Research libraryEdge to Dashboard
Chapter 07 of 14 · Part II · Draft web edition
The connected factory must lose remote services before it loses local evidence, and lose local evidence before it ever loses safe machine operation.
The cloth is woven from this chapter's 5 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.
Read-out
Illustrative zone-and-conduit design informed by NIST SP 800-82 Rev. 3 (S17), IEC 62443-3-2 (S19), CISA CPG 2.0 (S20) and IEC functional-safety principles (S23). Not a representation of an implemented GFT plant.
Unit: architectural zones. Status: illustrative. Sources: S17, S19, S20, S23. Illustrative figures are teaching examples, not measured factory results.
Overture · 1 min
A connected textile factory must never share a single failure boundary between its external cloud services, its plant historian and its shop-floor machines.[S17] Where electrical interruptions and wide-area network drops occur regularly, treating full connectivity as a precondition for production either halts manufacturing unnecessarily or trains supervisors to bypass digital records whenever a link flickers.[S32] Green Future Tech Limited (GFT), Hong Kong SAR, designs the continuity architecture so that capabilities shed in a strict sequence from the outside in.[S17] Remote convenience fails first, central plant dashboards degrade second, local edge buffering persists third, and machine control alongside automatic protective safety continues undisturbed at the core.[S19] Recovery reverses that sequence through controlled buffer replay, timestamp reconciliation and exercised restoration.[S22]
This rule serves Cameroon's cotton-to-garment sector, where inherited records indicate that approximately 95 percent of cotton fibre is exported raw and about 5 percent is processed locally, alongside a national target of 50 percent local processing by 2030.[R06] Because domestic mills such as CICAM have suffered severe capacity underutilisation across spinning, weaving and finishing assets, any modernised or greenfield facility must protect machine availability while building an unbroken audit trail of throughput, quality and resource intensity.[R12] Earlier chapters established how asset identity and time discipline turn signals into events, how brownfield capture isolates legacy controllers, and how edge inference keeps inspection on the line.[S01] This chapter specifies how network zones, power telemetry, remote-access conduits and isolated backups hold those functions together when external links or utility feeders fail.[S19]
7.1
Related · chapter 138 paragraphs step it
Read-out
Illustrative zone and responsibility separation informed by IEC 62443-3-2 zones and conduits (S19), IEC functional safety principles (S23) and IEC 61508-1 E/E/PE safety-related system scope (S1302). Protective actuation never traverses the edge, operations or external layers.
Unit: . Status: illustrative. Sources: S19, S23, S1302. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗An industrial network fails all at once when every device, database, workstation and gateway resides on a flat address space without enforced boundaries.[S19] In a flat network, a misconfigured vendor laptop, a switch broadcast storm or office malware can reach programmable logic controllers, operator panels and inspection cameras simultaneously.[S17] To prevent cascading disruption, IEC 62443-3-2 establishes security zones and conduits as the primary structural method for industrial automation and control system design.[S19] A zone groups physical and logical assets sharing common operational responsibilities and security requirements, while a conduit defines the exclusive pathway through which two zones exchange permitted traffic.[S19]
GFT organises the factory network into distinct zones aligned with ISA-95 and IEC 62264-1, augmented by an industrial demilitarised zone (DMZ) and an independent safety-related zone.[S01] Each zone has an operational owner, a survival requirement during utility or link loss, and a default-deny posture against undocumented connections.[S02] Rather than allowing business applications at Level 4 to poll shop-floor controllers directly, every cross-layer conversation terminates at a governed boundary.[S19]
The outermost layer is the Business Information Technology Zone, hosting enterprise resource planning, office workstations, internet gateways and cloud synchronisation services.[S01] Below it sits the Industrial DMZ, a buffer zone that terminates inbound remote-access sessions, hosts replica brokers, stages approved updates and blocks direct routing between office networks and the factory floor.[S19] Beneath the Industrial DMZ lies the Plant Operations Zone, corresponding to IEC 62264-1 Level 3 manufacturing operations management, where the central site historian, the governed key performance indicator (KPI) service, manufacturing execution software and plant-wide dashboards operate.[S02]
Closer to the physical process, the Edge Acquisition and Buffering Zone contains line-level gateways, local databases, protocol adapters and vision-inference nodes described in ETSI's multi-access edge computing framework and W3C's industrial edge pattern.[S16] Below the edge nodes sits the Production Operational Technology (OT) Zone, subdivided by manufacturing cell or line so that spinning frames, looms, dyeing vats, cutting tables and sewing lines do not share a broadcast domain.[S17] Finally, the Safety-Related Zone encompasses emergency-stop circuits, safety relays, light curtains, guard interlocks and thermal or pressure trips, which provide automatic functional safety in response to hazards and never depend on edge gateways, plant brokers or enterprise networks.[S23] The structural relationship across these layers is shown in Exhibit 28.[S19]
