Research libraryEdge to Dashboard
Chapter 14 of 14 · Part IV · Draft web edition
GFT recommends a four-phase build that earns each expansion through evidence quality, operating value, safe failure and recovery rather than device count.
The cloth is woven from this chapter's 5 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.
Read-out
Illustrative GFT synthesis. Layers describe proposed responsibilities, not installed equipment. Protective safety is independent of every reporting layer; it is not an analytics component.
Unit: proposed responsibility layers. Status: illustrative. Sources: S02, S08, S17, S40. Illustrative figures are teaching examples, not measured factory results.
Overture · 1 min
Scale the connected factory only when its evidence supports a useful operating decision and its failure leaves production under an accepted fallback. GFT recommends establishing contracts, proving a bounded line, replicating those contracts and then optimising the resulting system. Each transition requires a recorded decision by the factory's accountable owners. This is a proposed implementation method, not a claim that GFT has deployed or proved the architecture. The acceptance object is the complete path from an identifiable production event to a verified management action, including what happens when that path breaks.
14.1
The sponsor should first approve the division of responsibilities between machine control, manufacturing operations and enterprise reporting. ISA's description of its integration standard and IEC's description of the manufacturing operations interface provide a vocabulary for that separation. They do not select a supplier or demonstrate a site's conformity. GFT's recommendation is to preserve responsibility boundaries while allowing individual products to change. A line supervisor must know which system records production, which record authorises a disposition and who resolves disagreement between them.[S01][S02]
Create a small architecture authority with explicit decision rights rather than a new committee for every application. The production owner approves operational use and fallback. The data owner approves definitions and corrections. The engineering and safety owners approve physical interfaces and protective boundaries. The information-technology and security owners approve service operation and access. The sponsor resolves resource and scope decisions. These are recommended responsibilities, not assertions about existing GFT personnel. The same person may hold compatible roles, but authorship of a change should remain visible to whoever accepts its consequences.
The authority should maintain a shared event contract, KPI dictionary, interface register, zone design and recovery policy. Applications should refer to these records through controlled versions. A defect dashboard and an energy dashboard may use different views, but neither should silently invent the identity of a line or redefine its production period. When a definition changes, record the effective boundary and identify the earlier results that remain comparable. Repeated local exceptions are a reason to improve the shared contract, not to create an undocumented alternative.
Use local processing where the decision must survive external service loss. Use remote services where their analytical or administrative benefit justifies the dependency. This allocation is GFT's design recommendation, subject to site measurement. NIST's OT guidance explicitly treats performance, reliability and safety alongside security; a reporting convenience therefore cannot be accepted solely because it works under a healthy network connection. The factory should approve what remains operable when remote authentication, synchronisation or analytics is unavailable.[S17]
The proposed end state in Exhibit 62 consolidates responsibilities without specifying a vendor stack. Protective functions sit outside the reporting dependency path. The diagram describes an acceptance intention, not an installed system or a safety assessment.
The diagram's practical test is replaceability. Ask whether a new display could consume the existing dictionary, whether a replacement gateway could preserve event identity and whether a restored store could reproduce an accepted result. Failure of these tests identifies an ownership or interface gap before procurement turns it into an expensive dependency. This conclusion does not require every application to share a database. It requires their agreements and disagreements to remain inspectable.
14.2
Phase 0: establish contracts
Phase 0: establish contracts. Starting point. Leads to Phase 1: prove bounded use (Baseline approved). · illustrative
Phase 0 is the illustrative set-up gate; its duration is site-dependent.
Phase 1: prove bounded use
Phase 1: prove bounded use. From Phase 0: establish contracts (Baseline approved). Leads to Phase 2: replicate contracts (Dependence accepted). · illustrative
Phase 2: replicate contracts
Phase 2: replicate contracts. From Phase 1: prove bounded use (Dependence accepted). Leads to Phase 3: optimise and restore (Comparison accepted). · illustrative
Phase 3: optimise and restore
Phase 3: optimise and restore. From Phase 2: replicate contracts (Comparison accepted). End point. · illustrative
The method behind it: GFT note.
