MES & Shop FloorFree templatePDF, Excel, Word exportKepware / OPC UAManufacturing

Kepware and OPC UA Private AI Layer Blueprint Generator

This generator turns a few facts about your Kepware and OPC UA environment into an architecture plan for a private AI layer that stays on your servers. It produces a document you can hand to IT, security and the system owner.

Fill in

Company name

System version

Database or data store

Hosting

Named users

Sites or plants

Main use cases

Data that must never leave the site

GPU available

Target go-live

Live preview

Download:

Kepware and OPC UA Private AI Layer Blueprint Generator

Private AI Layer Architecture Plan: Kepware and OPC UA

Prepared for: Acme Precision Ltd System: Kepware and OPC UA servers, KEPServerEX 6.x Data store: Time-series database Hosting: On-prem server Named users: 150 across 1 site(s) Target go-live: 2027-03-01

1. Context and scope

Acme Precision Ltd wants an AI assistant that works on data held in Kepware and OPC UA servers without moving that data off its own infrastructure. The assistant is read-only by default. Any change to a system of record is proposed by the assistant and executed only after a named person approves it, through the system's supported interface.

Main use cases: Read current values for a machine; summarise a tag trend; compare today's cycle times with last week; explain what an unfamiliar tag means from its description.

2. Components

Component	Design for Kepware and OPC UA	Notes
Data access path	Read-only OPC UA client with a node allowlist and signed, encrypted session; Configuration API read for tag metadata	Read-only identity, reporting copy where possible
Retrieval index	Time-series store for history plus a retrieval index over tag descriptions and device documentation	Local vector store, metadata filters mirror permissions
Model serving	Open-weight model served with vLLM or Ollama on None yet in On-prem server	Size from users and questions per day
Tool server	Tool server with read_current, trend_summary and compare_periods, each returning value, quality and timestamp	Approved read actions only, parameterised
Identity and permissions	OPC UA user or certificate for the AI client; user to area mapping enforced in the tool server	Checked before every query and retrieval
Audit	Append-only log of user, question, tool calls, query text, rows returned and answer	Retained per your records policy

3. Security controls mapped to your constraints

Data that must never leave the site: Tag values from restricted cells, controller project files, network addresses of devices, credentials.

Hosting mode: On-prem server. All components run inside your network boundary. No model, index or log leaves it. For air-gapped hosting, model files, container images and updates enter through your controlled media process, and outbound telemetry in the serving stack is disabled.

Least privilege: a dedicated read-only service identity, no shared accounts, and per-user scope enforced in the tool server. Every answer shows its source records or query so a user can verify it.

4. Three-phase rollout

Phase	Scope	Exit criteria
Phase 1: Read-only questions	Cited answers on one site or line for a pilot group	Accuracy on a known question set accepted by the system owner
Phase 2: Drafts	Summaries, reports and proposed records for human editing	Edit rate and error types reviewed, no policy breaches in audit
Phase 3: Approved actions	Writes through the supported API or interface after named approval	Approval and rollback procedure tested, audit trail complete

5. Open questions for IT and the system owner

1. Which interface does the vendor support for read access in KEPServerEX 6.x, and are there contractual limits on direct database reads? 2. Can we take a reporting copy of Time-series database, and who owns refresh and retention? 3. Which user groups map to which scopes, and who maintains the mapping? 4. What is the approved model list and the process for bringing in model updates? 5. What logging retention and review cadence does our policy require? 6. Who is the accountable owner for answer quality after go-live?

Prepared by / Date

System owner / Date

IT security / Date

This is a planning starting point, not a design guarantee. Confirm interface names, versions and vendor support terms with your vendor before building. OPC UA nodes are addressed by namespace and identifier, and each read returns a value, a status code and timestamps. The blueprint treats quality as part of every answer. Trends come from a history store, not from the OPC UA server, and aggregation happens in the tool so the model sees summaries rather than thousands of raw samples.

Architecture review of your plan

Optional: a short review of your exported blueprint by an engineer who has built private AI layers on this kind of system.

Optional. The tool and every export work without this. No spam.

How to use the generator

Fill in company name, version, data store and hosting mode, then describe the use cases and the data that must never leave the site. Choose the GPU line that matches what you have or expect to buy. The document updates as you type and exports to PDF or Word. Share the first draft with the system owner and IT security, and use the open questions section as the agenda for your next meeting. Expect to edit the components table once you learn what your vendor supports.

Start with one site or line
Name an owner for answer quality
List the data that must stay on site before you pick models
Use the exported file as the basis for a change request

Method behind the plan

OPC UA nodes are addressed by namespace and identifier, and each read returns a value, a status code and timestamps. The blueprint treats quality as part of every answer. Trends come from a history store, not from the OPC UA server, and aggregation happens in the tool so the model sees summaries rather than thousands of raw samples.

What the plan covers

The plan has five parts: context and scope, a component table, security controls tied to your inputs, a three-phase rollout and open questions. The rollout moves from read-only questions to drafted outputs to approved actions, with exit criteria between phases. Each component is described for Kepware and OPC UA servers specifically, including the data access path and the permission model.

Data access path and identity
Retrieval index and tool server
Model serving on local GPUs
Audit log and retention

Common mistakes

Most failed pilots skip the permission model or the audit trail, then cannot get approval to widen use. Check the points below before you take the plan to a steering group.

Reading hundreds of tags at one-second intervals from a slow driver and degrading control communication.
Reusing the HMI or MES OPC UA identity for the AI client.
Dropping the quality code so stale values look good.

Frequently Asked Questions

Does this plan require a cloud service?

No. Every component in the plan runs inside your network: the data access path, the retrieval index, the model serving on your GPUs, the tool server and the audit log. Air-gapped hosting is a supported option.

Is the assistant able to change data?

Not by default. The plan is read-only. Writes are proposed by the assistant and executed only after a named person approves, through the system's supported interface, and the audit log records the proposal and the approval.

How do I pick the GPU line?

Pick what you have or plan to buy, then check it with the sizing calculator for this system. A 24 GB class GPU suits small models and few users. More users or larger models need more memory or more GPUs.

Can I edit the document?

Yes. Edit the fields and export to Word. The component table and the open questions are the parts most worth tailoring once your vendor confirms which interfaces it supports for your version.

If you want a second pair of eyes on this plan, Netray designs and builds private, on-prem AI layers over systems like this, read-only by default.

Talk to an Expert Explore More Free Tools

Related Tools

On-Prem AI

Kepware and OPC UA AI Assistant Sizing and Value Calculator

Estimate GPUs, index size, hours saved and payback for a private AI assistant over Kepware and OPC UA.

On-Prem AI

On-Prem AI Security Hardening Checklist

A practical control checklist for securing self-hosted language models, covering model provenance, network isolation, data governance, host hardening, and audit readiness.

On-Prem AI

On-Prem AI Deployment Checklist

A 30-point pre-deployment checklist covering use cases, hardware, security, model operations, and rollout for self-hosted enterprise LLMs.

On-Prem AI

Private RAG Corpus Sizing Calculator

Estimate chunk counts, vector index storage, raw text volume, and embedding compute time before you build a private retrieval system over your document estate.