As Exhibit 28 illustrates, placing the Industrial DMZ between Business IT and Plant Operations ensures that an office outage or compromise cannot propagate into production.[S19] While Exhibit 28 defines the containment hierarchy, it cannot specify physical cable routing, switch backplane capacity or firewall rule tables for a specific mill building, which require a site audit before commissioning.[S17]
Defining zones is ineffective if conduits permit broad port ranges or unauthenticated bidirectional traffic.[S19] Every conduit in GFT's architecture is documented as a contract recording source zone, destination zone, initiating asset, permitted protocol, transport encryption, credential mechanism, bandwidth limit and link-failure behaviour.[S19] Conduits between the Edge Acquisition Zone and Plant Operations Zone carry MQTT messages suited to constrained bandwidth environments with Sparkplug session state, accompanied by Network Time Protocol (NTP) synchronisation and structured syslog notifications conforming to RFC 5424.[S05]
Where production evidence moves from the Plant Operations Zone to Business IT or an external cloud service, the conduit terminates inside the Industrial DMZ rather than spanning both firewalls in one hop.[S17] The internal historian or broker publishes selected aggregates to a DMZ relay service, and the enterprise consumer pulls from that relay across a separate external conduit.[S14] If the wide-area network fails or the external firewall blocks traffic, the internal conduit between edge nodes and the plant historian experiences zero routing change.[S19]
Acceptance testing for zones and conduits verifies positive and negative assertions before the network carries live traffic.[S19] Engineers confirm that authorised payloads cross each conduit within latency bounds, and execute negative tests proving that unauthorised protocols, reverse-initiated connections from Business IT into Production OT, and lateral traffic between separate lines are rejected and logged via RFC 5424 syslog messages.[S0702] Any conduit for vendor maintenance remains disabled by default and follows the session rules established later in this chapter.[S20]
7.4
Exhibit 299 paragraphs step it
Read-out
Illustrative degradation and recovery sequence derived from NIST OT reliability principles (S17), NIST SP 800-34 Rev. 1 contingency planning (S22), IEC functional safety (S23) and Sparkplug offline buffering (S40).
Unit: ordered operational stages. Status: illustrative. Sources: S17, S22, S23, S40. Illustrative figures are teaching examples, not measured factory results.
When electrical supply degrades or network links drop, an uncoordinated factory suffers partial failures: operator screens freeze on old numbers, edge scripts block waiting for remote acknowledgements, and supervisors lose confidence in displayed metrics.[S40] NIST Special Publication 800-82 Rev. 3 emphasises that operational technology security and architecture must address unique performance, reliability and safety requirements alongside confidentiality and integrity.[S17] Network degradation must therefore follow a deterministic shedding order in which external convenience is sacrificed immediately to preserve local measurement, and local measurement is sacrificed if necessary to preserve safe physical operation.[S23]
GFT defines six ordered operational states through which the factory transitions as connectivity or power degrades, paired with a reverse sequence for recovery.[S17] Each transition is triggered by observable link, broker or power telemetry rather than guesswork, and maps to an explicit decision owner.[S22] The sequence is presented in Exhibit 29.[S17]
As shown in Exhibit 29, the first capability shed during a wide-area disruption is Stage 1: remote cloud analytics, off-site replication, vendor telemetry and non-urgent downloads across the external router.[S14] Because local operations in the Plant Operations Zone and Edge Acquisition Zone do not depend on cloud execution, shedding Stage 1 has zero effect on shift huddles, line inspection or machine control.[S16] If internal bandwidth degrades or the plant switches to backup generation with constrained load, Stage 2 sheds nonessential internal traffic, including archive exports and training-image uploads.[S17]
If the Plant Operations Zone server cluster or site-wide broker becomes unreachable, the architecture enters Stage 3 and Stage 4.[S40] In Stage 3, central dashboards mark affected metrics as stale using Sparkplug session-state conventions rather than displaying the last received figure as live production.[S40] In Stage 4, the central historian suspends downstream KPI batch aggregations for missing intervals so that partial denominators do not corrupt shift-level overall equipment effectiveness (OEE) calculations under ISO 22400-2.[S08]
Simultaneously, the factory operates in Stage 5 inside the Edge Acquisition Zone: line gateways continue polling programmable logic controllers and energy metres, camera nodes execute local defect inference, and every event is written with its source timestamp into local non-volatile storage.[S29] Even if an individual edge gateway fails during a prolonged crisis, the line transitions cleanly to Stage 6: machine controllers, local human-machine interfaces (HMIs) and functional-safety circuits continue operating while operators record hourly output, rejects and downtime on manual fallback sheets aligned with the KPI dictionary.[S23] While Exhibit 29 establishes the sequence of degradation and restoration, timeout thresholds in seconds for each transition must be tuned to the polling intervals of each work centre.[S08]