Illustrative GFT method. Phase identifiers are sequence labels, not durations. Every transition requires its own approval; failed tests retain the current scope and trigger remediation.
Unit: illustrative phase sequence. Status: illustrative. Sources: S08, S17, S22. Illustrative figures are teaching examples, not measured factory results.
14.2 · the bodyExhibit 63 above; its figures are illustrative where marked.
Phase 0 is the illustrative set-up gate; its duration is site-dependent. Begin with the decisions whose delay or error causes an identifiable operating consequence. Record the event needed, the responsible role, the permitted delay, the available manual record and the consequence of missing evidence. Inventory the relevant machines and measurement points against those needs. A machine that exposes a counter is not automatically a reliable source: the acceptance plan must establish what increments it, when it resets and how its meaning changes with the product or operating state.
Survey power, communications and physical access under representative operating conditions. Record interruptions and recovery behaviour rather than substituting a national indicator for local measurements. Identify dependencies on time services, licences, remote identities and vendor support. The proposed register should distinguish an observed condition from an assumed condition awaiting a test. It should also preserve conditions under which the survey was conducted, so later replication does not mistake an acceptance result from an idle line for evidence about loaded production.
Define the logging reference before measuring source coverage. For periodic measurements, specify the expected schedule and treatment of planned shutdowns. For event-driven capture, identify an independent count or reconciled production record that establishes how many events should have existed. An event stream cannot prove its own completeness merely by counting messages it received. Where no independent reference is feasible, record the limitation and restrict the decision accordingly. The baseline may be incomplete, but its incompleteness must be visible rather than converted into a favourable percentage.
The proposed baseline contract should also distinguish source time, gateway receipt time and later processing time. Define the quality states accepted by each use case and the rule for an uncertain clock. Record the identifier and version that travel through transformation, correction and replay. These agreements belong before shadow acceptance because retrospective interpretation cannot establish what an operator actually saw when a decision was due.
Write the KPI dictionary at the same time as the capture register. The ISO description of manufacturing KPIs includes formulas, input elements, time behaviour and units. GFT would turn that principle into an acceptance record containing the calculation boundary, source versions, exclusions, rounding and comparison tolerance. The process owner approves what the result means; the data owner approves how it is reproduced. A manual calculation is a comparison reference only after its own definitions and transcription controls have been reviewed.[S08]
The resource envelope should include the factory's internal capacity as well as purchased equipment. Assign time for process review, integration, physical engineering, safety review, configuration, training, support and recovery exercises. Identify who covers these responsibilities during absence or a supplier dispute. No budget or staffing level is assumed here. The gate should close only when the sponsor can see which necessary tasks are funded, which depend on existing roles and which remain unassigned. An unassigned critical task is an explicit stop condition, not a contingency allowance.
The proposed sequence in Exhibit 63 gives each phase an exit decision rather than a promised calendar date. Remediation returns to the relevant gate; it does not count as completion of that gate.
Phase 0 exits with the decision register, machine-capture register, interface contracts, zone-and-conduit design, KPI dictionary, recovery objectives and test plan under controlled ownership. The recovery plan should name the affected business decisions and the resources required to restore them. NIST's contingency guidance supports prioritising recovery requirements through an assessment of systems and operations. GFT proposes applying that logic to the factory's decision services without claiming that federal guidance itself constitutes a factory certification.[S22]
14.3
Exhibit 6413 paragraphs step it
Read-out
Illustrative inputs: source A 1900/2000=95%; source B 9980/10000=99.8%; combined 11880/12000=99%. Assumed minimum 99.5% is a teaching threshold only. All events are unique and valid under an assumed approved reference.
Unit: illustrative valid-event coverage, percent. Status: illustrative. Illustrative figures are teaching examples, not measured factory results.
The illustrative Phase 1 sequence begins with bounded read-only capture and an explicit rollback route. The selected line should exercise the intended operating decision under meaningful conditions while remaining small enough to investigate a failure. Define the approved products, operating states and shifts in scope. Record what lies outside that scope. If a later proposal adds a different machine family, lighting condition or production route, its owner should identify the evidence needed to extend acceptance rather than assume that physical proximity makes it equivalent.
