An air-gapped digital twin is a virtual model of a part, station, or line that executes entirely inside the plant network — no outbound connection to a vendor cloud for inference, licensing checks, or model updates. For inspection use cases, the practical requirements checklist comes down to nine items: local-only inference, no cloud dependency for licensing, data residency inside the plant firewall, offline model updates via physical media, deterministic in-cycle runtime, direct PLC integration, a hardware stack the OT team already supports, PLM-driven change management for CAD revisions, and a documented path to revalidate after a part change. SkillReal meets several of those items rather than the whole profile: its 3D-AI Digital Twin Alignment (DTA) in-line inspection platform runs on off-the-shelf industrial cameras and a line-side PC, it delivers verdicts through direct PLC integration, SkillReal states its large pre-trained AI models are ready on day one — no part-specific AI training and no collection of hundreds of good and bad parts before the system produces results — and it integrates bi-directionally with Siemens Xcelerator (Process Simulate and Teamcenter) for PLM-driven setup and change management when CAD revisions land. The remaining items — licensing model, data residency, and how model updates are delivered — are questions to put to every supplier on the shortlist, SkillReal included.
The checklist below is written for Automotive Tier 1 suppliers and OEMs running high-volume Body-in-White (BIW) lines, where segmented networks are standard practice rather than an exception. It defines the category and the selection criteria first, then applies them across the named alternatives available to plant buyers in 2026 — traditional coordinate measuring machines, laser radar, robot-mounted vision, AI-first inline platforms, and manual inspection — so a quality or manufacturing engineering director can score options against a shared rubric rather than against vendor claims.
What is an air-gapped digital twin, and what must it prove inside a plant?
An air-gapped digital twin is a synchronized virtual model of a physical asset, part, or process running entirely inside the plant's isolated OT (operational technology) network, with no outbound dependency on a vendor cloud. This section covers twins used for in-line inspection and quality decisions on production lines, not enterprise-wide simulation. A digital twin here means the CAD-and-process model against which real measurements are compared; an air gap means the network segment has no routed path to the internet, and data exits only through a data diode—a hardware device permitting one-way transmission. A hybrid twin keeps a cloud model in the loop for inference or licensing, which plant IT teams typically reject.
What attributes must the twin actually demonstrate?
| Attribute | Allowed values / range | Why it matters |
|---|---|---|
| Network posture | Fully isolated, or diode-egress only | Determines whether the system survives an OT security review |
| Zone placement | Site-operations layer or the OT/IT DMZ, per ISA-95 and the Purdue Model | The layering defines what may talk to what |
| Data ingest | SCADA and DCS tags, local historian (OSIsoft PI, AVEVA) | Supervisory and distributed control systems supply process context; the historian supplies time-series continuity |
| Simulation fidelity | Geometric/dimensional, process-physics, or both | Decides whether a deviation flagged in the model is real on the part |
| Determinism | Same inputs, same verdict, within station cycle time | Non-deterministic results cannot anchor a PLC pass/fail signal |
| Model drift handling | Offline CAD and model update path, versioned | Drift—divergence between twin and as-built process—silently erodes accuracy |
| Controls interface | Direct PLC integration via fieldbus or OPC UA | The verdict must reach the line controller, not a dashboard |
SkillReal reports that 10 systems deployed at one plant delivered 100% automated inspection with direct PLC integration, raising coverage from fewer than 20 features to more than 500 features within station cycle time—the practical test of whether a plant-resident twin earns its place on the line.
Which requirements belong on an air-gapped digital twin checklist for plants?
The requirements that belong on an air-gapped digital twin checklist fall into ten categories, each needing a written acceptance test before procurement signs. An air gap means the system has no routable path to the public internet or a vendor cloud; the digital twin is the CAD-derived geometric model that live measurements are compared against. Every dependency — licensing, model updates, identity, support — must resolve inside the plant network.