Separating machine control from digital capture prevents network glitches from causing mechanical stops, but raises a governance question: how long should a factory continue manufacturing when its digital measurement layer is degraded?[S22] The answer depends on which layer has failed and what risk unmeasured operation creates for product quality, traceability and worker safety.[S17]
Under IEC functional-safety principles, any failure inside the Safety-Related Zone, such as a faulted emergency-stop relay, a bypassed light curtain or an inoperable pressure trip, triggers immediate automatic protection and halts the affected equipment regardless of network health.[S23] Conversely, when the Safety-Related Zone and Production OT Zone are healthy but the Edge Acquisition Zone or Plant Operations Zone is degraded, production continues under manual fallback procedures documented in the contingency plan.[S22]
For discrete garment assembly and cutting lines, if an edge gateway fails, supervisors revert to hourly paper tally cards capturing good pieces, reworked pieces, defect codes and downtime minutes at the end of each hour, preserving the elements required by ISO 22400-2 for later reconciliation.[S08] For continuous processes such as fabric inspection or dyeing, losing an edge camera cell or bath-temperature logger requires shifting to a reduced line speed or an increased manual inspection sampling rate specified in the use-case contract so that defective rolls are not shipped blind.[S22] The contingency plan sets a maximum duration for manual fallback per process before the plant manager reviews whether to pause the line or reallocate maintenance resources.[S22]
7.7
Machine telemetry
Machine telemetry: adds 518. Running total 518 megabytes (illustrative 72-hour outage) · illustrative
Claiming that an edge node buffers data offline is meaningless unless the architecture specifies what is stored, how much capacity is provisioned, how records are evicted if an outage exceeds the design horizon…
Sub-metre logs
Sub-metre logs: adds 31. Running total 549 megabytes (illustrative 72-hour outage) · illustrative
DB index overhead
DB index overhead: adds 366. Running total 1,096 megabytes (illustrative 72-hour outage) · illustrative
Structured subtotal
Structured subtotal: total 1,096. Running total 1,096 megabytes (illustrative 72-hour outage) · illustrative
Flagged defect crops
Flagged defect crops: adds 1,296. Running total 2,392 megabytes (illustrative 72-hour outage) · illustrative
SSD headroom reserve
SSD headroom reserve: adds 608. Running total 5,000 megabytes (illustrative 72-hour outage) · illustrative
Total edge quota
Total edge quota: total 5,000. Running total 5,000 megabytes (illustrative 72-hour outage) · illustrative
The method behind it: Method.
Illustrative 72-hour edge storage budget derived from the worked example inputs: 518 MB machine telemetry, 31 MB sub-metre logs, 181 MB RFID and defect metadata, 366 MB database index overhead (totalling 1,096 MB structured store), 1,296 MB flagged defect crops, 2,000 MB rolling calibration ring buffer and 608 MB wear-levelling reserve, reconciling to 5,000 MB. Informed by S22, S29 and S40.
Unit: megabytes (illustrative 72-hour outage). Status: illustrative. Sources: S22, S29, S40. Illustrative figures are teaching examples, not measured factory results.
7.7 · the bodyExhibit 30 above; its figures are illustrative where marked.
Claiming that an edge node buffers data offline is meaningless unless the architecture specifies what is stored, how much capacity is provisioned, how records are evicted if an outage exceeds the design horizon, and how historical data is flushed without overwhelming the broker upon reconnection.[S40] In Sparkplug 3.0.0, when the Primary Host Application publishes a state message indicating that it is offline, or when the broker connection drops, the edge node stores metric updates locally and flushes that historical data once the Primary Host Application returns online.[S40] Turning that mechanism into dependable engineering requires explicit storage arithmetic and replay discipline.[S29]
An industrial edge gateway in a textile plant handles two classes of data that must never compete for the same storage pool.[S29] The first class consists of compact structured records: machine cycle counts, status transitions, energy and water metre readings, RFID bundle events, and tabular defect-inference results carrying timestamp, asset identifier, defect class, confidence and coordinates.[S40] As shown in edge energy-monitoring deployments, storing metre readings in a local database at the edge allows the gateway to compute derived parameters locally and persist compact time-series rows across link interruptions.[S29]
The second class consists of high-volume diagnostic media, notably camera frames from fabric-inspection stations.[S16] If a line-scan camera writes uncompressed frames into the disk partition holding the store-and-forward buffer, a multi-hour outage will fill the disk, crash the database and halt event capture.[S22] GFT enforces partition separation at the edge: structured events and metre time series occupy a dedicated storage pool sized for a multi-day outage, while diagnostic image crops use a separate circular ring buffer that overwrites the oldest unflagged frames first without encroaching on event persistence.[S29]
The breakdown of this 72-hour edge storage allocation is shown in Exhibit 30.[S29]
The breakdown of this 72-hour edge storage allocation is shown in Exhibit 30
S29
As Exhibit 30 demonstrates, structured telemetry, sub-metre readings, RFID events and defect metadata together with indexing overhead require only 1,096 megabytes over an illustrative 72-hour outage, less than a quarter of a 5,000 megabyte partition.[S29] Even a modest solid-state drive preserves weeks of structured evidence provided that camera frames remain confined to a ring buffer.[S40] What Exhibit 30 cannot establish is flash wear under elevated temperatures in a spinning or dyeing hall, which requires storage rated for the site's thermal envelope and health monitoring via the gateway.[S17]
