TLDR
- An operational twin is a bounded predictive model of state transitions, kept in measured correspondence with a live system. It is useful because proposed actions can be screened before they touch reality.
- A twin must declare its state variables, action envelope, horizon, residual error, calibration time and unsupported regimes. Fidelity is always conditional, never a property of the word “twin.”
- Counterfactual simulation can compare candidate actions under shared assumptions. It cannot reveal unmodelled causes, guarantee a future, or turn observational fit into intervention validity.
- The agent, twin and live executor need separate authority. Identity, policy, freshness, confirmation, idempotency and postcondition readback remain enforceable outside the simulator.
- Give twin evidence decision weight only while intervention tests stay inside the validated envelope and live residuals remain below an explicit expiry threshold.
The perfect rehearsal that failed at midnight
An operations agent manages a nightly data-processing estate. Before each batch, it proposes how many workers to allocate, which jobs to delay and whether to move traffic to a secondary cluster. A simulated copy of the estate predicts that adding twenty per cent capacity will clear the queue before the reporting cut-off. The rehearsal succeeds repeatedly.
At midnight, the live action increases capacity and the queue grows. A downstream licence cap throttles one service. The simulator modelled compute, queue length and job duration; it did not model the shared licence pool. Every predicted component behaved as expected inside the twin. The live system crossed a boundary the twin did not contain.
Calling the simulator a digital twin did not create the missing variable. The failure came from letting resemblance acquire authority. The model had been accurate under ordinary load, so the agent treated its proposed future as evidence that the live intervention was safe.
An operational twin can still be extremely useful. It can expose delayed effects, compare reversible choices, train policies, stage failure injection and reduce experimentation on a costly system. Its value depends on a stricter contract: the twin is a maintained hypothesis about transitions inside a declared envelope. It earns decision weight through intervention tests and loses that weight when live residuals, age or regime change exceed a bound.
That contract changes the architecture. The live system and twin remain separately observable. Candidate actions fan into several futures rather than one forecast. A policy gate decides whether simulation evidence is sufficient. Execution uses scoped identity and idempotency. Readback checks what actually happened. The twin informs the loop; it does not own the loop.
What makes a twin operational
A model becomes operationally twin-like when it participates in a continuing correspondence with a particular live system or class of systems. It receives observations, maintains a state estimate, predicts responses to candidate interventions, compares predictions with effects and updates or expires. A static architecture diagram is not a twin. A dashboard is not a twin. A simulation used once for design may be valuable without being an operational twin.
The word should therefore carry a typed contract:
- referent: which live entities and boundaries the twin represents;
- state: which variables it estimates and at what effective time;
- actions: which interventions it can model;
- dynamics: how state changes under action and disturbance;
- observations: which live measurements correct the estimate;
- horizon: how far predictions retain evaluated meaning;
- uncertainty: what variability and model ignorance are represented;
- validation envelope: the states and actions tested through intervention;
- expiry: conditions that remove decision weight; and
- readback: how predicted effects are compared with observed effects.
Without these fields, “twin” names aspiration. With them, it names an instrument.
Figure 1. The live system and its twin must remain separately observable
The two timelines in the figure are deliberately separate. The twin state is not the live state. At each observation point, a residual measures their difference. A small residual over familiar behaviour supports local correspondence. It does not prove that an untested action will preserve it.
Twin, replica and world model
A replica copies structure or data. A simulator generates trajectories under rules. A state estimator infers unobserved live state. A world model predicts consequences across an environment. An operational twin can contain all four, but none alone establishes the maintained relationship.
The distinction matters in agent design. A replicated database can be stale. A simulator can be accurate only in nominal conditions. A learned world model can generate plausible futures without reliable intervention semantics. A twin contract asks which relationship has been tested and when it expires.
Thought experiment: the twin with no wire back
Build two identical simulators of a warehouse. Simulator A receives daily observations and records residuals after every staffing change. Simulator B was calibrated six months ago and has no live feed. Both generate the same forecast today.
Only A can show whether recent changes preserved correspondence. B may still be a useful scenario model, but calling it a live twin creates false freshness. Now disconnect A’s action-result readback while leaving its sensor feed. It can track ordinary state and still fail to learn that its intervention response has changed.
The experiment varies the correspondence link. It shows that observation fit and intervention fit are different evidence. A twin used to screen actions needs action-conditioned readback, not merely a recent snapshot.