Shadow mode means that the proposed service records and evaluates decisions while the accepted operating process retains authority. Review event identity, source time, validity flags and transformations before assessing dashboard appearance. Recalculate accepted KPIs independently from the same versioned inputs and compare the results using the tolerance agreed before observation. The proposed difference is platform result minus independent result. Accept only when its absolute value is within the approved tolerance. Matching calculations establish consistency of implementation; they do not prove that the common input record is correct.
Approve an observation window that covers the relevant operating variation and foreseeable recovery cases. A longer window is not automatically better if it repeats the same easy conditions. Retain planned exclusions, unplanned exclusions and missing reference periods separately. If a product change removes the independent record, flag the affected comparison as unavailable. Do not revise the expected-event denominator after seeing the result merely to clear the gate. Any genuine correction to the logging reference needs a reason, an approving owner and a new comparison against the corrected version.
Test loss of the external link, interruption of the acquisition service, restart and controlled replay. Physical interruption tests require the responsible engineering and safety owners to approve the method and conditions. The proposed acceptance question is whether the decision remains legible during loss and whether recovered events reconcile without duplicate operating actions. A replayed event may belong in historical analysis while being too old to trigger a current response. Sparkplug specifies session-state behaviour and stale metrics, but the factory must still define how its consuming display and action process interpret that state.[S40]
Where inspection is included, separate acquisition acceptance from model acceptance and quality-disposition authority. The proposed pilot should preserve representative images or other reviewable evidence under the agreed retention boundary. Quality staff should be able to identify an unusable observation, follow the manual inspection route and record an override. A plausible model output is insufficient when the acquisition condition is unknown. Until the applicable evidence and fallback are accepted, the pilot remains advisory. No open protective-safety exception may be waived into operational dependence under this roadmap.
The arithmetic in Exhibit 64 makes the example's denominator visible. It is an illustration of the rule, not evidence that these values are suitable thresholds for any factory.
Operational acceptance should state the permitted decision, scope, service version, evidence window and fallback. A conditional acceptance can authorise a narrower advisory use without authorising automatic quality disposition or machine control. Attach each remaining exception to a responsible role, expiry condition and compensating measure. A failed critical evidence gate blocks the dependent use. Do not let a deadline convert a shadow demonstration into operating authority. The sponsor should be able to explain exactly what has been accepted without relying on a supplier's general declaration that the pilot works.
The phase decision should record pass, hold, restricted acceptance or withdrawal, with the evidence supporting that state. A hold preserves the earlier authority and identifies the next useful test. Restricted acceptance names the exact use permitted and the uses still blocked. Withdrawal removes reliance on the affected service and activates its accepted fallback. These proposed states prevent a partial technical success from being reported as an unqualified programme success. The record should remain understandable to the next shift and to a reviewer who did not attend the demonstration.
The acceptance schedule in Exhibit 65 summarises the proposed owner and stopping rule. It is an illustrative governance design, not a derived result from a standard. Thresholds are intentionally site-approved before testing, rather than filled with invented industry benchmarks.
For the bounded-operation gate, the proposed evidence pack includes per-source coverage, freshness under relevant operating states, KPI differences within approved tolerances, completed interruption tests and confirmation that no protective-safety exception remains open. Record dissent and unresolved uncertainty rather than averaging their severity into a readiness score. The sponsor can adjust the programme's sequence or resource envelope, but a commercial preference to expand does not itself supply missing evidence. Where a different decision can be accepted independently, its boundary must exclude reliance on the failed source or service.
For replication, the receiving owner should confirm that the comparison method, target, exclusions and local differences were approved before results were assessed. Require evidence gaps to be closed or, for eligible non-critical limitations, accepted through the documented exception process. The approval should state why the limitation does not undermine the authorised decision and what would cause that judgement to expire. It should not merely inherit the pilot sponsor's confidence. Repeated exceptions require a review of the common contract before more installations copy the same weakness.