When a severed conduit returns to service, naive edge implementations dump their queued backlog onto the broker at wire speed.[S40] That behaviour creates three hazards: it saturates the link so live events and alerts are delayed, it causes out-of-order updates where an old buffered reading overwrites a newer live reading, and it produces duplicate counts if a connection flickers during replay.[S40]
GFT prevents replay chaos through four rules at the edge-to-broker interface.[S40] First, live state and historical backfill travel with explicit semantic distinction: under Sparkplug 3.0.0, when the Primary Host Application publishes its online STATE message, the edge node establishes current session state via birth certificates (NBIRTH and DBIRTH) so live consumers immediately see current machine status, and historical records are ingested using their original source timestamps rather than arrival time.[S40] Second, the edge node prioritises structured telemetry and event metadata ahead of diagnostic image crops, flushing the compact records needed for ISO 22400-2 KPI reconstruction before bulk media.[S08]
Third, historical flush is rate-limited to a fraction of conduit capacity so real-time production messages and heartbeats retain head-of-line priority.[S17] Fourth, every buffered event carries a deterministic identifier combining the ISA-95 asset identifier, source timestamp, clock-synchronisation quality state and a monotonic sequence number, allowing the historian in Chapter 09 to perform idempotent upserts and discard duplicates.[S31] If an outage lasts so long that even the structured partition nears capacity, the eviction policy preserves hourly summaries, quality dispositions and audit logs while down-sampling high-frequency analogue waveforms first.[S29]
Interlude · the cloth half-woven
Woven: sections 7.0 to 7.7Still to weave: 7.10 to 7.16
Read-out
GFT arithmetic from World Bank Enterprise Surveys Cameroon 2024 Country Profile (S32). Outage-incidence gap against Sub-Saharan Africa: 93.3 percent minus 69.7 percent equals 23.6 percentage points. Outage-incidence gap against lower-middle-income economies: 93.3 percent minus 55.0 percent equals 38.3 percentage points. Monthly frequency excess: 10.4 minus 6.9 equals 3.5 outages per typical month. Compares all surveyed firms, not textile factories.
Unit: percentage points and monthly events. Status: derived. Sources: S32.
Read this exhibit in its chapter ↗7.10
Read-out · sourced
Sourced macro context from ITU Facts and Figures 2024 (S33) and World Bank Cameroon 2024 Enterprise Survey Country Profile, published 2025 (S32). ITU figure is a regional population coverage indicator, not a factory link-quality metric. World Bank figures cover all surveyed formal private firms in Cameroon, not a textile-only sample.
Unit: percent and monthly count. Status: sourced. Sources: S32, S33.
In factories with stable grids and redundant fibre rings, engineers often treat electrical supply and telecommunications as background utilities managed solely by facilities or IT staff.[S17] In Cameroon and Central Africa, power and connectivity directly shape when machines run, why energy intensity fluctuates and why telemetry contains gaps.[S32] If the architecture fails to record utility and link status alongside machine events, a plant manager reviewing yesterday's dashboard cannot tell whether a zero-output hour on a weaving line resulted from mechanical breakdown, material starvation, a blackout or a dead switch.[S29]
Two institutional datasets illustrate why GFT treats power and connectivity interruptions as baseline operating conditions.[S32] First, in the World Bank's Cameroon 2024 Enterprise Survey Country Profile (fieldwork June 2024 to February 2025), 93.3 percent of surveyed formal private non-agricultural firms reported experiencing electrical outages, compared with 69.7 percent across Sub-Saharan Africa and 55.0 percent across lower-middle-income economies, with surveyed Cameroonian firms reporting 10.4 outages in a typical month against 6.9 in Sub-Saharan Africa.[S32] Second, the International Telecommunication Union (ITU) reports in Facts and Figures 2024 that Africa has the largest mobile-network coverage gap globally, with 14 percent of the population lacking access to a mobile-broadband network.[S33] These indicators are summarised in Exhibit 31.[S33]
93.3 percent of surveyed formal private non-agricultural firms reported experiencing electrical outages
S32
It is essential to state what Exhibit 31 does and does not establish.[S33] The ITU's 14 percent figure measures the share of Africa's population outside a mobile-broadband footprint in 2024; it does not measure packet loss, latency, jitter or availability inside an industrial zone in Douala, Dibamba or Garoua.[S33] Similarly, the World Bank's 93.3 percent outage incidence and 10.4 monthly outage frequency represent all surveyed formal private firms in Cameroon rather than a specific textile mill's feeder reliability.[S32]
The ITU’s 14 percent figure measures the share of Africa’s population outside a mobile-broadband…
S33
Nevertheless, Exhibit 31 proves that assuming continuous wide-area connectivity or uninterrupted utility power is an engineering error.[S32] Before selecting any cloud dependency or wireless backhaul, GFT requires a site link and power survey measuring round-trip latency, packet loss, spectrum interference, availability and voltage stability over representative shifts, while sizing local uninterruptible power supplies (UPS) and edge buffers to ride through utility transitions.[S31]