The twin lifecycle is a publication pipeline
Operational correspondence does not arise from a single model-training job. Source events are acquired, reconciled into entities, transformed into state, fitted or parameterised, validated through interventions, released with a bounded envelope, monitored and withdrawn. Each stage has an owner and version.
Start with an event contract. For each observation, record entity, event time, ingestion time, unit, source, quality state and correction semantics. A late measurement may update historical state without becoming evidence that was available to an earlier decision. Store both timelines so replay does not leak the future.
Entity resolution is part of model validity. If the twin joins a queue to the wrong service, or a physical asset to the wrong maintenance record, transition accuracy is irrelevant. Test merges, splits and identity changes. Preserve source identifiers and confidence rather than hiding them behind one synthetic key.
State reconstruction should be deterministic where possible. Event-sourced state lets the team rebuild what the twin believed at a decision time. Learned state estimators need versioned inputs and posterior or confidence information. A current snapshot alone cannot explain an earlier recommendation.
Release resembles knowledge publication. A twin version carries code, parameters, data window, state schema, action definitions, intervention evidence, residuals, uncertainty method and unsupported regimes. Monitoring may deprecate it. A later version supersedes rather than rewriting the earlier record. This lineage is necessary for incident replay.
Figure 3. An operational twin closes two loops
The two loops operate at different speeds. The fast loop screens a proposal using current state and a validated model. The slow loop compares predictions with live effects, investigates residuals and publishes a revised twin. Allowing the fast loop to retrain itself after every surprising outcome can erase evidence and destabilise control.
A twin can be modular without becoming fragmented
Large estates may need several models: demand, capacity, dependency, human response and financial consequence. Give each module a typed input and uncertainty contract. Compose them only where their time scales and entity definitions align.
Error can amplify across modules. If demand uncertainty feeds a nonlinear queue model, the expected queue under expected demand may differ from the expectation across demand scenarios. Pass distributions or samples where the nonlinearity matters. Do not replace every intermediate state with a point estimate for convenience.
Modularity aids replacement and fault localisation. It also creates interface debt. Validate the composed system, not only each module. Two individually accurate models can be jointly inconsistent because they were calibrated on different definitions of capacity or time.
State, actions and horizons
Let be the state at time , a proposed action, an uncontrolled disturbance and an observation. A simple transition model is
with observation model
The parameter encodes learned or engineered dynamics. The disturbance captures influences outside the action. The observation error reminds us that sensors do not reveal state perfectly. A state estimator combines prior state and observations to maintain a belief about .
Every symbol is a boundary decision. If a downstream licence pool affects transitions but is absent from and , the model may explain nominal data while failing under saturation. If operator behaviour changes after an alert, the human response is part of the dynamics. If the twin updates only every hour, a five-minute action may use an obsolete state.
State should be decision-sufficient
The twin does not need a photorealistic copy of everything. It needs enough state to predict the consequences relevant to a bounded decision. Extra detail can add maintenance cost and false confidence. Missing causal state creates bias.
For a service queue, decision-sufficient state might include arrival rate, service capacity, work mix, dependency limits and recovery time. Server colour, rack labels and decorative topology are irrelevant unless they affect transitions. For a regulated workflow, evidence freshness and approval state may matter more than CPU utilisation.
A state-ablation test removes one variable or coarsens its resolution and measures intervention error. If removing a variable changes appearance without changing decision quality, it may not belong in the operational core. If a rare variable dominates high-consequence error, aggregate fit must not wash it away.
Horizon compounds uncertainty
Repeated application of carries error forward. Small one-step residuals can produce large multi-step divergence, especially near unstable boundaries. A twin may support ten-minute capacity decisions and fail for a monthly migration plan.
The horizon belongs in every recommendation. Report a distribution or envelope of possible outcomes, not a single cinematic future. Record which disturbances were sampled and which were omitted. A robust action performs acceptably across plausible trajectories, not only along the mean path.
Figure 2. One proposed action should create several possible futures
The fan in the figure has one action and several possible futures. The central path is a summary. The width carries decision information. If every acceptable future stays within a safety or service boundary, the action may be robust. If a small tail crosses an irreversible threshold, the decision may require more evidence or a safer action.
flowchart LR A["The perfect rehearsal that<br/>failed at midnight"] --> B["What makes a twin operational"] B --> C["State, actions and horizons"] C --> D["Counterfactuals within an envelope"] D -. "re-test" .-> A classDef first fill:#0a1424,stroke:#007D68,stroke-width:2px,color:#e6f3ff classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff class A first class B,C,D step
Counterfactuals within an envelope
An agent usually asks the twin a comparative question: what is expected under action versus action ? The comparison is useful when both actions lie within a region where the transition model has intervention evidence.
