# Kepware and OPC UA Private AI Layer Blueprint Generator

> Source: https://netray.co/tools/kepware-opc-ua-private-ai-layer-blueprint-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Fill in your Kepware and OPC UA environment and get a shareable architecture plan for a private, read-only AI layer: components, controls, rollout and open questions.

## Category

mes-shop-floor

## Erp

Kepware / OPC UA

## Industry

Manufacturing

## Audience

- CIO
- IT manager
- Controls engineer
- Solution architect

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### System version

**Key:** version

**Type:** select

**Options:**

- KEPServerEX 6.x
- ThingWorx Kepware Server 6.14 or newer
- Other OPC UA server (standards-based)
- Mixed OPC UA servers

**Default:** KEPServerEX 6.x

#### Database or data store

**Key:** database

**Type:** select

**Options:**

- Time-series database
- Existing historian
- SQL Server or PostgreSQL via logging
- No history store yet

**Default:** Time-series database

#### Hosting

**Key:** hosting

**Type:** select

**Options:**

- On-prem server
- Private cloud
- Air-gapped

**Default:** On-prem server

#### Named users

**Key:** users

**Type:** number

**Default:** 150

#### Sites or plants

**Key:** sites

**Type:** number

**Default:** 1

#### Main use cases

**Key:** use_cases

**Type:** textarea

**Default:** Read current values for a machine; summarise a tag trend; compare today's cycle times with last week; explain what an unfamiliar tag means from its description.

#### Data that must never leave the site

**Key:** never_leave

**Type:** textarea

**Default:** Tag values from restricted cells, controller project files, network addresses of devices, credentials.

#### GPU available

**Key:** gpu

**Type:** select

**Options:**

- None yet
- 1 x 24 GB class
- 1 x 48 to 80 GB class
- 2 to 4 GPUs
- More than 4 GPUs

**Default:** None yet

#### Target go-live

**Key:** golive

**Type:** date

**Default:** 2027-03-01

**Blocks:**

#### Private AI Layer Architecture Plan: Kepware and OPC UA

**Body:** Prepared for: {{company}}
System: Kepware and OPC UA servers, {{version}}
Data store: {{database}}
Hosting: {{hosting}}
Named users: {{users}} across {{sites}} site(s)
Target go-live: {{golive}}

#### 1. Context and scope

**Body:** {{company}} wants an AI assistant that works on data held in Kepware and OPC UA servers without moving that data off its own infrastructure. The assistant is read-only by default. Any change to a system of record is proposed by the assistant and executed only after a named person approves it, through the system's supported interface.

Main use cases:
{{use_cases}}

#### 2. Components

**Table:**

**Columns:**

- Component
- Design for Kepware and OPC UA
- Notes

**Rows:**

**0:** Data access path

**1:** Read-only OPC UA client with a node allowlist and signed, encrypted session; Configuration API read for tag metadata

**2:** Read-only identity, reporting copy where possible

**0:** Retrieval index

**1:** Time-series store for history plus a retrieval index over tag descriptions and device documentation

**2:** Local vector store, metadata filters mirror permissions

**0:** Model serving

**1:** Open-weight model served with vLLM or Ollama on {{gpu}} in {{hosting}}

**2:** Size from users and questions per day

**0:** Tool server

**1:** Tool server with read_current, trend_summary and compare_periods, each returning value, quality and timestamp

**2:** Approved read actions only, parameterised

**0:** Identity and permissions

**1:** OPC UA user or certificate for the AI client; user to area mapping enforced in the tool server

**2:** Checked before every query and retrieval

**0:** Audit

**1:** Append-only log of user, question, tool calls, query text, rows returned and answer

**2:** Retained per your records policy

#### 3. Security controls mapped to your constraints

**Body:** Data that must never leave the site:
{{never_leave}}

Hosting mode: {{hosting}}. All components run inside your network boundary. No model, index or log leaves it. For air-gapped hosting, model files, container images and updates enter through your controlled media process, and outbound telemetry in the serving stack is disabled.

Least privilege: a dedicated read-only service identity, no shared accounts, and per-user scope enforced in the tool server. Every answer shows its source records or query so a user can verify it.

