PRISM — Gas-Turbine Remote Monitoring Platform
A vertically-integrated replacement for OEM turbine monitoring: PLC to pixel to platform, built solo in seven months.
PRISM is a remote monitoring and diagnostics system for Solar Turbines Centaur 40 gas-turbine generator sets. It replaces an expensive proprietary OEM monitoring product with an open stack the operator owns end to end: live tag collection from Allen-Bradley PLCs on the OT network, store-and-forward replication to a central ClickHouse cluster, a multi-tenant SaaS dashboard with a live HMI, and the entire self-hosted platform underneath it provisioned as code.
The problem
Operators of industrial gas turbines are typically locked into the OEM's remote monitoring product. It is expensive, closed, and the data leaves the operator's hands. The fleet in question is a set of Solar Turbines Centaur 40 generator sets, each driven by an Allen-Bradley ControlLogix PLC on an isolated OT network.
PRISM replaces that product with an open stack the operator owns, without giving up the two things the OEM tooling did well: high-resolution trigger logs around events, and a live HMI view of each unit.
How the data flows
Allen-Bradley ControlLogix PLC on the turbine skid
│ Ethernet/IP (pycomm3) or OPC UA (asyncua)
▼
prism-plc — Python collector on a Windows host on the OT network
├─► OT-side ClickHouse buffer (30-day retention = the outage queue)
└─► trigger-log subsystem: ring buffer → edge detector → CSV / JSON / SQLite / VTHMI binary
│
│ ch-replicator (watermark-based, survives WAN outages)
▼
Central ClickHouse in the datacentre
▼
prism-fe — multi-tenant SaaS (Vite + React, Hono + tRPC) with embedded Grafana
▼
Cloudflare Zero Trust (Tunnel + Access + Gateway) → operator dashboard
Underneath all of it, prism-infra builds and runs every VM, tunnel, Access policy, CI runner, Git host, wiki, database and observability stack with Terraform and Ansible. Nothing has a public inbound port beyond SSH.
The pieces
The three product repos are deliberately not a monorepo. They have different runtimes, different deploy targets (a Windows OT host versus Debian VMs) and different release cadences. They are bound together by a versioned cross-repo data contract that CI enforces in both directions.
- prism-plc — the edge data plane. Multi-protocol PLC collection, trigger-based event capture, and replication.
- prism-fe — the multi-tenant dashboard. Fleet overview, live HMI, alarms, trigger forensics, admin console.
- prism-infra — infrastructure as code for the whole estate.
- prism-ops — a retired side project that gave the team per-user AI coding sandboxes behind Cloudflare Access.
Two things I'm proudest of
I replaced a vendor's monitoring product, including its file formats. The trigger logs PRISM writes are bit-compatible with the OEM HMI's Trigger.log, the signal catalog was reverse-engineered from the proprietary HMI template, alarm definitions are derived heuristically from PLC program exports, and the live HMI draws a turbine cutaway that mirrors the OEM layout. This is deep OT domain work, not CRUD.
I built the whole vertical alone. Ethernet/IP polling on a Windows OT host, a replicator that treats the OT buffer's retention window as its queue, a tuned ClickHouse store, a multi-tenant SaaS app with a fixed-cadence SSE live view, and the self-hosted Proxmox and Forgejo platform behind Cloudflare Zero Trust that runs it. All provisioned by Terraform and Ansible I wrote.
Tenancy and access
Roles flow from Authentik OIDC groups: super admin, operator staff, customer admin and customer user. Tenants are resolved by email domain with per-email overrides. Premium features sit behind a double gate: the tenant must be entitled and the site must have the feature flag on.