Observational prediction is not enough. A model may learn that extra staff appear when queues are severe and conclude that staffing increases queues. The correlation reflects reactive policy. To estimate the action effect, the twin must represent the policy or use intervention, quasi-experimental or causal assumptions that separate cause from response.
In structural form, an intervention replaces the ordinary mechanism for action with a chosen value. The twin then propagates consequences through the remaining dynamics. This is stronger than asking a sequence model to continue a familiar trajectory with an action token inserted.
Thought experiment: swap the operator policy
Historical logs show that operators open a secondary channel whenever latency exceeds a threshold. A learned simulator predicts that opening the channel is followed by high latency. First evaluate it on held-out observational sequences; it performs well. Then randomise the channel in a safe test environment while holding load fixed. If the predicted direction fails, observational fit did not identify the intervention response.
Now include the operator policy and dependency contention explicitly. The simulator can distinguish “channel opened because latency was high” from “channel opening changed latency.” The experiment varies intervention information while preserving the observed data. It exposes the gap between forecasting and acting.
Figure 4. The intervention envelope is narrower than the simulator
The validated envelope combines state, action and horizon. An action can be numerically small and still lie outside it when the system is in an unseen regime. A familiar state can become unsupported under a new action. A familiar action can become unsupported over a longer horizon.
Envelope tests
Build the envelope from intervention coverage, not the convex hull of historical points. Useful tests include controlled action sweeps, fault injection, boundary perturbations, policy changes and counterfactual replay against known effects. Mark regions with sparse or conflicting evidence.
When the agent proposes an out-of-envelope action, the correct result
is unsupported, not an extrapolated number with hidden
confidence. The system may run a safer experiment, gather evidence, use
a conservative policy or escalate. Refusal is part of twin
competence.
Uncertainty has two origins
Aleatoric uncertainty represents variability that persists even with a correct model: random arrivals, weather, human choices or component noise. Epistemic uncertainty represents ignorance about the model, parameters or regime. More relevant evidence can reduce epistemic uncertainty. Robust action design addresses aleatoric variation.
Figure 5. Model uncertainty and process randomness demand different responses
Conflating them produces poor responses. Averaging more simulations cannot repair a missing causal variable. Declaring a system unknowable can hide a model that simply needs calibration. Ensembles, posterior models, residual analysis and regime detectors can expose some epistemic uncertainty; none guarantees that all missing mechanisms are represented.
Residuals, calibration and expiry
After a live action, compare predicted and observed state. A residual may be
Residuals should be analysed by variable, horizon, action, regime and consequence. A mean near zero can hide alternating large errors. Normalise only when the denominator has operational meaning. Preserve absolute error for variables where small denominators would inflate ratios.
The twin carries a calibration receipt: data window, intervention set, parameter version, residual distribution, unresolved anomalies and effective time. Decision weight decays as the live system changes. The expiry rule may depend on age, residual threshold, detected regime, schema change, policy change or unverified deployment.
Figure 7. Twin usefulness decays between calibration events
The saw-tooth pattern represents calibration debt. Between observations, uncertainty and unmodelled change accumulate. A recalibration event reduces measured debt only if its validation includes the relevant actions. Refitting on passive observations may improve state tracking while leaving intervention error untouched.
Optimisers search for model error
An ordinary user may query a twin near familiar actions. An optimiser or capable agent deliberately searches the action space for high reward. This distribution is shaped by the model itself. It concentrates on regions where small prediction errors look like opportunities.
In simulation-based control this is sometimes called model exploitation. A policy discovers a manoeuvre that succeeds only because friction, latency, resource contention or human response is simplified. The simulated reward rises while live performance falls.
Test proposed optima against an ensemble of plausible models, withheld simulators or higher-fidelity environments. Penalise epistemic uncertainty. Restrict optimisation to the validated envelope and keep distance from hard safety boundaries. Randomise uncertain parameters during training, then validate against fixed stress cases the policy did not see.
Most importantly, apply one bounded action and re-observe. Receding-horizon control limits commitment. An agent should not execute a long plan merely because every step succeeds in one simulated branch. Later actions depend on verified state.