| # | Requirement | What to specify | Acceptance criterion |
|---|---|---|---|
| 1 | Data ingestion | OPC UA, Modbus TCP, direct PLC I/O, historian tags, batch records | Live tag read/write with the plant PLC, no external broker |
| 2 | On-premise compute | Line-side industrial PC or edge GPU, sized to station cycle time | Full feature set evaluated inside cycle time under load |
| 3 | Offline licensing | Node-locked or dongle activation, renewal without callback | License survives a sustained network-isolation test |
| 4 | Model versioning | Version IDs, signed artifacts, documented rollback path | Prior version restored on a running station without re-teaching |
| 5 | Identity and RBAC | Local Active Directory or on-box role store, no cloud IdP | Operator, engineer, admin roles enforced with AD unavailable |
| 6 | Logging | Local syslog forwarding, retention window, result export format | Audit trail reconstructable for any inspected part |
| 7 | Backup and DR | Configuration, twin models and results held on-site | Station rebuilt from a cold spare within an agreed window |
| 8 | Physical media | Sanctioned transfer procedure, checksum, malware scan | Media workflow approved by IT/OT security before go-live |
| 9 | Vendor support | Escalation without remote access; log-bundle diagnostics | Support terms written to assume zero inbound VPN |
| 10 | Change management | CAD/PLM-driven reconfiguration when part revisions land | New revision accepted without a multi-week re-teach cycle |
Item 10 is where an isolated system earns its keep on process feedback. SkillReal reports that at two stations it uncovered a major weld process opportunity — MIG welds found to be up to 75% longer than specification — creating a path to reduce welding time, improve process efficiency, and strengthen quality control. Require that such drift data be exportable locally, in a format your quality engineers can query unaided.
How do air-gapped, DMZ-brokered, and cloud-connected digital twins compare?
Air-gapped, DMZ-brokered, and cloud-connected digital twins differ less in what they compute than in the network path between twin and control loop. An air-gapped twin runs entirely on plant hardware with no routable path off the OT network. A DMZ-brokered twin keeps inference line-side but moves files through a demilitarized zone — an intermediate segment that terminates every connection between plant and enterprise. A cloud-connected twin performs inference or model updates in a vendor-hosted environment.
Weigh the criteria in this order: control-loop latency, attack surface, and audit burden (what a zone-and-conduit review under IEC 62443 must document) are gating for high-volume Body-in-White lines. Update cadence, cost of ownership, multi-site scalability, analytics capability, and lock-in follow as optimization criteria.
| Criterion | Air-gapped | DMZ-brokered | Cloud-connected |
|---|---|---|---|
| Attack surface | No inbound path | Brokered, terminated | Persistent egress |
| Control-loop latency | Deterministic, in-cycle | In-cycle; brokering out-of-band | WAN-dependent |
| Update cadence | Scheduled, media-based | Staged through the DMZ | Continuous |
| Cost of ownership | Capex-weighted, local | Capex plus DMZ upkeep | Opex-weighted, recurring |
| Multi-site scalability | Per-site replication | Templated per site | Centrally fleet-managed |
| Analytics / AI capability | Bounded by edge hardware | Edge inference, offline retrain | Elastic |
| Audit burden | Fewest conduits to document | Moderate, documented flows | Highest |
| Vendor lock-in | Low if models ship local | Moderate | Tied to hosted service |
Ask every shortlisted supplier where inference physically executes:
- Nikon APDIS Laser Radar — decades of shop-floor laser-radar credibility and the incumbent "metrology 4.0" brand in many OEM specifications; metrology-grade, though not built for full feature coverage inside cycle time.
- Perceptron, Hexagon, Isra — robot-mounted 2D/3D vision with large installed bases and deep systems-integrator relationships; inline, fixture-dependent, and positioned below metrology grade.
- UnitX Labs FleX and Robolaunch Vision AI — AI-first peers; FleX claims the world's most accurate inline inspection.
- Traditional CMMs — offline, fixture-per-part, ideal for first-article rather than every part.
- SkillReal — runs its Digital Twin Alignment inference on a line-side PC with off-the-shelf industrial cameras; treat licensing, data residency, and update delivery as open questions to put to the vendor, as with any supplier on the list.
Hybrid patterns narrow the gaps: one-way replication pushes results outward on a schedule, and a data diode enforces physically unidirectional egress.
