Kepware + shop-floor AI
AI for Kepware KEPServerEX: Linking Shop-Floor Tags to ERP Work Orders, Read-Only
Short answer
AI for Kepware KEPServerEX reads machine data that the server already exposes through OPC UA, MQTT or logged SQL tables and joins it to ERP work orders, routings and downtime reasons, so engineers can ask why a line stopped or which jobs ran slow. The AI is read-only toward the plant floor and runs on-prem inside your network.
- ERP
- Kepware KEPServerEX
- Industries
- Manufacturing, Aerospace, Defense, Electronics, Automotive
- Written for
- Controls Engineer
KEPServerEX is the connectivity layer many plants use to turn PLC and machine protocols into something the rest of the business can consume. Channels and devices speak Allen-Bradley, Siemens, Modbus, Fanuc and many other drivers; tags are published to OPC UA clients, historians, MES and, through the IoT Gateway, to MQTT or REST consumers.
The gap is usually between that stream of tag values and the ERP. The ERP knows the work order, routing operation, planned run rate and scrap codes. Kepware knows that machine 14 stopped at 02:13 and its cycle counter climbed more slowly all week. Joining the two usually means a custom historian query or a spreadsheet an engineer maintains.
AI is useful for the analysis between them, not for control. A model can read logged tag data, match it against work order and routing data, and answer questions such as which jobs ran below standard rate, what the stoppage pattern looked like, or whether a new tag mapping makes sense. It should not write to a tag or send a command to any machine.
This page describes a safe pattern for that, what Kepware features it uses, and the security boundaries that matter in a plant, including defense and aerospace sites where the network is segmented or air-gapped.
What usually gets in the way
The problems we hear most from controls engineer teams running Kepware KEPServerEX.
Tag data and work orders live apart
Machine counters and states sit in Kepware, a historian or SQL; the work order, routing and standard hours sit in the ERP. Reconciling them is manual and often done once a month.
Downtime reasons are inconsistent
Operators select reasons in an MES or on a panel, but codes are inconsistent. Without a way to read free text and states together, root cause reporting is thin.
Tag configuration grows messy
Large projects accumulate channels, devices, tag groups and scaling settings built over years. Naming conventions drift and nobody is certain which tags are still used.
Security rules restrict cloud analytics
Plants following IEC 62443 style zoning, or defense sites with controlled networks, cannot send machine data to a public AI service.
Controls staff are stretched
The same few engineers handle commissioning, connectivity, and requests for reports. Ad hoc analysis competes with maintenance work.
Where AI earns its place in Kepware KEPServerEX
Each use case names the ERP objects it reads or writes, so your ERP team can judge the integration effort before anyone commits budget.
Work order run-rate review
Compare actual cycle counts and run states from logged tags with the ERP work order, planned rate and quantity completed.
Touches: Work order and routing operation tables, planned run time and standard rate, production reporting entries; Kepware Data Logger tables
Outcome: Slow jobs and unreported downtime become visible weekly instead of at month-end.
Downtime narrative
Ask what happened on a machine last shift and get a timeline from state tags, alarms and operator reasons.
Touches: State, alarm and counter tags via OPC UA or logged SQL; ERP work order in progress
Outcome: Faster shift handover and root cause meetings, with evidence attached.
Tag configuration review
Analyze exported project files and the Configuration API output for duplicate tags, inconsistent names and unused groups.
Touches: Kepware channels, devices, tag groups and scaling settings; ERP work center and machine master naming
Outcome: A clean-up list that engineers review; a more consistent project for future ERP mapping.
Machine to work center mapping
Propose mappings between device names in Kepware and work centers in the ERP for engineer approval.
Touches: Kepware device names, ERP work center and resource master
Outcome: A reviewed mapping table created in an hour rather than a day of cross-checking.
Scrap and quality correlation
Look for relationships between process tags such as temperature or pressure and scrap codes recorded against the work order.
Touches: Process tags, ERP scrap and rework transactions, inspection results
Outcome: Candidate relationships for process engineers to test; not an automatic conclusion.
OEE questions in plain English
Ask for availability, performance and quality by machine and period, with the calculation shown.