Security belongs in the correspondence contract
A twin concentrates valuable operational state and a map of possible interventions. Attackers may poison observations, alter parameters, spoof entity identity, extract sensitive trajectories or use the simulator to discover harmful actions.
Separate read, simulate, calibrate, publish and execute permissions. A planning agent may query an aggregated state without receiving raw personal data. A calibration service may write candidate parameters without activating them. Publication requires validation and an auditable owner. Execution accepts only policy-approved action contracts.
Sign or otherwise integrity-protect model versions and critical observations. Detect impossible state transitions, sudden residual changes and source disagreement. Preserve a clean fallback model or conservative rule. If observation integrity is uncertain, twin confidence should fall; the system must not treat poisoned consistency as calibration.
Prompt injection can enter through descriptive state or maintenance notes. Treat those fields as data, never as authority to change twin behaviour. Tool and model boundaries remain explicit even when the agent reads natural-language operational context.
Residuals are diagnostic, not just alarms
Structured residuals point to missing mechanisms. Error that grows with load suggests capacity nonlinearity. Error after one action suggests an incorrect control effect. Error isolated to one subgroup suggests aggregation. Error at long horizons suggests compounding or unmodelled feedback.
Store the residual with the proposal, assumed state, action, predicted distribution, observed state and source versions. This creates a falsification record. The twin improves by confronting where it was wrong, not by overwriting old predictions after the outcome arrives.
Negative control: a polished replay
After an incident, fit the twin using data that includes the incident and show that it reconstructs the trajectory. This demonstrates retrospective capacity, not prospective warning. The negative control freezes the pre-incident twin and asks what it predicted with evidence available at the time. If only the refitted version succeeds, do not describe the original system as predictive.
A bounded twin in code
The executable artefact models a queue and capacity. Its state is
intentionally tiny. The twin declares calibration time, maximum age,
permitted action magnitude and residual limit. A proposal inside the
envelope produces a predicted state labelled only
eligible-for-policy-check. A larger action raises an error.
Observed readback is compared with the prediction.
. It uses only the Python standard library and includes positive and negative cases.
#!/usr/bin/env python3
"""A bounded operational twin with envelope, expiry and readback checks."""
from __future__ import annotations
from dataclasses import dataclass
@dataclass(frozen=True)
class State:
queue: float
capacity: float
@dataclass(frozen=True)
class Twin:
calibrated_at: int
max_age: int = 5
max_action: float = 0.25
residual_limit: float = 0.08
def simulate(self, state: State, action: float, now: int) -> State:
if now - self.calibrated_at > self.max_age:
raise ValueError("Twin expired: refresh from live observations")
if not -self.max_action <= action <= self.max_action:
raise ValueError("Action lies outside the validated intervention envelope")
capacity = max(0.1, state.capacity * (1 + action))
queue = max(0.0, state.queue - 0.55 * capacity)
return State(queue=round(queue, 3), capacity=round(capacity, 3))
def verify_readback(self, predicted: State, observed: State) -> bool:
queue_residual = abs(predicted.queue - observed.queue) / max(1.0, observed.queue)
capacity_residual = abs(predicted.capacity - observed.capacity) / max(1.0, observed.capacity)
return max(queue_residual, capacity_residual) <= self.residual_limit
def screen(twin: Twin, state: State, action: float, now: int) -> dict:
predicted = twin.simulate(state, action, now)
return {
"proposal": action,
"predicted": predicted,
"recommendation": "eligible-for-policy-check" if predicted.queue < state.queue else "reject",
"authority": "simulation only; live policy and identity checks remain mandatory",
}
def run() -> None:
twin = Twin(calibrated_at=100)
current = State(queue=12.0, capacity=4.0)
positive = screen(twin, current, action=0.20, now=103)
observed = State(queue=9.4, capacity=4.75)
readback_ok = twin.verify_readback(positive["predicted"], observed)
try:
screen(twin, current, action=0.60, now=103)
except ValueError as error:
negative = str(error)
else:
raise AssertionError("Out-of-envelope action was not rejected")
print({"positive": positive, "readback_ok": readback_ok, "negative": negative})
assert positive["recommendation"] == "eligible-for-policy-check"
assert readback_ok is True
assert "outside" in negative
if __name__ == "__main__":
run()
The positive case increases capacity by twenty per cent within the evaluated range and verifies a close live observation. The negative case proposes sixty per cent, outside the intervention envelope, and is rejected before simulation.