To make degraded operation legible to operators and KPI services, the Edge Acquisition Zone captures infrastructure telemetry using the same clock discipline and event contract applied to production machines.[S13] Every line edge gateway, core switch, site historian and inspection lighting controller is backed by an uninterruptible power supply bridging the interval between a utility drop and either generator transfer or controlled shutdown.[S0701]
Rather than treating the UPS as an unmonitored battery box, the gateway polls the UPS controller and packs its status into the telemetry stream.[S0701] The Internet Engineering Task Force (IETF) UPS Management Information Base (RFC 1628) defines a standard object model across battery, input, output, bypass and alarm groups.[S0701] Specifically, RFC 1628 specifies upsBatteryStatus to distinguish normal capacity (batteryNormal), low remaining run-time (batteryLow) and depleted capacity (batteryDepleted), alongside upsSecondsOnBattery, upsEstimatedMinutesRemaining, upsEstimatedChargeRemaining and upsInputLineBads, which counts input out-of-tolerance transitions.[S0701]
…UPS Management Information Base (RFC 1628) defines a standard object model across battery
S0701
Recording these UPS states alongside main-incomer and generator sub-metres yields three benefits.[S29] First, when upsBatteryStatus transitions to batteryLow and upsEstimatedMinutesRemaining drops below threshold without generator transfer, the edge node and historian flush open transactions to disk and execute an orderly halt before battery depletion corrupts file systems.[S0701] Second, during shift reviews under ISO 22400-2, any interval where utility power dropped is tagged with the source timestamp of the feeder trip and generator takeover, preventing blackouts from being misclassified as unexplained mechanical downtime.[S08]
Third, local gateway survivability does not rely on a single routing switch.[S0703] Where a hall deploys redundant layer-3 switches or dual WAN gateways, the Virtual Router Redundancy Protocol Version 3 (RFC 5798) provides dynamic election and failover of the virtual default router if the master router becomes unavailable, without requiring dynamic routing on every controller or edge node.[S0703] Every VRRP transition, WAN drop and Sparkplug state change is logged with its NTP-synchronised timestamp so engineers and managers inspect one unified timeline.[S13]
7.13
Textile factories operating mixed-generation equipment rely on external equipment manufacturers, vision specialists or integrators outside Cameroon or off site to diagnose controller faults, tune drives or update software.[S17] When implemented hastily, vendors often install persistent virtual private network (VPN) tunnels, remote-desktop agents or cellular modems directly inside machine cabinets.[S19] Those bypasses destroy the zone-and-conduit boundary, create unmonitored entry points into Production OT and allow a supplier incident to compromise multiple factories.[S21]
GFT treats remote access as a temporary, audited conduit that is closed by default and opened only for an approved maintenance window.[S19] In Cybersecurity Performance Goals 2.0 (CPG 2.0), the Cybersecurity and Infrastructure Security Agency (CISA) requires multi-factor authentication (MFA) on all remotely accessible operational-technology accounts and systems, including vendor and maintenance accounts, engineering workstations and remotely accessible human-machine interfaces where available.[S20] Furthermore, ISO/IEC 27001 places supplier access, access control and operational change within a governed information security management system.[S24]
Warning
Unauthorised cellular routers, Wi-Fi bridges and "call-home" vendor dongles inside machine panels represent a severe failure mode in brownfield factories.[S19] Because these devices bypass the Industrial DMZ, they expose unpatched controllers directly to external carrier networks and can introduce unexpected polling onto deterministic machine buses.[S17] During the Phase 0 audit, engineers must inspect every cabinet, trace all cables, remove undocumented modems, and contractually require suppliers to route all support through the Industrial DMZ jump host.[S20]
In brownfield mills, many programmable logic controllers, dye-house controllers and older HMIs lack modern operating systems and cannot natively evaluate MFA tokens or transport encryption.[S17] CISA CPG 2.0 acknowledges this hardware limit by specifying MFA on remotely accessible HMIs "when available", while IEC 62443-3-2 provides the compensating mechanism through zone segmentation and conduit mediation.[S20]
Where a legacy controller or HMI cannot support strong authentication natively, GFT prohibits making that device directly reachable from any remote conduit, even via port forwarding.[S19] Instead, the controller is isolated inside its cell-level Production OT Zone behind an edge gateway or hardened engineering workstation inside the plant.[S17] The remote specialist authenticates with MFA to the DMZ jump host and interacts only with the hardened engineering proxy, which enforces role-based authentication, mediates protocol commands and prevents scanning of the legacy cell.[S20]
For critical machine-control logic modifications, the architecture requires dual-control confirmation: the remote specialist stages a configuration or ladder-logic file in the DMZ repository, and a technician standing at the machine turns a local key-switch or confirms the download on the local HMI after verifying that the equipment is clear of personnel.[S23]
7.16
Read-out
Illustrative transformation sequence showing how a physical controller signal is normalised, transported with session state, contextualised into a production event, exported as an EPCIS visibility event and aggregated into an ISO 22400 KPI (S04, S08, S15, S40).