Touches: Run state tags, counters, ERP quantity good and scrap
Outcome: OEE reports built from the same data sources and shown with their formula, easy for engineers to challenge.
Commissioning documentation
Generate a plain description of a Kepware project: devices, protocols, tag counts and what each group represents.
Touches: Project file export, device lists, ERP asset records
Outcome: Handover documents for sites where the original integrator has gone.
Reference architecture
Data moves one way, from Kepware outward. Logged tags land in a SQL table or an MQTT consumer inside the plant network, the AI layer reads from there and from the ERP, and no path leads back to controllers.
- 1
Kepware data paths
Existing outputs: OPC UA server endpoints, the IoT Gateway for MQTT or REST, or the Data Logger writing to a database over ODBC.
- 2
Plant data store
A time-series or SQL store inside the plant network holding tag history, kept separate from controller networks.
- 3
ERP read access
Read-only access to work order, routing, resource and scrap data via views or API.
- 4
Private model serving
Open-weight models on a GPU node in the plant or site data center, with no outbound internet requirement.
- 5
Analysis interface
Natural-language questions answered with the underlying query and time window displayed, and configuration review produced as reports.
Integration notes for your ERP team
- Prefer data already produced by Kepware: the Data Logger for SQL history, the IoT Gateway for MQTT, or the OPC UA server for live reads.
- The OPC UA server typically listens on a configured endpoint; use a read-only UA user and certificate trust lists, never anonymous write access.
- The Configuration API is useful for exporting project structure; give it a read-only role and restrict it by network.
- Use consistent tag naming such as plant, line, machine, signal, so joins to ERP work centers are mechanical.
- Log timestamps in UTC and record the time zone of the ERP for the join; shift boundaries cause most reconciliation errors.
- Do not expose write-enabled tags to the analysis path. Use tag-level access controls to enforce read-only at the source.
Deployment options
Air-gapped plant node
Defense, aerospace and sites with segmented networks
Model and data store inside the plant zone; updates delivered by controlled media; no internet dependency.
Site data center
Multi-line plants with IT-managed servers
Model hosted beside the historian and ERP replica, reachable only from approved subnets.
Configuration review only
Teams wanting low-risk first steps
Analyze exported Kepware project files and documentation without live tag data.
Compliance and data control
How the architecture supports your obligations. Certification and accountability stay with your organisation; the design keeps the evidence straightforward.
IEC 62443 and zone and conduit design
Data flows outward through a controlled conduit; the AI node sits above the control zone and has no path to controllers.
NIST SP 800-82 guidance
Read-only design, minimal access and logged queries align with its recommendations for industrial networks.
ITAR, EAR and CUI environments
Running entirely in your enclave keeps technical and production data inside the boundary you already control.
Safety systems separation
The AI is never part of a safety function and cannot write to any tag or command any equipment.
How an engagement runs
Phase 1 . 1-2 weeks
Site survey
- -Map of Kepware channels, devices and outputs
- -Network zone review with IT and controls
- -Selection of machines and work centers for a pilot
Phase 2 . 2-4 weeks
Data bridge
- -Plant data store fed from Kepware
- -Machine to work center mapping reviewed by engineers
- -Read-only ERP access set up
Phase 3 . 3-4 weeks
Analysis pilot
- -Private model on a plant node
- -Run-rate and downtime questions on pilot machines
- -Comparison against existing manual reports
Phase 4 . 2 weeks
Handover
- -Runbook for controls and IT
- -Security review sign-off
- -Expansion plan for further lines
Questions to ask any vendor, including us
A short list that separates real Kepware KEPServerEX AI work from a chatbot demo.
- Is there any path from the AI system back to controllers or tags?
- Does the system need internet access, or can it run air-gapped?
- Which Kepware outputs do you use, and do they require extra licensed features?
- How do you reconcile time zones and shift boundaries with the ERP?
- Who validates the machine to work center mapping?
- How are OEE or downtime figures calculated, and can we inspect the formula?
- How is the model updated in a segmented network?
Frequently asked questions
Can the AI write values to PLCs through Kepware?