The code omits identity, policy and execution on purpose. Its output
says simulation alone cannot authorise the action. Extend it by making
the state schema explicit, sampling disturbances, returning quantiles
and storing calibration receipts. Do not extend it by letting a boolean
called safe bypass the action gateway.
stateDiagram-v2 [*] --> Claim state "Figure 1. The live system and<br/>its twin must remain<br/>separately observable" as Claim state "Twin, replica and world model" as Test state "Thought experiment: the twin<br/>with no wire back" as Revision Claim --> Test: expose mechanism Test --> Decision: evidence survives Test --> Revision: rival survives Revision --> Claim: narrow or rebuild Decision --> [*]
A production-shaped twin
Consider a bank’s customer-service operation. The live system includes incoming contacts, skill queues, adviser availability, authentication steps, downstream service times and vulnerable-customer rules. The agent proposes routing and staffing changes for the next hour.
The twin state includes arrival rates by contact type, service-time distributions, current queue age, skill capacity, transfer probabilities and rule-constrained routes. It excludes individual message content and uses aggregated or synthetic data for planning. Actions include bounded staffing moves and route weights. The horizon is sixty minutes.
The team validates ordinary changes through shadow recommendations and controlled pilots. It injects surges, dependency delays and adviser absence in simulation. Every live pilot retains a control group or matched counterfactual where practical. Residuals are sliced by contact type and vulnerability route.
The twin identifies that moving two advisers from a low-demand queue could reduce the ninety-fifth percentile wait elsewhere. The policy gate rejects the move because one adviser holds a required specialist skill and minimum coverage would be breached. Simulation improved the proposal; policy preserved an obligation absent from the objective.
Later, a new authentication step increases service time. Residuals cross the expiry threshold. The agent falls back to conservative routing and the twin loses decision weight until recalibrated. This is graceful degradation, not twin failure. A system that continues producing precise recommendations would be less competent.
Worked minimal example: thermostat with a delayed room
A room heats with a ten-minute lag. A reactive agent sees low temperature and repeatedly increases power. A twin with delay state predicts overshoot and suggests one bounded pulse. The model is useful because it represents a hidden transition.
Open a window. If window state is unobserved, the residual grows and the twin expires. Adding a camera is not automatically the answer; privacy and reliability matter. The system may instead use a conservative controller until temperature response identifies the disturbance.
Model-predictive control as a disciplined pattern
Model-predictive control repeatedly estimates state, optimises a finite sequence of actions, applies only the first action, observes the system and replans. This receding horizon limits commitment to distant predictions. Constraints can be enforced during optimisation.
Agent plus twin can borrow the pattern without pretending that language generation is a controller. The agent frames objectives and alternatives. The twin predicts. A deterministic optimiser or policy selects within constraints. The executor applies one bounded action. Readback closes the loop.
Human response can be part of the dynamics
Operational systems often include people who adapt to recommendations. Advisers may trust some alerts, ignore others or change work to satisfy a metric. Customers may respond to offers. Operators may compensate for a model’s known bias. A twin that treats humans as fixed service rates can fail after the interface changes behaviour.
Represent human response at the coarsest level sufficient for the decision and protect dignity. Do not infer a detailed psychological copy when an observed queue-response curve is enough. Test interfaces with real users, measure workload and preserve override. Some preferences and rights belong in policy constraints, not a behavioural predictor.
Feedback creates reflexivity. If the twin predicts congestion and the agent reroutes traffic, the predicted congestion may never occur. That does not make the model wrong. Evaluation should compare action-conditioned outcomes and record which recommendation changed the system. Otherwise successful prevention looks like overprediction.
Price the twin against a simpler controller
A twin has continuing cost: data integration, state reconstruction, calibration, simulation, security, monitoring and incident review. Compare it with a queue formula, rule table, statistical forecast or supervised human planner. Use the same outcome, constraint and recovery measures.
The twin earns its cost when interactions, delayed effects or counterfactual actions materially change decisions. It may be justified for high-value recurrent control and excessive for rare simple choices. A small system can begin with one validated module and add detail only after residuals show a decision-relevant gap.
Measure value of information. If all plausible twin futures choose the same safe action, additional fidelity does not alter the decision. If small uncertainty changes which action crosses a hard boundary, invest in observation or use a conservative policy. Simulation quality matters through the action it changes.
Retirement is part of the lifecycle. A process redesign, stable deterministic controller or uneconomic maintenance burden may end the twin. Preserve its evidence for replay, withdraw live authority and remove stale interfaces. A twin should not persist because its visualisation is impressive.