Unit: . Status: illustrative. Sources: S04, S08, S15, S40. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗7.16 · Introduction
A degraded-operation architecture is incomplete if it only describes how systems step down during an outage without proving how they return to verified service after hardware failure, database corruption or a cyber incident.
Exhibit 34, chapter 08: 1. Controller state (PLC or IO-Link)
7.17 · Isolated backups cover machine logic, edge configurations and historian state
To protect critical infrastructure against cyber threats, CISA and international authorities advise organisations to regularly test backup procedures and ensure backups are isolated from network connections that could spread malware.
Exhibit 34, chapter 08: 1. Controller state (PLC or IO-Link)
7.18 · Contingency exercises measure actual restoration time and data loss against factory contracts
Having isolated backups on a shelf still does not guarantee that a small factory team can restore a line within an acceptable window.
Exhibit 34, chapter 08: 2. OPC UA object (Type, unit, quality)
7.16 · the bodyThe film above follows these sub-steps.
A degraded-operation architecture is incomplete if it only describes how systems step down during an outage without proving how they return to verified service after hardware failure, database corruption or a cyber incident.[S22] In many projects, backup and recovery exist only as a policy document or a script writing files to a network drive on the same subnet as production servers.[S21] When ransomware, a power surge or a storage fault strikes, operators discover too late that backups were encrypted over the same network path, machine recipes are missing, or no one knows the sequence for rebuilding an edge gateway.[S21]
To protect critical infrastructure against cyber threats, CISA and international authorities advise organisations to regularly test backup procedures and ensure backups are isolated from network connections that could spread malware.[S21] In a connected textile factory, business files are only a fraction of what is required to resume manufacturing.[S17] A complete industrial backup inventory preserves six operational asset classes across the ISA-95 hierarchy:[S01]
GFT enforces the "pull and isolate" pattern for these backups.[S21] Rather than allowing Production OT or Plant Operations servers to hold write credentials to the backup vault, a dedicated backup service pulls encrypted snapshots across a scheduled conduit and replicates an immutable offline copy that cannot be modified from the live network.[S21] Every change to a PLC recipe, edge configuration or KPI formula approved under ISO/IEC 27001 change control triggers a versioned backup alongside its cryptographic hash so engineers verify integrity before restoration.[S24]
Having isolated backups on a shelf still does not guarantee that a small factory team can restore a line within an acceptable window.[S22] NIST Special Publication 800-34 Rev. 1 distinguishes three activities that organisations frequently conflate: testing validates recovery capabilities, training prepares personnel for plan activation, and exercising the plan identifies planning gaps; combined, these activities improve preparedness.[S22] Complementing this discipline, the NIST Cybersecurity Framework (CSF) 2.0 places recovery governance, risk ownership and verification outcomes at the core of cybersecurity management.[S18]
GFT translates NIST's contingency framework into testable factory recovery contracts defined by two parameters per service class: the Recovery Time Objective (RTO), the maximum target elapsed time to restore service after disruption, and the Recovery Point Objective (RPO), the maximum tolerated age of lost data measured backwards from disruption.[S22] Because each mill has different shift patterns, buffer capacities and staffing, GFT does not invent universal minute or hour targets in the reference architecture; instead, the process and OT owners approve target RTO and RPO values on the use-case cards prior to commissioning and verify performance through restoration drills.[S22] This recovery contract is detailed in Exhibit 32.[S21]
A close inspection of Exhibit 32 shows why edge persistence improves the recovery posture of the central historian.[S40] In an ordinary database, if a daily snapshot is taken at midnight and storage fails at noon, twelve hours of transactions are lost unless synchronous replication was active.[S21] In GFT's edge-first architecture, if the central historian is restored from a 24-hour-old isolated snapshot, the missing 24-hour window remains preserved inside the 72-hour local store-and-forward databases of the line edge nodes.[S29]
if the central historian is restored from a 24-hour-old isolated snapshot
S29
While Exhibit 32 establishes the verification contract across all six asset classes, it cannot substitute for executing drills on the shop floor.[S22] As Chapter 13 specifies, no pilot line in Phase 1 transitions from shadow mode to operational dependence until a cold-spare edge swap, a network disconnection drill and an isolated historian restore have been executed by factory staff and signed off by process and safety owners.[S22] By engineering the network to shed external dependencies cleanly, buffer evidence locally with source-time integrity, monitor power and link state, lock remote access behind multi-factor jump hosts and rehearse isolated restoration, the factory ensures that infrastructure turbulence never becomes an excuse for blind or unsafe production.[S17]
no pilot line in Phase 1 transitions from shadow mode to operational dependence until…
S22
Check the record
Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.
25 sources · 192 citation marks on this pageMost cited: S17, 23 times
Grade AGrade BGrade CKnot size: citations on this page
All 25 records shown
R06 · Grade C · inherited record
Inherited evidence R06
About 95 percent of cotton fibre exported raw against 5 percent processed locally; industrialisation target of 50 percent local processing.