#### 4. Three-phase rollout

**Table:**

**Columns:**

- Phase
- Scope
- Exit criteria

**Rows:**

**0:** Phase 1: Read-only questions

**1:** Cited answers on one site or line for a pilot group

**2:** Accuracy on a known question set accepted by the system owner

**0:** Phase 2: Drafts

**1:** Summaries, reports and proposed records for human editing

**2:** Edit rate and error types reviewed, no policy breaches in audit

**0:** Phase 3: Approved actions

**1:** Writes through the supported API or interface after named approval

**2:** Approval and rollback procedure tested, audit trail complete

#### 5. Open questions for IT and the system owner

**Body:** 1. Which interface does the vendor support for read access in {{version}}, and are there contractual limits on direct database reads?
2. Can we take a reporting copy of {{database}}, and who owns refresh and retention?
3. Which user groups map to which scopes, and who maintains the mapping?
4. What is the approved model list and the process for bringing in model updates?
5. What logging retention and review cadence does our policy require?
6. Who is the accountable owner for answer quality after go-live?

**Signatures:**

- Prepared by
- System owner
- IT security

**Notes:** This is a planning starting point, not a design guarantee. Confirm interface names, versions and vendor support terms with your vendor before building. OPC UA nodes are addressed by namespace and identifier, and each read returns a value, a status code and timestamps. The blueprint treats quality as part of every answer. Trends come from a history store, not from the OPC UA server, and aggregation happens in the tool so the model sees summaries rather than thousands of raw samples.

## Content

**Intro:** This generator turns a few facts about your Kepware and OPC UA environment into an architecture plan for a private AI layer that stays on your servers. It produces a document you can hand to IT, security and the system owner.

**Sections:**

#### How to use the generator

**Body:** Fill in company name, version, data store and hosting mode, then describe the use cases and the data that must never leave the site. Choose the GPU line that matches what you have or expect to buy. The document updates as you type and exports to PDF or Word. Share the first draft with the system owner and IT security, and use the open questions section as the agenda for your next meeting. Expect to edit the components table once you learn what your vendor supports.

**Bullets:**

- Start with one site or line
- Name an owner for answer quality
- List the data that must stay on site before you pick models
- Use the exported file as the basis for a change request

#### Method behind the plan

**Body:** OPC UA nodes are addressed by namespace and identifier, and each read returns a value, a status code and timestamps. The blueprint treats quality as part of every answer. Trends come from a history store, not from the OPC UA server, and aggregation happens in the tool so the model sees summaries rather than thousands of raw samples.

#### What the plan covers

**Body:** The plan has five parts: context and scope, a component table, security controls tied to your inputs, a three-phase rollout and open questions. The rollout moves from read-only questions to drafted outputs to approved actions, with exit criteria between phases. Each component is described for Kepware and OPC UA servers specifically, including the data access path and the permission model.

**Bullets:**

- Data access path and identity
- Retrieval index and tool server
- Model serving on local GPUs
- Audit log and retention

#### Common mistakes

**Body:** Most failed pilots skip the permission model or the audit trail, then cannot get approval to widen use. Check the points below before you take the plan to a steering group.

**Bullets:**

- Reading hundreds of tags at one-second intervals from a slow driver and degrading control communication.
- Reusing the HMI or MES OPC UA identity for the AI client.
- Dropping the quality code so stale values look good.

**Cta:** If you want a second pair of eyes on this plan, Netray designs and builds private, on-prem AI layers over systems like this, read-only by default.

**Faq:**

#### Does this plan require a cloud service?

**Answer:** No. Every component in the plan runs inside your network: the data access path, the retrieval index, the model serving on your GPUs, the tool server and the audit log. Air-gapped hosting is a supported option.

#### Is the assistant able to change data?

**Answer:** Not by default. The plan is read-only. Writes are proposed by the assistant and executed only after a named person approves, through the system's supported interface, and the audit log records the proposal and the approval.

#### How do I pick the GPU line?

**Answer:** Pick what you have or plan to buy, then check it with the sizing calculator for this system. A 24 GB class GPU suits small models and few users. More users or larger models need more memory or more GPUs.

#### Can I edit the document?

**Answer:** Yes. Edit the fields and export to Word. The component table and the open questions are the parts most worth tailoring once your vendor confirms which interfaces it supports for your version.

## Search terms

kepware and opc ua ai architecture, kepware and opc ua on-prem ai, private ai layer blueprint, on-prem ai architecture template, air-gapped ai architecture plan, local llm architecture document, read-only ai assistant design

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json