Industrial AI Safety Architecture
Industrial Twin Lab separates observation, experimentation, validation, and operational authority. Information may move from a physical asset into a controlled digital environment; an experimental result does not travel back as a control command. The full reasoning path is longer than a dashboard pipeline:
Physical Asset → Digital Twin → Isolated Experiment Lab → AI Scientist → Evidence → Human Decision → Validated Deployment
Digital Twin System / ITL research boundary
Data
Synchronized signals + provenance
Context
Twin Capsule + operating envelope
Decision and process orchestration
AI Scientist + deterministic validation
Actuation
People, agents, or machines
Human authority / Phase 1 out of scope
ITL Phase 1 has no control path. Evidence may be reviewed; actuation is not implemented or authorized.
Industrial Twin Lab safety boundary
Diagram notation
- Solid line = directional flow
- Dashed boundary = isolated experiment zone
- Signal-orange stop marker = human authority / safety boundary
OT Control Zone
P-101 is a fictional demonstration asset. PLC, DCS, and SCADA retain deterministic plant control under existing authority.
Safety boundary
Data Access Zone
Sensors, gateway, read-only historian, OPC UA, and MQTT provide controlled acquisition and quality context.
Twin Zone
Twin Capsule, digital twin, and simulation runtime represent behaviour within a declared fidelity and envelope.
AI Experiment Zone
Isolated Twin Lab services include local models, feature engineering, model training, experiment tracking, and AI Scientist. They have no control authority.
Isolated experiment zone
Validation Gate
Human in command. Engineering review, approval, and a signed model determine fitness for a stated inference use.
Human validation gate
Inference Zone
An approved local model runs only as the reviewed version within its approved boundary, with no path back to control.
Experimentation is isolated from operational control. There is no direct control path from AI or an experiment result to the physical machine or OT Control.
Human engineering review remains in command of every physical-machine decision.
Real-world to digital-world evidence flow
- Physical Asset
- Digital Twin
- Isolated Experiment Lab
- AI Scientist
- Evidence
- Human Decision
- Validated Deployment
The 4 September 2026 editorial review maps this publication to the Digital Twin System Framework (opens in a new tab), published on 25 August 2026: data, context, decision and process orchestration, and actuation are connected by a digital thread. Industrial Twin Lab Phase 1 deliberately stops before actuation. It studies how evidence can inform a named human decision; it does not provide an automated control path.
The diagram describes a target architecture. Phase 1 renders its records and boundaries with fictional data; it does not acquire machine signals, run a twin solver, or execute an AI Scientist.
Zoned boundary
| Zone | Boundary role | Representative elements | Permitted role |
|---|---|---|---|
| OT Control Zone | Safety boundary | P-101 fictional demonstration asset, PLC, DCS, SCADA | Deterministic plant control under existing authority. |
| Data Access Zone | Controlled flow | Sensors, Gateway, Read-only Historian, OPC UA, MQTT | Controlled, read-oriented acquisition and quality context. |
| Twin Zone | Controlled flow | Twin Capsule, Digital Twin, Twin Runtime, Simulation Runtime | Represent behavior within a declared fidelity and envelope. |
| AI Experiment Zone | Isolated experiment boundary | Local Models, Feature Engineering, Model Training, Experiment Tracking, AI Scientist | Generate and test hypotheses without control authority. |
| Validation Gate | Human authority gate | Engineering Review, Approval, Signed Model | Decide whether evidence is fit for a stated inference use. Human in command. |
| Inference Zone | Approved inference boundary | Approved Local Model | Run only the reviewed version within its approved boundary, with no path back to control. |
The separation is both logical and architectural. Access credentials, networks, software lifecycles, data paths, and approval records should make it difficult to confuse a research experiment with a production control change. Cloud resources may extend the lab, but must not become an undeclared dependency for critical local data, knowledge, experiments, or inference.
Training an AI model and granting an AI system authority over machinery are completely different activities.
For the fictional P-101 teaching asset, suction pressure, discharge pressure, flow, power, temperature, speed, and vibration can be copied into a bounded Twin Capsule. The twin may replay history or simulate a hypothesis about bearing degradation. The AI Scientist may request experiments and compare Evidence Packages. None of these actions changes a setpoint, starts a pump, bypasses an interlock, or certifies safety. An identified engineer decides whether further testing, maintenance inspection, or a separately validated inference deployment is justified.
Evidence crosses the gate, not authority
A candidate crosses the Validation Gate only with a reproducible record: asset and twin versions, dataset and feature versions, experiment configuration, validation strategy, performance by operating regime, uncertainty, limitations, explainability, and provenance. Approval is scoped. Evidence for detecting P-101 bearing degradation under a known envelope does not authorize control, another failure mode, another machine, or an unseen regime.
See the Twin Capsule, Experiment Fabric, and AI Scientist for the records on each side of this boundary.
Research direction / not deployed
Digital Triplet: research direction only
Physical Machine + Digital Twin + AI Scientist describes a research direction, not a deployed autonomous capability. It grants no control authority and remains subject to the same validation boundary and human engineering decision.