For optimisation, require restoration time and data loss within their approved objectives, plus an authorised review of the new scope. Recovery evidence expires in practical value when a material dependency changes. A replacement identity service, storage format or support arrangement should therefore trigger an applicability review of the earlier exercise. Retest what the change invalidates and retain the unaffected evidence with its original conditions. This avoids both an unsupported blanket renewal and an unnecessary restart of every acceptance activity.
Interlude · the cloth half-woven
Woven: sections 14.0 to 14.3Still to weave: 14.4 to 14.7
Read-out
GFT arithmetic from World Bank Enterprise Surveys Cameroon 2024 Country Profile (S32). Outage-incidence gap against Sub-Saharan Africa: 93.3 percent minus 69.7 percent equals 23.6 percentage points. Outage-incidence gap against lower-middle-income economies: 93.3 percent minus 55.0 percent equals 38.3 percentage points. Monthly frequency excess: 10.4 minus 6.9 equals 3.5 outages per typical month. Compares all surveyed firms, not textile factories.
Unit: percentage points and monthly events. Status: derived. Sources: S32.
Read this exhibit in its chapter ↗14.4
Related · chapter 126 paragraphs step it
Read-out
Illustrative GFT metering and allocation architecture informed by ISO 22400-2 KPI elements (S08), edge energy database and parameter derivation (S29), GHG Protocol Product Standard boundaries (S36), ISO 50001 EnMS structure (S37) and ISO 14046 water-footprint scopes (S38). Illustrative design model, not an observed factory installation.
Unit: proposed architecture layers. Status: illustrative. Sources: S08, S29, S36, S37, S38. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗The illustrative Phase 2 sequence replicates an accepted decision contract rather than clone an installation directory. Compare the receiving line's asset hierarchy, machine states, product routes and event semantics with the proven scope. Maintain a visible difference register. Differences may be configuration changes, new capture engineering or reasons to repeat part of shadow acceptance. Retain the common contract where its meaning remains valid. Where meaning differs, approve an explicit mapping or a revised version and identify the consequences for cross-line comparison.
Before comparing operating results, approve the baseline, comparison period, exclusions and target values. Track production mix, scheduled time, staffing conditions, material quality, maintenance interventions and other relevant changes alongside the outcome. An improvement following installation is an observation about sequence, not by itself a causal result. GFT would require the reviewer to state the plausible alternative explanations and the evidence used to assess them. If the periods are not meaningfully comparable, report that limit rather than produce a digitalisation benefit percentage from incompatible denominators.
Use a narrow set of operational outcomes that the process owner can influence: good-unit throughput, first-pass yield, downtime, delivery and resource intensity where the measurement boundary supports them. Keep definitions consistent with the approved dictionary, including the treatment of rework, planned stops and product changes. ISO's KPI description provides the discipline of explicit calculation characteristics; the particular target and decision consequence remain the factory's responsibility. A shared name does not justify comparing results calculated under different production boundaries.[S08]
Replication also changes the support burden. The proposed review should establish who maintains mappings, investigates alarms, approves releases and covers out-of-hours failures. Repeated success on an easy line does not resolve an unowned recovery service. Review exception age and repeated overrides before authorising the next group of lines. Where a non-critical exception is accepted, retain its precise scope and expiry. A protective-safety exception cannot be accepted through the ordinary data-exception process, and any unresolved critical evidence gap continues to block the decision that depends on it.
Advanced analytics should enter through a new use-case contract once its required history, reference outcomes and action process exist. Identify the proposed model's decision horizon, evaluation reference, error consequences and permitted authority. Start with advisory output if that is the accepted risk boundary. Preserve the previous decision method and a rollback route. GFT's measure-before-model sequence is a design recommendation: the existence of stored data does not establish that those data cover the conditions in which the model will later be used.
The proposed release gate should also ask whether a supplier can reproduce a result without privileged access to undocumented transformations. Require the event snapshot, relevant configurations, calculation or model version and exclusion record. These artefacts support acceptance across products and integrators. They also allow the factory to recognise a misleading comparison before it becomes a repeated management target. The purpose of scale is a more dependable operating system, so evidence health and the capacity to act must grow with the installation footprint.
