Skip to content

Blog · Edge AI

OT/IT segmentation for a vision cell: where the inspection unit belongs.

Updated July 2026 · 7 min read · Adente Vision Engineering Team

OT/IT segmentation keeps the plant-floor network separate from business IT, and a vision cell belongs on the floor. An edge inspection unit computes pass/fail on-device and signals the PLC over fieldbus or 24V I/O, so it sits in the OT zone with no outbound hole, unlike cloud vision that must reach the internet to decide.

What does OT/IT segmentation mean for a vision cell?

OT/IT segmentation is the practice of separating the operational-technology network that runs the plant floor from the information-technology network that runs the business, so a problem on one side cannot cross into the other. The common reference is the Purdue model, which layers a plant from the physical process and controllers at the bottom (Levels 0-2), through site operations (Level 3), up to enterprise IT and the internet at the top (Levels 4-5). A vision cell that inspects parts and drives a reject belongs at the bottom, next to the PLC it signals.

The segmentation question for inspection is therefore concrete: does adding the vision cell require a new path across the OT/IT boundary, or does it stay inside the OT zone where the rest of the cell already lives. The answer depends entirely on where the inspection decision is computed.

Adente Vision is an edge-AI visual inspection unit built by ADENTE Advanced Engineering Technologies, part of the Aden Group, sold through automation system integrators, and it is designed to sit in the OT zone and talk only to the cell.

Why does cloud vision force a hole in the OT boundary?

Cloud vision forces a hole because the decision is made outside the plant. If the pass/fail comes from a model hosted on an external service, then every cell needs a route from the OT floor, up through the segmentation layers, out to the internet and back, which means an outbound firewall rule and a live dependency that crosses the boundary the segmentation exists to protect. That path is exactly what a plant security team is trying to minimise.

An outbound hole is not only a policy problem, it is an attack-surface problem. Each cell with a route to an external endpoint is one more thing to authenticate, patch, monitor and reason about when assessing what could reach the controllers. The more cells that need the boundary opened, the harder the network is to defend and the weaker the segmentation becomes in practice.

Where does an edge inspection unit sit in the Purdue model?

An edge inspection unit sits low, at the cell and controller levels, and never needs to reach past site operations. The unit captures the image, runs the model on-device and emits the result straight to the PLC, so the entire decision loop stays inside the OT zone at Levels 1-2. No leg of the decision travels up to Level 4 or 5, and so there is no outbound hole to open for inspection to work.

ConcernCloud or networked visionEdge unit in the cell
Purdue placementNeeds a path from Levels 2-3 out to an external serviceLives at Levels 1-2, beside the PLC
Outbound firewall ruleRequires an outbound hole to a cloud endpointNone; no outbound dependency for the decision
Protocols on the wireAdds cloud APIs over IT networkingFieldbus and 24V I/O only, on the OT network
Attack surfaceNew external exposure per cellNo cloud dependency to attack
Data leaving the plantRaw frames cross the boundaryImages stay on the line; nothing crosses

Read across the table and the segmentation story is one-sided: the edge unit adds an inspector to the cell without adding a boundary crossing. Because inference runs on a fanless Jetson-class board inside the enclosure and results go out over fieldbus or discrete I/O, the cell gains a full AI check while the network diagram gains nothing that crosses the OT/IT line.

Which protocols keep the vision cell on the plant network?

The unit talks to the cell over the same industrial protocols the rest of the floor already uses, so nothing has to leave the OT network. Adente Vision speaks PROFINET, EtherNet/IP, Modbus TCP, EtherCAT and OPC UA, and carries discrete signals over 4 inputs and 4 outputs at 24V. A pass/fail, a variant code or a reject command travels as a fieldbus tag or a hardwired signal to the PLC, all on the plant network, none of it routed to an external service.

That protocol set matters for segmentation because it makes the inspector a peer of the PLC, not a client of the cloud. Where a remote dashboard is wanted for monitoring, it can be fed metrics without moving raw frames, and on an air-gapped line model updates arrive by USB stick, so even the update path does not require opening the boundary.

What do you hand plant IT for sign-off?

What you hand plant IT is a short, closed list: an OT-side device that speaks fieldbus and 24V I/O, computes its decision on-device, and has no outbound cloud dependency for inspection. Raw part imagery, which is sensitive process IP, stays on the line, so there is no data-egress rule to write and no external region to risk. The unit's exposure is the same class as any other cell device, not a new internet-facing service.

That is the practical case for placing an edge inspector in the OT zone: it drops into the cell like a smart sensor, keeps the segmentation intact, and gives the integrator a clean answer when the customer's security team asks where the vision unit belongs and what it can reach. For how the unit fits an integrator programme, the broader edge-versus-cloud trade-off in the sibling post on edge vs cloud visual inspection, and the full method in the pillar guide on AI visual inspection.

Frequently asked questions

Need a vision cell that passes a plant security review?

Send us a sample part or your cell network layout, and we show how the unit sits in the OT zone with no outbound hole. Schedule a walkthrough for integrators and plant IT.