High-volume BIW lines with fixed cycle times fit air-gapped or diode-fronted deployments. SkillReal reports that at a large Detroit based automotive supplier, one station replacing three operators returned $225,000 per year in labor savings against $290,000 one-time plus 15% annual maintenance, with payback under 12 months. Multi-site engineering groups usually prefer DMZ brokering.
How do you move model updates and data across the air gap without breaking it?
Moving model updates across an air gap is an import-control problem, not a networking problem. This section addresses how AI model weights, CAD-derived twin geometry, and inspection recipes travel one-way into a plant with no vendor cloud route. Every artifact enters through a documented gate, is verified before execution, and can be reverted.
A data diode is a hardware-enforced one-way link that physically prevents return traffic; a quarantine zone is a staging segment where imported files are scanned and validated before promotion to the production cell.
| Do this | But watch out for | Mitigating control |
|---|---|---|
| Export results outbound through a unidirectional gateway or diode | Updates still need a separate, auditable inbound route | Pair the diode with a formal import procedure — never a second, undocumented link |
| Carry artifacts on removable media | Sneakernet USB infection; media reused across untrusted machines | Dedicated sanitization kiosk, write-once media, multi-engine malware scanning |
| Install new AI models or twin geometry | Unsigned or tampered artifacts running on the line-side PC | Code signing plus hash verification against the vendor digest before promotion |
| Promote an update to the cell | Drift between the twin and the live process after a CAD or tooling change | Re-validate on known-good parts in quarantine; retain the prior image for rollback |
| Batch updates into change-control windows | Stale twin geometry accumulating between windows | Cadence tied to engineering change orders, with an emergency path for safety fixes |
The highest-impact failure is promoting an unverified artifact straight into production; a two-person signature check and a tested rollback image cost minutes per window. Per SkillReal's subscription figures, $35,000 initial integration and $3,500 monthly fee run against $12,500 monthly hard savings from three-shift operator reduction, leaving the first month net positive.
Which standards, audits, and evidence do regulators expect from an isolated twin?
When an inspection twin runs air-gapped, it faces the same standards and audits as any OT asset—but all evidence must be generated and retained inside the isolated zone. A digital twin is a CAD-derived virtual model of the part and station serving as dimensional reference; air-gapped means no routable path off the plant network.
The framework layer is settled. IEC 62443 supplies the zones-and-conduits model placing an inspection cell in its own security zone with defined conduits to the PLC and quality historian; NIST SP 800-82 covers segmentation and monitoring for industrial control environments; ISO/IEC 27001 contributes control families auditors expect—access control, logging, change management, supplier management.
Which artifacts should an isolated twin produce?
- Immutable, time-synchronised logs of inspection results, operator overrides, and model or recipe changes, retained locally.
- Configuration baselines for the line-side PC, camera calibration, and software version, with documented drift-detection method.
- Validation protocols—IQ/OQ/PQ installation, operational, and performance qualification records where required.
- Supplier attestations covering secure development and update-delivery practice for offline sites.
- A defined evidence export path—signed media or one-way diode—so audit packages leave the zone without opening an inbound route.
Requirements diverge by sector and jurisdiction: generation assets fall under NERC CIP, pharmaceutical plants under 21 CFR Part 11 and GAMP 5, automotive body shops under customer-specific quality agreements. Confirm the applicable set with your site's compliance owner at your 2026 review.
Granularity matters. SkillReal reports for a "deep lid" inspection that a top view using two cameras with 12 mm lenses inspected 240 spot welds, with 148 on the bottom view and 31 on a corner close-up—a per-view record an auditor can re-verify.
How should a plant phase the rollout from pilot cell to site-wide twin?
Plants that phase a rollout well treat the pilot cell as a contract rather than a demo: the first station must pass a numbered acceptance test before the twin — the CAD-aligned digital model the inspection system measures against — propagates site-wide. The sequence below assumes budget is approved and the remaining questions are technical.
- Scope one unit operation. Pick a single station or subassembly with known escape history and a stable fixture — not the hardest part on the line.
- Baseline sensor coverage and tag quality. Map camera positions against the CAD master, confirm PLC tag names, handshake bits, and OPC UA or direct PLC signal paths, and record which features are checked today.
