Engineering Dashboard" end Sensors -- |WITS / WITSML| WITSMLAgent PWD -- |Mud Pulse / EM| WITSMLAgent WITSMLAgent -- MathEngine MathEngine -- |Anomaly Context Window| LocalSLM LocalSLM -- |Sub-second Triage & Root Cause| RigDisplay WITSMLAgent -.- |Async Delta Sync via VSAT When Online | CloudMesh CloudMesh -.- RemoteDashboard Language models should never replace basic physics calculations. Calculating flow differential $\Delta Q = Q {\text{out}} - Q {\text{in}}$ or standpipe pressure derivatives $\frac{dP}{dt}$ requires deterministic arithmetic, not probabilistic token generation. The edge agent runs a two-tier architecture : The witsml-edge-agent https://github.com/Greybeard00007/witsml-edge-agent maintains a rolling in-memory ring buffer defaulting to 300 seconds of 1-second records . A high-speed Rust/Python physics worker evaluates: When Tier 1 triggers an anomaly condition, it compiles a structured JSON context payload capturing the pre-event baseline, trigger metrics, current rig state drilling, tripping, circulating, reaming , and recent downhole events. This payload is dispatched via localhost IPC to ai-gateway-sentinel https://github.com/Greybeard00007/ai-gateway-sentinel , which interfaces directly with an embedded Ollama or llama.cpp instance running a quantized $7\text{B}$ or $3\text{B}$ parameter model e.g., mistral-7b-instruct-q4 K M or qwen2.5-coder-7b . Here is how the edge agent structures the telemetry window and queries the local edge engine: python import numpy as np from dataclasses import dataclass from typing import List, Optional import httpx @dataclass class TelemetryPoint: timestamp: float depth ft: float rop fph: float spp psi: float flow out pct: float pit total bbl: float pumps active: bool class RigEdgeAnomalyDetector: def init self, ollama url: str = "http://127.0.0.1:11434" : self.buffer: List TelemetryPoint = self.max buffer size = 300 self.ollama url = ollama url self.anomaly cooldown = 0 def push self, point: TelemetryPoint - Optional dict : self.buffer.append point if len self.buffer self.max buffer size: self.buffer.pop 0 Require at least 30 seconds of stable baseline if len self.buffer < 30: return None Deterministic trigger checks recent = self.buffer -5: baseline = self.buffer -30:-5 avg baseline pit = np.mean p.pit total bbl for p in baseline current pit = recent -1 .pit total bbl pit gain = current pit - avg baseline pit Condition: Flowing with pumps off, or pit gain 10 bbl flow anomaly = not recent -1 .pumps active and recent -1 .flow out pct 3.0 kick indicator = pit gain 10.0 if flow anomaly or kick indicator and self.anomaly cooldown == 0: self.anomaly cooldown = 60 Cooldown to avoid prompt flooding return self. triage with local slm point, pit gain, flow anomaly if self.anomaly cooldown 0: self.anomaly cooldown -= 1 return None def triage with local slm self, pt: TelemetryPoint, pit gain: float, flow anomaly: bool - dict: prompt = f""" RIG ALARM TRIAGE - HIGH PRIORITY You are a senior drilling superintendent and well control advisor running on an edge rig computer. Current Telemetry: - Hole Depth: {pt.depth ft:.1f} ft - Standpipe Pressure: {pt.spp psi:.0f} psi - Pumps Active: {pt.pumps active} - Flow Out: {pt.flow out pct:.1f}% - Total Pit Gain: {pt.pit gain:.1f} bbl - Flow Anomaly Flag: {flow anomaly} Provide a concise, 3-bullet assessment: 1. Probable Root Cause e.g., Formation Influx vs. Pit Transfer vs. Sensor Drift 2. Immediate Verification Step for Driller e.g., Space out and perform flow check 3. Well Control Level Green / Yellow / Red Alert Format response as strictly actionable guidance for the rig crew.""" try: with httpx.Client timeout=4.0 as client: res = client.post f"{self.ollama url}/api/generate", json={"model": "mistral:7b-instruct-q4 K M", "prompt": prompt, "stream": False} if res.status code == 200: return {"status": "ALERT", "assessment": res.json .get "response", "" } except Exception as e: Deterministic failsafe if local inference times out return {"status": "ALERT", "assessment": "LOCAL SLM TIMEOUT - EXECUTE FLOW CHECK IMMEDIATELY"} return {"status": "ALERT", "assessment": "UNVERIFIED ANOMALY - INITIATE FLOW CHECK"} Testing deployed on an industrial fanless rig-floor edge PC Intel Core i7-12700E, 32GB DDR5, running Ubuntu Core 24.04 LTS : | Model / Quantization | Parameter Size | Memory Footprint | Edge Inference Latency | Deterministic Filter Latency | Cloud Round-Trip VSAT | |---|---|---|---|---|---| | Deterministic Rule Filter | N/A | $< 40\text{ MB}$ | $0.4\text{ ms}$ | Baseline | N/A | | Qwen 2.5 3B Q4 K M | $3.1\text{B}$ | $1.9\text{ GB}$ | $210\text{ ms}$ | $+0.4\text{ ms}$ | $1,800\text{ ms}$ | | Mistral 7B Instruct Q4 K M | $7.2\text{B}$ | $4.4\text{ GB}$ | $490\text{ ms}$ | $+0.4\text{ ms}$ | $2,100\text{ ms}$ | | Llama 3.1 8B Q4 K M | $8.0\text{B}$ | $4.9\text{ GB}$ | $580\text{ ms}$ | $+0.4\text{ ms}$ | $2,300\text{ ms}$ | By running locally: The witsml-edge-agent https://github.com/Greybeard00007/witsml-edge-agent and ai-gateway-sentinel https://github.com/Greybeard00007/ai-gateway-sentinel work alongside our kill-sheet-calculations https://github.com/Greybeard00007/kill-sheet-calculations library. When a kick is verified, the edge agent can automatically push shut-in drillpipe pressure SIDPP , shut-in casing pressure SICP , and pit volume gain into the kill calculation engine, rendering a fully populated, IADC-compliant kill sheet within seconds of well shut-in.