14.5
The illustrative Phase 3 sequence permits cross-line analysis, product evidence and more sophisticated applications only within the same ownership and change-control arrangements. Every added interface needs an identified producer, consumer, meaning and failure behaviour. A simulation or digital representation should disclose which observations update it and which outputs remain assumptions. It must not become an informal control route around the established approval process. Optimisation changes the questions asked of the evidence; it should not erase the records needed to challenge its answers.
The illustrative Phase 3 sequence permits cross-line analysis
illustrative
Recovery acceptance should use a business-defined recovery time objective and recovery point objective. Specify the start and end of the restoration clock, the service being restored and the evidence used to identify missing data. The proposed operational endpoint is the ability to perform the accepted decision with reconciled records, rather than the moment a server responds. Report the measured restoration time against the approved objective and the measured loss against the approved loss boundary. A restored database with unresolved production identity conflicts is not an accepted decision service.
Keep a recoverable package of configurations, interfaces, dictionaries, identities and required application versions alongside the necessary data. Exercise restoration in an environment that avoids contaminating the recovered service with the original failure. Verify access and the ability to interpret the recovered records. NIST distinguishes testing, training and exercises in its contingency guidance. GFT would therefore retain separate evidence that the technical restore worked, that the responsible roles could perform it and that the decision process survived the disruption.[S22]
An illustrative recovery exercise might set an approved RTO of 120 minutes and an approved RPO of 15 minutes for a reporting service. If the measured return to usable, reconciled operation takes 95 minutes but the proven data-loss interval is 18 minutes, restoration time passes and data loss fails. The excess loss is 3 minutes. These assumed values demonstrate independent tests; they do not recommend objectives or describe a GFT exercise. Expansion of the dependent service remains blocked until the loss failure is resolved and retested.
…set an approved RTO of 120 minutes and an approved RPO of 15 minutes…
illustrative
Replication to another area or site repeats the relevant site survey, risk review, physical engineering acceptance and restoration exercise. Carry forward reusable contracts and test methods, then identify what must be established again. Power conditions, equipment interfaces, access responsibilities and available recovery resources require local evidence. In GFT's proposed governance, the receiving owner signs the applicability review; the originating site's acceptance cannot sign on that owner's behalf. This keeps replication conditional even when the technical package appears identical.
Optimisation must also remain interruptible. Agree when the factory returns to the earlier method, how outstanding actions are handed back and which historical calculations remain under review. Preserve the evidence of a failed release so the same defect is not introduced again under a new application name. The review should distinguish a technically reversible deployment from an operationally recoverable change: restoring software does not automatically undo an erroneous production disposition or recreate an observation that was never captured.
14.6
The proposed scorecard should place the operating result beside the evidence needed to trust it and the action needed to change it. Coverage is unique valid critical events received divided by critical events expected under the approved logging reference. Freshness age is review time minus source timestamp, subject to the clock-validity rule. Action closure is verified closed actions divided by actions due, with overdue items visible separately. These are GFT's proposed management definitions. They require agreed units, reference periods, owners and exclusions before use.
Freshness should be assessed at the moment the decision is needed, not only after a replay has repaired historical completeness. Report clock uncertainty and stale state as separate qualifications. A negative calculated age is a clock or timestamp exception to investigate, not evidence of exceptional freshness. For an event-driven source, silence can be legitimate; use the agreed state or heartbeat rule to distinguish quiet production from failed acquisition. Sparkplug's stale-metric provisions inform this requirement without determining the factory's acceptable decision age.[S40]
Keep source coverage disaggregated by critical source and relevant operating condition. Retain missingness, invalid observations, duplicates and late arrivals as different categories. An empty denominator means unavailable or not applicable under an explicit rule, not perfect performance. The scorecard should expose how exclusions affected the result. This prevents a declining observation population from appearing as an improvement and helps the owner direct remediation towards the actual weak point.