No, and it should not. The design is read-only: data flows out of Kepware to a plant data store, and there is no write path from the AI to tags or controllers. Enforce this with read-only OPC UA credentials and tag access settings at the source.
Which Kepware features does it rely on?
Usually the Data Logger for SQL history, the IoT Gateway for MQTT or REST, or the OPC UA server for live reads. Some features may need separate licensing, so we confirm what your installation already has before designing a data path.
Does this replace an MES or historian?
No. It adds natural-language analysis on top of data they or Kepware already collect. If you already have an MES with good OEE and downtime reporting, you may not need anything more.
Can it run in an air-gapped plant?
Yes. Open-weight models run locally on a GPU node, with the data store and ERP replica inside the same zone. Updates arrive by controlled media under your change process.
How does it link a machine to an ERP work order?
Through a reviewed mapping between device or tag names and ERP work centers, then by time window against the work order in progress. Engineers approve the mapping because errors there corrupt every later answer.
Is machine data used to train a model?
No. Retrieval happens at question time over your data. Any fine-tuning on plant data would be a separate decision, scoped and approved by you.
How much data history is needed?
Useful answers about recent shifts need only days of history. Pattern analysis such as scrap correlation is better with several months. Storage depends on tag count and logging rate, which we size in the site survey.
Related guides
AI Agents for ERP, Running On-Prem
A practical guide to on-prem AI agents for ERP: what they can safely automate, where human approval belongs, and how to design the guardrails.
RAG + SQL + permissionsA Private LLM Grounded on Your ERP Data
How a private LLM answers questions on your ERP data: RAG plus text-to-SQL, role-based permissions inherited from the ERP, and where each fits.
On-prem AI, any ERP, A&DOn-Prem AI for ERP in Aerospace, Defense, and Electronics Manufacturing
A hub guide to on-prem AI across SAP, Infor LN, Costpoint, IFS, and Oracle EBS for aerospace, defense, and electronics manufacturers under ITAR, CMMC, and AS9100.
Infor SyteLine / CSI + AIAI for Infor SyteLine and CloudSuite Industrial
Add grounded AI to Infor SyteLine or CloudSuite Industrial: natural-language answers, agents over IDOs and ION, on-prem or CloudSuite deployment.
Infor LN + AIAI for Infor LN: Sessions, BODs, and Engineer-to-Order Work
Add grounded AI to Infor LN 10.x or CloudSuite: natural-language answers over sessions and BODs, agents for project and engineer-to-order work, on-prem options.
Opcenter Execution + private AIAI for Siemens Opcenter Execution MES, Running Inside Your Own Network
Add private, grounded AI to Siemens Opcenter Execution MES: ask questions over lots, work orders, nonconformances and genealogy without leaving your network.
Plan it with numbers
Predictive Maintenance ROI Calculator
Compare baseline unplanned downtime cost against predictive maintenance monitoring cost to see net annual savings across your asset fleet.
Free ToolMES Implementation Cost Calculator
Estimate total MES implementation cost across licensing, shop-floor terminal hardware, configuration labor, and ERP integration complexity.
Free ToolERP Security Posture Checklist
Work through 30 concrete security controls across access, patching, network, data protection, and monitoring, with the highest-risk items flagged.
GuideIoT Sensor to ERP Data Integration for Manufacturing
Build reliable IoT sensor to ERP data pipelines for manufacturing. Covers MQTT, edge processing, data normalization, and ERP API ingestion patterns.
GuideSmart Factory ERP Integration: Industry 4.0 Connectivity Guide
Connect your smart factory systems to ERP with this Industry 4.0 integration guide covering MES, SCADA, IoT platforms, and real-time production data pipelines.
GuideSyteLine RFID Integration for Manufacturing
Integrate RFID technology with Infor SyteLine for manufacturing tracking. Configure readers, tag encoding, and real-time WIP visibility in CloudSuite Industrial.
Talk it through with an engineer who knows Kepware KEPServerEX
Bring one real question your team cannot answer from the ERP today. We will map the data path, the model, and where it runs, and tell you honestly if AI is the wrong tool for it.