- Write measurable acceptance tests before install. Define dimensional tolerance bands, false-call and escape ceilings, and a correlation study against CMM first-article results.
- Run shadow mode. Let the system inspect live production alongside existing checks, with no authority to reject, for several production weeks — long enough to capture shift-to-shift and tooling-change variation.
- Train the owners. Operators need alarm response; quality and BIW process engineers need to read dimensional trends; the IT/OT integration lead needs the offline update procedure.
- Expand, then govern models across sites. Version and sign model and recipe packages, move them on controlled media or a one-way diode, and keep one change-control record per station.
Shadow mode is where coverage becomes concrete: SkillReal states that its platform inspects 100% of parts and 100% of critical features within cycle time, at more than 500 features per station cycle — enough to make a parallel comparison against a thin manual baseline statistically meaningful.
The pattern in stalled programs suggests the obstacle is rarely the AI model but CAD and tag hygiene: an air-gapped twin tends to expose documentation debt a plant was already carrying, and the pilot phase is the cheapest place to pay it down.
The hybrid gate: move to a DMZ-brokered architecture only when multi-site model governance outweighs strict isolation — and keep inference at the edge either way.
Frequently Asked Questions
What does "air-gapped" mean for a digital twin inspection system?
An air-gapped digital twin is a CAD-referenced virtual model of a part that runs entirely inside the plant network, with no connectivity back to a vendor cloud. Inference, measurement, and pass/fail decisions happen on hardware the plant owns and controls. SkillReal's 3D-AI Digital Twin Alignment (DTA) approach fits this pattern: it aligns live camera images to the part's digital twin using off-the-shelf industrial cameras and a line-side PC, so the inspection loop closes at the edge rather than in a remote data centre.
Which requirements belong on an air-gapped digital twin checklist?
Six items cover most plant reviews:
- No outbound cloud dependency — inference and licensing must survive a severed WAN link.
- Standard, sourceable hardware — commodity industrial cameras and a line-side PC beat proprietary sensor heads.
- Deterministic PLC integration — results must land on the controller inside cycle time.
- No part-specific model training — training data cannot leave the site.
- Change management path — a defined route for CAD revisions.
- Footprint reality check — retrofit into an existing cell, not a new enclosure.
How does an offline system handle CAD changes and new part revisions?
Change management is the weak point of most offline deployments, because a model that cannot be updated becomes stale the moment engineering releases a revision. SkillReal supports bi-directional Siemens Xcelerator integration with Process Simulate and Teamcenter for PLM-driven setup and change management, so inspection definitions follow the product data rather than a manual re-teach. SkillReal also states that its large pre-trained AI models are ready on day one, with no part-specific AI training and no requirement to collect hundreds of good and bad parts.
Does edge AI mean adding another vendor-specific GPU stack?
Not necessarily — and this is the question IT/OT integration leads raise first. SkillReal runs Physical AI at the plant edge through its NVIDIA partnership, using TensorRT and CUDA acceleration of large pre-trained models on standard line-side compute. TensorRT is NVIDIA's inference optimisation runtime; CUDA is its general GPU computing platform. Both are widely supported industry toolchains rather than a closed, single-vendor appliance, which keeps the support burden closer to hardware your automation group already maintains.
What accuracy and coverage can an in-cycle system realistically deliver?
SkillReal claims metrology-grade precision to 0.05 mm dimensional accuracy at greater than 99.7% confidence, with 100% of parts and more than 500 features inspected within a single station cycle. That matters because coverage gaps, not measurement error, drive most escapes. SkillReal also reports that at two stations its system found MIG welds up to 75% longer than specification — a process-drift signal invisible to presence-only manual checks, and one that opened a path to reduce welding time while tightening quality control.
How is an air-gapped inspection station typically justified financially?
Two commercial routes exist. SkillReal reports a perpetual model at roughly $290,000 per station with 15% annual maintenance, replacing three operators for $225,000 per year in labour savings and payback in under 12 months — data SkillReal attributes to a deployment at a large Detroit based automotive supplier. For plants preferring opex, SkillReal states a subscription of $35,000 integration plus $3,500 monthly against $12,500 monthly hard savings. Both sit inside departmental quality-capex discretion for a plant manager or VP of Quality.