A digital model, a digital shadow, and a digital twin are three integration tiers defined by the Kritzinger et al. classification, differing only in how data flows between the physical asset and its digital counterpart [S3].
The split is binary on each axis: a digital model has no automatic data flow in either direction, a digital shadow has automatic physical-to-digital flow only, and a digital twin has automatic flow in both directions [S3]. In a process-plant context this means the same pump skid can sit at any of the three tiers depending on which pressure transmitter, flow meter, and control-loop wiring you decide to install.
Integration levels defined by data-flow direction
The Kritzinger et al. matrix, widely cited in academic reviews of Industry 4.0, scores the three concepts on two axes: physical-to-digital and digital-to-physical data flow, each marked manual or automatic [S3]. A digital model scores manual/manual, a digital shadow scores automatic/manual, and a digital twin scores automatic/automatic, a layout confirmed by the 2025 Brarda et al. systematic literature review covering 47 Scopus, Web of Science, and ScienceDirect articles [S5].
In engineering terms the bar for "digital twin" is therefore not visualization quality, mesh resolution, or AI sophistication; it is closed-loop automatic write-back to the physical asset [S3]. Any vendor that cannot point to an automatic, machine-driven command path from the digital instance back to a pressure sensor, actuator, or industrial valve is, by this definition, selling a digital shadow at best [S2].
Where each tier actually fits a process plant
A digital model is the right tool when the job is design validation: 3D layout of a skidded compressor package, piping isometric checks, or robotics reach studies on a body-in-white line, with no live process data needed [S2]. These models are commonly built in tools such as Visual Components, Plant Simulation, or static CAD, and remain useful for the full equipment life without any sensor retrofit [S2].
A digital shadow fits retrofit projects where the value is monitoring, not control: a SCADA HMI that mirrors the live state of a 50-loop DCS without writing setpoints back [S2]. Examples in the literature include tracking conveyor-belt speed to flag inefficiencies and live condition dashboards fed by a digital panel meter network, where any optimization is done by an operator using the shadow, not by the shadow itself [S2].
A digital twin is justified when the use case requires automatic prediction plus automatic correction, such as model-predictive control on a distillation column, closed-loop optimization of a chiller plant, or autonomous coordination of AGV fleets [S5]. The 2025 Brarda review treats IoT, simulation, and AI as the three enabling technology stacks that only become necessary at the twin tier, because the shadow tier can be served by sensors and dashboards alone [S5].
Cost, integration effort, and failure modes by tier
Cost scales non-linearly. A digital model is essentially an engineering-hours cost on a CAD workstation, no plant instrumentation beyond a laptop is required, and the main failure mode is model drift because nothing in the model updates from the field [S2]. A digital shadow adds the cost of sensor density, network bandwidth, and a historian, with failure modes dominated by data-quality issues: dropped MQTT topics, misaligned time stamps, and unit-of-measure conversion errors that corrupt any downstream analytics [S2].
A digital twin adds the cost of a control-grade connection, with strict requirements on latency, determinism, and cybersecurity before any automatic write-back is permitted [S3]. The twin's specific failure modes are unsafe commands, model over-trust, and the regulatory exposure that comes with letting a software object move a digital multimeter-calibrated actuator; for this reason most plant-scale twins operate in advisory mode even when the architecture supports closed loop [S5].
Decision matrix: pick by use case, not by marketing label
Use the matrix below to choose: if the deliverable is a 3D layout review, a digital model suffices; if it is a live KPI dashboard or predictive-maintenance score, a digital shadow is the right target; if it is closed-loop optimization or autonomous reconfiguration, a digital twin is required and the project must budget for control-grade integration [S3][S5]. The same asset can and often should sit at different tiers in parallel, for example a static digital model for engineering reviews running alongside a live digital shadow for operations, with a digital twin scoped only to the loops where the business case justifies it [S2].
Buyers evaluating vendor proposals should ask, on penalty of label inflation, which of the two data-flow directions is automatic and which is manual, and what physical actuator receives the digital instance's commands [S3]. A useful sanity check is that if the answer is "we feed the model with a daily CSV export," the system is a digital model; if the answer is "the model reads our historian in real time but only displays," it is a digital shadow; only an automatic, machine-driven path back to a flow meter setpoint or a valve positioner qualifies as a digital twin [S2][S3].
When to skip a tier, and when to skip digital entirely
Skip the digital-twin tier when the loop is already well-tuned by a DCS and the marginal value of model-based optimization is below the cost of certifying the write-back path; in brownfield plants this is most loops [S5]. Skip the digital-shadow tier when the only consumer of data is a monthly report, because a manual CSV into a model is cheaper and lower risk than a live historian [S2].
For buyers comparing the licensing model itself across these tiers, the cost difference between per-seat and per-asset schemes can swing a project budget by a factor of three or more, a question covered in Digital Twin Licensing: Per-Seat vs Per-Asset Cost Models Compared. For plants weighing the control-network side of the twin's write-back path, the cyclic refresh setting on the I/O layer is the lever that determines whether the closed loop is stable, as detailed in EtherNet/IP RPI for Remote I/O: Setting the Cyclic Refresh Right.
Trackable signals to watch over the next two quarters: vendor literature shifting from "twin" to "shadow" or "model" labels as the integration-level definition gets enforced in RFPs, and the publication of updated reference architectures from ISO/IEC that codify the Kritzinger classification for procurement use [S3][S5].