Air-gapped model updates: how to improve an offline inspector safely.

Why is retraining offline and deployment manual on an air-gapped line?

On an air-gapped line, retraining is offline and deployment is manual by design, because the whole point of the air gap is that the cell has no path to the outside. Defense, pharmaceutical and contract-manufacturing plants often forbid outbound connections from the production network, so there is no channel for a model to update itself over the wire. The update has to be carried in deliberately, by a person, on removable media.

That constraint is a feature, not a limitation, for these plants. It means every change to the inspector is an intentional, logged act rather than a silent push, which is exactly what a regulated or security-conscious site wants. The trade is that you own the workflow: you decide when a new model is built, how it reaches the cell, and how you prove it is safe before it runs.

So the question for an offline line is not whether the model can improve. It can. The question is what a disciplined update procedure looks like when connecting the cell is not allowed.

What does the USB update workflow look like step by step?

The USB workflow moves a validated model from an offline training environment to the cell on removable media, in a fixed sequence. Adente Vision is an edge-AI visual inspection unit built by ADENTE Advanced Engineering Technologies, part of the Aden Group, sold through automation system integrators, and it supports model updates by USB stick precisely so an air-gapped line can be improved without opening a network path.

In practice the steps are: retrain the model off the line on the new examples; export the new model as a versioned package; write it to a controlled USB stick; carry it to the cell and load it onto the unit; run the new model against a known validation set before it judges live parts; and, only once it passes, promote it to production while keeping the prior version on hand. Because the unit trains from about 20 good reference images and completes training in under 48 hours, building the improved model is a short, contained task rather than a long data-collection project, which keeps the update cadence practical even when every deployment is manual.

Each hop in that sequence is a place to apply control: the USB stick is a managed, scanned item, the package carries a version, and the load step is logged. The media is the transport, not the safeguard; the safeguards are the version, the validation and the sign-off around it.

How do you version and roll back a model without connecting the cell?

You version and roll back by treating each model as a numbered, labeled package and keeping the previous one available on the unit, so a bad update is reversible without any network. Every model that goes to the cell carries a version identifier, the date it was built, and a note of what changed and on what data. That record is what makes an offline change auditable after the fact.

Rollback is then simply loading the prior version, the same USB act in reverse. If a new model over-rejects, misses a defect it should catch, or behaves unexpectedly on the first shift, you revert to the known-good version already held on the unit and investigate off the line. Keeping the last known-good model on the cell, not only in the training environment, is what makes rollback a one-step operation instead of an emergency.

Because the whole scheme is numbered and logged, you always know which model is running on which cell, which matters when you run several air-gapped stations and need to reason about them from records rather than a live dashboard.

Update path: connected versus air-gapped

The table sets a connected update against the air-gapped procedure so the extra discipline is visible where it belongs.

How do you validate a new model before it goes live?

You validate a new model by running it against a known set of parts with known verdicts before it is allowed to judge production, so its behavior is proven, not assumed. The validation set is a curated group of good and defective parts, or their images, where the correct answer is already established, and the new model has to reproduce those answers within your accepted tolerance before promotion.

This step is what stops an update from being a gamble. On a connected line you might lean on live monitoring to catch a regression; on an air-gapped line, where you cannot watch a remote dashboard in real time, front-loaded validation is the substitute. You do the checking before the model touches a live part, record the result alongside the version, and only then promote. The specific pass criteria, how close to the reference verdicts the model must land, are yours to set to the cell's cost of a miss versus a false reject, and any per-line number needs measuring on your own parts.

What does change-control sign-off look like for an offline inspector?

Change-control sign-off is the human gate that turns a new model from tested to approved, and on a regulated air-gapped line it is often mandatory. It means a named person, typically quality or plant IT/OT, reviews the version record and the validation result and authorizes the promotion, so there is an accountable decision behind every model running on the floor.

That gate fits the air-gapped workflow naturally, because the deployment is already a deliberate, manual, logged act. The version identifier, the validation result and the sign-off together form the audit trail an inspector on a controlled line needs: what changed, on what evidence, and who approved it. For where the air-gapped unit sits in the plant network and why it stays in the OT zone, see the sibling post on edge versus cloud visual inspection; for how the unit reaches your line through an integrator, see the integrators page; and for the full method, the pillar guide on AI visual inspection.