無模具機械人鈑金單元的實體 AI 系統設計：自主掌控刀具路徑、模型權重與證據

This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://codeatoms.ai/dieless-sheet-metal-cell-aerospace-mro-us/. The operator is described by class, never by name.

An aircraft maintenance, repair and overhaul facility in the United States needs structural brackets, panels and skin sections on demand. Today a low volume part waits for a die that must be designed, cut, stored and paid for before the first blank is bent, or waits for a supply chain the facility does not control. The dieless robotic alternatives on the market arrive with hosted reachback services the facility cannot own, which flight critical provenance rules will not tolerate. The question is narrow: can this serial numbered part be formed now, on a machine the facility owns, to drawing tolerance, with evidence a quality authority will accept, without a die and without a vendor's cloud?

1. Four constraints before any component is named

No vendor cloud and no reachback, because camera imagery and process data on controlled parts are controlled technical data. The facility owns every artifact: weights, trained detectors, toolpath baselines, the record layer and every container image. The record attaches to the serialized part instance, never the part type. And the riskiest assumption is tested first, in metal, on sacrificial aluminium, with a written kill criterion in the facility's own numbers. Each constraint eliminates whole families of choices before anything is bought.

2. One joined record per serialized part

Fourteen objects held as Asset Administration Shells in Eclipse BaSyx: the formed part, the sheet blank with its mill certificate and lot, the dieless cell, the robot arm and stylus, the toolpath program with its CAD revision and compensation passes, the CAD model, the formability analysis, the metrology scan with its instrument calibration state, the force trace, the work order, the nonconformance with its evidence pack, the facility operator and the cell model service with its weights hash. From one serial number a query reaches the mill certificate, the CAD revision, every scan and the calibration state of the instrument that took it, every force trace, the operator who released the program and any disposition. The first article inspection pack is assembled by traversal, not by hand.

3. Six sources, two adapter families, one clock

CAD import, the operator's own sensors, third party software interfaces, the production systems, the quality records system and cell control telemetry over MTConnect all enter read only through an integration adapter or a telemetry adapter; nothing reaches the model directly. Apache Kafka 4.3 in KRaft mode, self managed inside the perimeter, orders events by part serial. An OCP Time Card grandmaster with linuxptp keeps a scan, its force trace and the arm pose on one clock, because a joined record without a shared clock is a guess with a timestamp attached.

4. Detection at the cell, governance in the facility

A fanless industrial inference computer in the cell panel serves Anomalib 2.7.0 for surface and geometric anomaly detection on in-process and post form scans, and Chronos-Bolt for force trace baselines, both Apache 2.0, through ONNX Runtime, interleaved between passes so a flagged pass stops before the next begins. An eight card 48 GB PCIe server in the facility holds the registered models, the thresholds and the versioned springback baselines. Records cross from the cell's OT zone to the facility tier one way, over a hardware data diode running lidi and Eurydice; released programs reach the cell by a signed release path, never a return channel. No language model is committed, so no frontier cluster is sized.

5. The safety function admits no software verdict

Light curtains, the safety PLC and the interlocks own stopping. Around them sit three advisory budgets: detection inside the pause between passes, scan evaluation between acquisition and the deviation map reaching the record, alert routing while the part is still on the fixture. Each is verified against bench measured streams, not asserted on paper. The anomaly detector runs in shadow until its false alarm rate on the facility's own panels is known; only then does its verdict hold a part.

6. Three phases, one kill criterion

Twelve items in a validation prototype on sacrificial blanks, where dual arm synchronization on a large flexible panel, the assumption a previous industry fuselage robotics program failed on, is proven or the work stops at prototype cost. Five items for the production cell, exiting on facility staff running it on their own authority. One item for a steel and titanium limits investigation, reporting achievable accuracy as a range before any production claim.

The design is one of the sovereign AI reference architectures CodeNinja Atoms publishes, each with its sector, country, compute and cost in one table.

The cost line

The priced classes come to about 151,000 US dollars in list prices, and 202,000 to 220,000 over three years with support and power, the structured light scanner and the eight card server most of it. The two compute tiers alone cost about 132,000 dollars to own over three years, about two fifths of the deepest three year AWS commitment for eight L40S cards, which the offline requirement rules out anyway. The laser tracker, the data diode and the safety PLC are sold by quotation and are named but not totalled. The sourced arithmetic is in Appendix A.

Designed on CodeNinja Praxis, the CodeNinja Atoms platform for designing physical AI systems. The object model imports into Hyper Ontology. DOI: 10.5281/zenodo.23308095.