Publication date unrecorded. Inherited source-text record. The original publication has not been independently reopened for this web edition.
R12 · Grade C · inherited record
Inherited evidence R12
CICAM capacity utilisation, July 2023 report: Garoua 33.7 percent, CICAM 1 48.9 percent, CICAM 2 10.83 percent; underutilisation cost about CFAF 2 billion in 2020.
Publication date unrecorded. Inherited source-text record. The original publication has not been independently reopened for this web edition.
c07-S01 · Grade A
Update to ISA-95 Standard Addresses Integration of Enterprise and Manufacturing Control Systems
ANSI/ISA-95.00.01-2025, also known as ISA-95 Part 1, summarizes the scope of the manufacturing operations and control domain, discusses how physical assets of a manufacturing enterprise are organized, lists the functions associated with the interface between control functions and enterprise functions and describes the information shared among these functions.
2025-04-10. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S02 · Grade A
IEC 62264-1:2013: Enterprise-control system integration, Part 1: Models and terminology
IEC 62264-1:2013 describes the manufacturing operations management domain (Level 3) and its activities, and the interface content and associated transactions within Level 3 and between Level 3 and Level 4.
2013-05-22. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S05 · Grade A
MQTT V5.0 OASIS Standard published
These characteristics make it ideal for use in many situations, including constrained environments such as for communication in Machine to Machine (M2M) and Internet of Things (IoT) contexts where a small code footprint is required and/or network bandwidth is at a premium.
2019-03-07. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S08 · Grade A
ISO 22400-2:2014: Automation systems and integration, Key performance indicators for manufacturing operations management, Part 2: Definitions and descriptions
The KPIs are presented by means of their formula and corresponding elements, their time behaviour, their unit/dimension and other characteristics.
2014-01. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S13 · Grade A
Network Time Protocol Version 4: Protocol and Algorithms Specification
NTPv4 includes fundamental improvements in the mitigation and discipline algorithms that extend the potential accuracy to the tens of microseconds with modern workstations and fast LANs.
2010-06. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S14 · Grade A
Web of Things Architecture 1.1
An industrial edge device collects selected data from various controllers and makes it available to a cloud backend service, e.g., for remote monitoring via a dashboard or analyzes it for preventive maintenance.
2023-12-05. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S16 · Grade A
ETSI GS MEC 003 V3.2.1: Multi-access Edge Computing, Framework and Reference Architecture
Multi-access Edge Computing enables the implementation of MEC applications as software-only entities that run on top of a Virtualisation infrastructure, which is located in or close to the network edge.
2024-04. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S17 · Grade A
NIST SP 800-82 Rev. 3: Guide to Operational Technology Security
This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.
2023-09. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S18 · Grade A
The NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks.
2024-02-26. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S19 · Grade A
IEC 62443-3-2:2020: Security for industrial automation and control systems, Part 3-2: Security risk assessment for system design
A key concept in this document is the application of IACS security zones and conduits.
2020-06. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S20 · Grade A
Cybersecurity Performance Goals 2.0
OT: MFA is enabled on all accounts and systems that can be accessed remotely, including vendors/maintenance accounts, remotely accessible user and engineering workstations, and remotely accessible HMIs when available.
2025-12. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S21 · Grade A
Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
Regularly test backup procedures and ensure that backups are isolated from network connections that could enable the spread of malware.
2022-05-09. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S22 · Grade A
NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
Testing validates recovery capabilities, whereas training prepares recovery personnel for plan activation and exercising the plan identifies planning gaps; combined, the activities improve plan effectiveness and overall organization preparedness.
2010-11-11. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S23 · Grade A
Ensuring safety in the workplace
Within the overall safety of a system, functional safety refers to the aspect that provides automatic protection in response to errors.
2022-04-28. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S24 · Grade A
ISO/IEC 27001:2022: Information security, cybersecurity and privacy protection, Information security management systems, Requirements
The ISO/IEC 27001 standard provides companies of any size and from all sectors of activity with guidance for establishing, implementing, maintaining and continually improving an information security management system.
2022-10. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S29 · Grade B
Industrial IoT-Based Energy Monitoring System: Using Data Processing at Edge
Once the edge receives the meter’s data, it stores the information in the database server, followed by the data processing method to find nine additional analytical parameters.
2024-09-28. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S31 · Grade B
A Review of IoT Sensing Applications and Challenges Using RFID and Wireless Sensor Networks
Also, time synchronization between the nodes and spectrum sharing techniques are of the utmost importance to ensure the integrity of the data or avoid uncertainty in the sensed data, without consuming all the radio resources [37].
2020-04-28. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S32 · Grade A
Enterprise Surveys: What Businesses Experience, Cameroon 2024 Country Profile
Figure 8 shows the extent to which firms face failures in the provision of electricity as measured by the percent of firms experiencing electrical outages and by the number of power outages.