Monitor replay backlog as both a record count and the age of the oldest unresolved event. An apparently draining queue may still leave a critical interval unreconciled, so the review should identify affected sources and decision periods. Record stale-display incidents, invalid clock status and alert acknowledgement delay alongside service availability. These proposed health measures should trigger an assigned investigation or a restricted operating mode, rather than accumulate as unattended diagnostics. Their thresholds must follow the consequence of delayed evidence for the relevant decision.
For actions, distinguish acknowledgement, assignment, intervention and verified closure. An acknowledged alert may still represent an unresolved fault. Record who verified the consequence and whether the action addressed the cause or only restored a temporary condition. Retain human overrides with their reason, affected decision and review status. Frequent justified overrides may show a poor operating rule rather than operator resistance. Repeated unreviewed overrides are a governance gap even when production continues.
The compact scorecard in Exhibit 66 is a proposed definition set. Its baseline and targets must be approved at the factory before comparison. It contains no assumed measured performance.
Read-out
| Coverage | Valid / expected | Data owner |
|---|---|---|
| Freshness | Review minus source time | Process owner |
| Action closure | Verified closed / due | Process owner |
| Recovery | Measured against RTO/RPO | Service owner |
| Access review | List overdue items | Security owner |
Illustrative GFT method, not measured values or a prescribed standard. Owner approves baseline window, exclusions and target before comparison. Detailed denominator and verification rules are in the adjacent prose.
Unit: illustrative definition and ownership schedule. Status: illustrative. Sources: S08, S18, S22, S40. Illustrative figures are teaching examples, not measured factory results.
Security review should similarly preserve the unresolved item and its owner. List overdue remote-access reviews, affected privileges, expiry and action due rather than presenting an unqualified compliance percentage. NIST's Cybersecurity Framework supplies high-level risk outcomes rather than a prescribed implementation. GFT would use those outcomes to organise responsibility, while requiring local evidence for the controls selected. A favourable reporting score cannot override an unresolved condition that blocks the relevant operating gate.[S18]
14.7
Procurement should purchase an inspectable operating capability and its exit route. Ask bidders to identify the data that can be exported, the schemas supplied, the configuration backup method and the access needed to reproduce accepted results. Require a demonstration using the proposed contractual deliverables. A statement that data belong to the factory is incomplete if only the supplier can interpret their identifiers or restore the application that reads them. These are recommended negotiating requirements; no supplier acceptance is claimed.
Specify the support boundary for security updates, vulnerabilities, remote maintenance and end-of-support events. Require application and model versions to be recorded against the evidence they produce. Tie each release to the factory's approval and rollback process. NIST's OT guidance supports evaluating changes against operating constraints, but procurement must translate those constraints into testable obligations for the actual service. A general promise of secure operation is not an acceptance method.[S17]
Before contract award, establish how the factory would transition to another integrator or operate the accepted fallback during a dispute. Test a representative export and independent recalculation, inspect backup completeness and identify any licences or keys required for restoration. Record costs, dependencies and permitted uses in the proposed terms. Legal review should assess whether those terms achieve the intended ownership and continuity. This chapter specifies the engineering questions; it does not assert enforceable rights in an unsigned agreement.
Final acceptance should be a short, traceable decision record stating the authorised scope, evidence reviewed, unresolved limitations, responsible roles and next review trigger. Scope expansion should cite that record and explain what changes. The sponsor can then distinguish an available prototype, an accepted advisory service, an operational dependency and a replicated capability. Those states need different evidence. Treating them as interchangeable is how a collection of promising demonstrations becomes an unmanaged factory dependency.
GFT's recommendation is conditional on site engineering and applicable legal and regulatory review. This reference architecture is not investment, legal or tax advice. It certifies neither a machine nor a supplier nor a factory. Its useful conclusion is narrower and practical: preserve the production boundary, prove the evidence, accept the decision and retain the ability to recover before the next expansion.
Check the record
Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.