Procurement should use the same test. Ask a vendor to expose state definitions, intervention coverage, residuals, expiry and readback rather than a polished three-dimensional view. If those artefacts cannot be exported and audited, the organisation is buying a simulation service, not verified operational correspondence.
The contract should also state who owns mismatch resolution. When the live system and twin disagree, operators need a bounded rule for pausing recommendations, preserving both states, investigating the observation path and restoring authority. A service-level promise for uptime is not enough. The critical promise is how quickly an untrustworthy mirror stops steering the world.
Test that rule in a rehearsal before launch. Inject a stale sensor, an impossible state and a delayed effect, then verify that the recommendation expires, the live action pauses and the evidence survives investigation. A mismatch procedure that exists only in prose will fail at the first operational ambiguity.
The twin readiness record
Figure 8. The readiness test ends with a counterfactual audit
| Field | Required evidence | Expiry trigger |
|---|---|---|
| Referent and state | Entity boundaries, variables, units, effective time and observation sources | Schema, topology or entity-resolution change |
| Action envelope | Intervention coverage by state, magnitude and duration | Proposed action or regime leaves coverage |
| Horizon | Error and uncertainty by forecast distance | Requested horizon exceeds validated range |
| Causal validity | Controlled intervention, natural experiment or defended structural assumptions | Policy or confounding process changes |
| Residuals | Distribution by variable, action, regime and consequence | Threshold, drift pattern or unmodelled mode appears |
| Authority | Separate identity, policy, confirmation and execution contracts | Twin output can bypass a deterministic gate |
| Readback | Effect identity, postcondition query and unknown-outcome route | Action effect cannot be verified |
| Fallback | Conservative policy, hold or human route | No safe behaviour exists after expiry |
The record should accompany every recommendation. A compact response can include twin version, state snapshot, action, predicted distribution, envelope status, residual status, expiry time and unsupported assumptions. The receiving policy engine needs those fields more than a narrative explanation.
Where the mirror ends
An operational twin fails when its boundary is mistaken for the world. Unmodelled dependencies, strategic behaviour, rare combinations and irreversible changes can invalidate local fit. A simulator can also be gamed by an optimiser that discovers unrealistic loopholes. The more aggressively an agent searches the twin, the more likely it is to find model error rather than real opportunity.
The strongest objection is economic. Maintaining state correspondence, intervention tests and residual pipelines can cost more than the decisions justify. Many workflows need a simple rule, queue model or scenario spreadsheet. The objection should be accepted when a lighter model gives the same decision quality within risk tolerance. “Twin” is not a maturity badge.
Another boundary is ethical. A detailed human twin may invite invasive inference or automated treatment. Decision sufficiency and data minimisation should constrain state. People need contestability where predictions affect them. A more faithful model does not create legitimate purpose.
The midnight failure began when a successful rehearsal was allowed to stand in for the live effect. The repair is architectural and epistemic. Keep twin and world separately observable. Give every forecast an envelope and expiry. Let several futures survive. Preserve deterministic authority. Read back the effect.
The twin earns trust by making its divergence visible. A model that can say “unsupported,” expire itself and record residuals is more useful than a perfect-looking copy with no boundary. Its purpose is not to make an agent feel that it has already acted. Its purpose is to make the next real action smaller, better tested and easier to recover.
sequenceDiagram participant Q as Question participant M as Mechanism participant E as Evidence participant D as Decision Q->>M: The perfect rehearsal that failed at midnight M->>E: Figure 1. The live system and its twin must remain separately observable E-->>M: compare rival explanations E->>D: Sources D-->>Q: revise scope or act
Sources
- Primary Glaessgen and Stargel, The Digital Twin Paradigm for Future NASA and U.S. Air Force Vehicles, 2012.
- Reference Fuller et al., Digital Twin: Enabling Technologies, Challenges and Open Research, 2020.
- Primary Rawlings, Mayne and Diehl, Model Predictive Control: Theory, Computation, and Design, second edition.
- Primary Pearl, Causal Inference in Statistics: An Overview, 2009.
- Primary Tobin et al., Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real World, 2017.
- Primary Ha and Schmidhuber, World Models, 2018.
- Official ISO, ISO 23247 Digital Twin Framework for Manufacturing, official standard family.
- Official NIST, Digital Twins for Advanced Manufacturing, official programme material.