2025. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S33 · Grade A
Facts and Figures 2024: Mobile network coverage
The largest coverage gap is in Africa, where 14 per cent of the population still does not have access to a mobile broadband network and therefore cannot access the Internet.
2024-11-10. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S40 · Grade A
Sparkplug Specification 3.0.0
The intent and purpose of the Sparkplug Specification is to define an MQTT Topic Namespace, payload, and session state management that can be applied generically to the overall IIoT market sector, but specifically meets the requirements of real-time SCADA/Control HMI solutions.
2022-11-16. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S0701 · Grade A
UPS Management Information Base
This document defines the managed objects for Uninterruptible Power Supplies which are to be manageable via the Simple Network Management Protocol (SNMP).
1994-05. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S0702 · Grade A
The Syslog Protocol
This document describes the syslog protocol, which is used to convey event notification messages. This protocol utilizes a layered architecture, which allows the use of any number of transport protocols for transmission of syslog messages.
2009-03. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c07-S0703 · Grade A
Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6
The election process provides dynamic failover in the forwarding responsibility should the Master become unavailable.
2010-03. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗S17 National Institute of Standards and Technology. 2023-09.
S32 World Bank Enterprise Surveys. 2025.
S19 International Electrotechnical Commission. 2020-06.
S22 National Institute of Standards and Technology. 2010-11-11.
R06 Cameroon Trade Hub. Publication date unrecorded; inherited source-text check.
R12 Business in Cameroon. Publication date unrecorded; inherited source-text check.
S01 International Society of Automation. 2025-04-10.
S02 International Electrotechnical Commission. 2013-05-22.
S16 European Telecommunications Standards Institute. 2024-04.
S23 International Electrotechnical Commission. 2022-04-28.
S20 Cybersecurity and Infrastructure Security Agency. 2025-12.
S05 OASIS Open. 2019-03-07.
S14 World Wide Web Consortium. 2023-12-05.
S0702 Internet Engineering Task Force and RFC Editor. 2009-03.
S40 Eclipse Foundation. 2022-11-16.
S08 International Organization for Standardization. 2014-01.
S29 MDPI, IoT. 2024-09-28.
S31 MDPI, Sensors. 2020-04-28.
S33 International Telecommunication Union. 2024-11-10.
S13 Internet Engineering Task Force and RFC Editor. 2010-06.
S0701 Internet Engineering Task Force and RFC Editor. 1994-05.
S0703 Internet Engineering Task Force and RFC Editor. 2010-03.
S21 CISA and joint international cybersecurity authorities. 2022-05-09.
S24 International Organization for Standardization and International Electrotechnical Commission. 2022-10.
S18 National Institute of Standards and Technology. 2024-02-26.
Keep the thread · chapter 07 of 14
Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.
The paper's rack · 14 boltsBolt length: reading time
01Part I: Decisions before devices
GFT starts with the production decisions and infrastructure constraints that a connected architecture must serve, because visualisation alone cannot create trustworthy operating evidence.
02Part I: Decisions before devices
Each connected-factory use case needs an event, an owner, a permitted delay, a fallback and a measurable consequence before any sensor or platform is selected.
03Part I: Decisions before devices
A useful reference architecture assigns each function to a responsibility boundary and information contract before it assigns that function to a product.
04Part II: Capture at the production edge
A value becomes production evidence only when its asset, occurrence time, uncertainty and transformation history remain inspectable.
05Part II: Capture at the production edge
The safest digital retrofit begins by observing equipment through its documented interfaces and proving that acquisition does not alter control timing, protective functions or maintainability.
06Part II: Capture at the production edge
Local inspection earns its place when a valid image becomes a traceable quality decision before the fabric leaves the decision point. Acquisition, persistence and an approved fallback matter as much as inference speed.
07Part II: Capture at the production edge
The connected factory must lose remote services before it loses local evidence, and lose local evidence before it ever loses safe machine operation.
08Part III: One governed data spine
Two systems can exchange packets and still misunderstand production, so the architecture must define information, state, events and asset meaning separately.
09Part III: One governed data spine
The factory's data store is an evidence system, not a growing pile of values, so raw observations, contextual events, KPI results and corrections remain distinguishable and replayable.
10Part III: One governed data spine
The dashboard is a role-specific control surface whose freshness, definitions and next action are visible, not a gallery of independently calculated charts.
11Part III: One governed data spine
Applications should arrive as bounded, observable and reversible changes to a working production architecture, with ownership and rollback proven before scale.
12Part IV: Prove value and scale safely
This chapter specifies evidence capture rather than accounting or compliance methods: metres, denominators, allocations and life-cycle boundaries must make every displayed result reconstructable.
13Part IV: Prove value and scale safely
A connected factory is not accepted when its screens work on a normal day, but when its controls, fallbacks and recovery perform under adversarial and degraded conditions.
14Part IV: Prove value and scale safely
GFT recommends a four-phase build that earns each expansion through evidence quality, operating value, safe failure and recovery rather than device count.