7 sources · 18 citation marks on this pageMost cited: S08, 3 times
Grade AGrade BGrade CKnot size: citations on this page
All 7 records shown
c14-S01 · Grade A
Update to ISA-95 Standard Addresses Integration of Enterprise and Manufacturing Control Systems
As the world grows more digitized, the 2025 update to ISA-95 Part 1 reflects the ongoing need for an integration standard.
2025-04-10. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c14-S02 · Grade A
IEC 62264-1:2013: Enterprise-control system integration, Part 1: Models and terminology
This description enables integration between the manufacturing operations and control domain (Levels 3, 2, 1) and the enterprise domain (Level 4).
2013-05-22. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c14-S08 · Grade A
ISO 22400-2:2014: Automation systems and integration, Key performance indicators for manufacturing operations management, Part 2: Definitions and descriptions
The KPIs are presented by means of their formula and corresponding elements, their time behaviour, their unit/dimension and other characteristics.
2014-01. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c14-S17 · Grade A
NIST SP 800-82 Rev. 3: Guide to Operational Technology Security
This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.
2023-09. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c14-S18 · Grade A
The NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks.
2024-02-26. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c14-S22 · Grade A
NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
This document provides guidance to help personnel evaluate information systems and operations to determine contingency planning requirements and priorities.
2010-11-11. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c14-S40 · Grade A
Sparkplug Specification 3.0.0
It is also up to the designers of the Sparkplug Host Application on how they mark a metric as STALE.
2022-11-16. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗S01 International Society of Automation. 2025-04-10.
S02 International Electrotechnical Commission. 2013-05-22.
S17 National Institute of Standards and Technology. 2023-09.
S08 International Organization for Standardization. 2014-01.
S40 Eclipse Foundation. 2022-11-16.
S22 National Institute of Standards and Technology. 2010-11-11.
S18 National Institute of Standards and Technology. 2024-02-26.
Keep the thread · chapter 14 of 14
Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.
The paper's rack · 14 boltsBolt length: reading time
01Part I: Decisions before devices
GFT starts with the production decisions and infrastructure constraints that a connected architecture must serve, because visualisation alone cannot create trustworthy operating evidence.
02Part I: Decisions before devices
Each connected-factory use case needs an event, an owner, a permitted delay, a fallback and a measurable consequence before any sensor or platform is selected.
03Part I: Decisions before devices
A useful reference architecture assigns each function to a responsibility boundary and information contract before it assigns that function to a product.
04Part II: Capture at the production edge
A value becomes production evidence only when its asset, occurrence time, uncertainty and transformation history remain inspectable.
05Part II: Capture at the production edge
The safest digital retrofit begins by observing equipment through its documented interfaces and proving that acquisition does not alter control timing, protective functions or maintainability.
06Part II: Capture at the production edge
Local inspection earns its place when a valid image becomes a traceable quality decision before the fabric leaves the decision point. Acquisition, persistence and an approved fallback matter as much as inference speed.
07Part II: Capture at the production edge
The connected factory must lose remote services before it loses local evidence, and lose local evidence before it ever loses safe machine operation.
08Part III: One governed data spine
Two systems can exchange packets and still misunderstand production, so the architecture must define information, state, events and asset meaning separately.
09Part III: One governed data spine
The factory's data store is an evidence system, not a growing pile of values, so raw observations, contextual events, KPI results and corrections remain distinguishable and replayable.
10Part III: One governed data spine
The dashboard is a role-specific control surface whose freshness, definitions and next action are visible, not a gallery of independently calculated charts.
11Part III: One governed data spine
Applications should arrive as bounded, observable and reversible changes to a working production architecture, with ownership and rollback proven before scale.
12Part IV: Prove value and scale safely
This chapter specifies evidence capture rather than accounting or compliance methods: metres, denominators, allocations and life-cycle boundaries must make every displayed result reconstructable.
13Part IV: Prove value and scale safely
A connected factory is not accepted when its screens work on a normal day, but when its controls, fallbacks and recovery perform under adversarial and degraded conditions.
14Part IV: Prove value and scale safely
GFT recommends a four-phase build that earns each expansion through evidence quality, operating value, safe failure and recovery rather than device count.