BLUF: Industrial AI usually fails before model selection. The missing component is a data contract: a temperature arrives without stable asset identity, unit, engineering range, source timestamp, quality state, machine state, owner or permitted use. An LLM, anomaly model or rule engine can still produce a plausible answer; it cannot prove that the answer concerns the right asset, is comparable across lines, or is safe to use. Build a versioned semantic interface at the edge, validate it before inference, and expose its governed representation through the Asset Administration Shell (AAS).
OPC UA is a strong source-model foundation, not a finished contract. Its Data Access model includes engineering units and quality codes. The OPC Foundation interoperability guidance makes the practical point: value, quality and timestamp only become useful with asset context. The IDTA AAS specifications define structure, interfaces and semantics for standardised digital twins. Neither standard decides your ownership, compatibility policy or test evidence.
The architecture: contract before feature
Treat the path from a PLC or historian to an AI feature as four responsibilities. Do not let an embedding job or notebook become the de facto integration layer.
OPC UA nodes / historian replica → edge contract adapter → validation gate + quarantine → versioned event store / feature view → AAS submodel + AI consumer.
1. Source adapter: read approved OPC UA nodes and preserve NodeId/namespace, server and source timestamps, StatusCode, engineering unit and source endpoint. Do not silently rename or convert values.
2. Edge contract: map source fields to a stable asset identifier and semantic concept. Add machine-state context, permissible-use policy, owner and contract version. Convert units only through explicit tested rules, retaining source value and unit.
3. Validation gate: reject, quarantine or flag records violating type, unit, range, timestamp skew, quality, state or identity rules. Emit a reason code; never coerce unknown quality to good.
4. AAS representation: publish approved semantic references and contract provenance as a submodel or linked submodel elements. AAS semanticId makes an interface discoverable; it does not replace runtime validation.
The minimum contract
| Field | Example | Why it is non-negotiable |
|---|---|---|
| asset_id | plant-3/line-2/pump-17 | Stops tag-name collisions and binds evidence to a physical or logical asset. |
| semantic_id + property | IEC 61360/ECLASS reference + bearing_temperature | States meaning beyond a local historian label. |
| value, unit, engineering_range | 82.4 °C; 0–120 °C | Prevents °F/°C errors and flags impossible values without inventing alarms. |
| source_time, ingest_time, clock_basis | UTC source time; edge receipt | Separates late, replayed and time-skewed observations. |
| quality + machine_state | Bad/Uncertain; maintenance | Prevents a model treating calibration as process evidence. |
| owner + permitted_use | Reliability engineering; advisory only | Makes responsibility and downstream use explicit. |
| contract_version + lineage | 1.4.0; NodeId and adapter release | Supports compatibility review, replay and incident reconstruction. |
Compatibility is a release decision
Classify changes before deployment. A patch clarifies a description or adds an optional field. A minor change adds an optional semantic field with default-safe consumer behaviour. A major change alters unit, identity semantics, range meaning, state vocabulary, cardinality or permitted use. Major changes need a parallel contract, explicit consumer migration and replay evidence—not a best-effort parser. This is the same discipline as structured LLM output as a versioned API contract: syntax validation does not prove operational validity.
Edge tests and deliberate failure tests
Run contract tests at the edge on every adapter release and against captured production samples. Unit tests verify dimensions and conversion precision; schema tests require mandatory fields; semantic tests reject incompatible asset classes; temporal tests bound timestamp skew and detect time reversal; state tests exclude maintenance or bypass modes from normal training; replay tests prove a proposed consumer can still interpret old events.
Keep a quarantine stream. A dropped event hides a defect; a quarantined event with contract version, source endpoint, reason code and sample reference gives the data owner an actionable queue. Set acceptance thresholds by use case: an advisory dashboard may tolerate delayed observations marked stale; condition monitoring should not silently substitute stale or Bad-quality data.
Unit drift: a supplier changes bar to kPa or omits the unit. Mitigation: reject missing units, retain source and canonical units, require conversion test vectors.
Identity drift: a PLC program reuses a tag for a replacement asset. Mitigation: bind observations to an asset-lifecycle identifier, not a display name; require owner approval for remapping.
Timestamp ambiguity: source time is local time, resets after reboot, or arrives after the event. Mitigation: store source and ingest time with clock basis; alert on skew and test recovery/replay.
Quality laundering: an adapter maps vendor uncertainty to Good. Mitigation: maintain a source-to-contract quality mapping, preserve raw StatusCode and block unapproved mappings.
State blindness: training treats planned shutdown, calibration or manual override as normal production. Mitigation: require machine state and define inclusion rules per use case.
AAS is the semantic interface, not the data lake
Use AAS where it creates a governed, discoverable interface: asset identity, submodel semantics, data-specification references, constraints, owner and contract version. The IDTA metamodel recommends semantic identifiers for submodel elements and permits independently versioned aspect views. Do not copy every high-frequency measurement into AAS. Keep high-rate telemetry in an event or historian path, then link the semantic contract and provenance.
The Data Act names poor metadata management and missing semantic and technical interoperability as barriers to data sharing. That is an engineering signal, not a legal determination for one factory. Legal questions—whether a party is a data holder, what access is required, and which sector or contract rules apply—need counsel. Engineering can make access, purpose, provenance and interfaces explicit now.
What this does not solve
A clean contract does not prove model accuracy, establish functional safety, settle data rights or reconcile competing product master data. It also costs engineering effort: canonical IDs and quality mappings need owners; strict validation may initially increase quarantined records; parallel versions create temporary overhead. Those costs are usually preferable to discovering after an incident that a model was trained on incomparable signals.
A practical first workshop
Choose one bounded use case and one asset family. Inventory ten high-value signals; document the contract fields; map OPC UA sources and quality states; define canonical units and allowed machine states; implement a quarantine reason code; replay one week of samples through a proposed consumer; then publish the approved interface as an AAS-linked contract. If the OT AI initiative needs architectural protection around the data path, begin with the observation–inference–control boundary before expanding access. A focused architecture review can expose missing owners, versions and failure tests before the first model is connected.
