Skip to content
GREEN FUTURETECH.
Explore

Research libraryFactories on a Weak Grid

Chapter 12 of 14 · Part IV · Draft web edition

The economic case should price avoidable loss and restoration

Compare service classes using transparent operating assumptions and procurement obligations rather than promised resilience percentages.

Sections
7
Exhibits
4
Minutes
31
Sources
41
EX 47 · Digital boundary: total 280. Running total 280 illustrative thousand XAF per outage event

The cloth is woven from this chapter's 4 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.

The chapter as a draft: 7 sections, 3 exhibit wefts, one shuttle.

Lead exhibit · 47ReconciliationillustrativeOnly attributable losses belong in the benefit case
05001,0001,5001,200Gross outage loss-780Unpowered motors-140Unpowered cameras280Digital boundary-45Manual handover235Net avoidable loss

Read-outGross outage loss: total 1,200. Running total 1,200 illustrative thousand XAF per outage event

Method and source

Illustrative accounting decomposition for a single hypothetical outage event. Total gross disruption (1,200 thousand XAF) is reduced by unpowered machinery downtime (-780 thousand XAF) and unpowered optical inspection stop (-140 thousand XAF) to isolate the digital-boundary exposure (280 thousand XAF), then reduced by unavoidable changeover administration (-45 thousand XAF) to reach net avoidable record and restoration loss (235 thousand XAF). Values are illustrative method inputs, not observed GFT plant figures.

Unit: illustrative thousand XAF per outage event. Status: illustrative. Sources: S03, S05, S1203. Illustrative figures are teaching examples, not measured factory results.

The chapter's warpBar: share of the reading · square: an exhibit

Section 12.0 · Opening · 2 min · no exhibit of its own · one movement Go to section ↓

The chapter cloth8 warp groups · one pick per paragraph

This paragraph previews 12.4 · Use contribution margin when estimating lost output value

An investment in digital continuity on an intermittent grid is sound only when the cost of protecting the local operating boundary and restoring a verified production record is lower than the specific operational losses that the protected service can actually prevent.[S03][S05] A factory sponsor in Cameroon evaluating uninterruptible power for edge computing, local write-ahead storage, store-and-forward buffering, and rehearsed spare-device recovery should reject return-on-investment calculators that credit a software project with avoiding full plant downtime.[S05][S1203] When the main distribution board trips and spinning frames, looms, dyeing vats, or sewing motors lose prime power, a battery-backed gateway and a durable local database do not keep unpowered machinery turning.[S03] What a protected digital boundary prevents is a narrower and measurable class of loss: the erasure of committed bundle histories, the quarantine of unverified fabric rolls, the clerical labour of transcribing paper dockets, the supervisory hours spent untangling duplicated or out-of-order counts, and the post-restoration delay while lines wait on an unverified ledger before resuming work.[S05][S13] Pricing that boundary honestly, valuing prevented output loss at contribution margin rather than gross revenue, exposing multi-year ownership costs, and converting vendor promises into witnessed acceptance clauses turns resilience into an inspectable engineering contract.[S04][S06][S1201]

This chapter translates the technical mechanisms established across the preceding chapters into an economic and procurement decision method for GFT's Cameroon textile programme.[S05][S1203] The inherited sector baseline shows that roughly 95 percent of Cameroon's cotton fibre is exported raw while about 5 percent is processed locally, against a national target of 50 percent local processing by 2030.[R06][R07] Moving along that curve requires factories whose operating margins are not eroded by either unrecorded floor losses or oversized, unmaintainable information-technology spending.[R12][S05] None of the calculations in this chapter represent observed financial returns from a commissioned GFT plant, and nothing in this paper constitutes investment, legal, or tax advice.[S26] Instead, the framework separates physical downtime from digital record loss, defines a counterfactual manual baseline, sets out a procurement cost register free of invented vendor prices, tests break-even sensitivity across correlated failure assumptions, and establishes contractual exit rights so the plant retains its production history when a supplier contract ends.[S1201][S1203]

12.14 min · 2 sub-steps · 1 exhibit

Start with the loss the protected service can actually avoid

Step 1 of 3Intro

Related exhibit 14 · chapter 04Stacked compositionillustrativeThe record-only load includes six supporting components
60Edge computer25Broker20Switch15Router5Timesource25Localconsole

Read-outEdge computer: 60 of 150 watts, illustrative steady operating scenario (40 percent)

Method and source

Illustrative GFT load boundary. Assumed values: edge computer 60 W, broker 25 W, switch 20 W, router 15 W, time source 5 W and local console 25 W. Total = 60+25+20+15+5+25 = 150 W. Cameras, illumination, machinery and production control are excluded. This protects proposed record capture and local reporting only; it is not an equipment selection or an operating result.

Unit: watts, illustrative steady operating scenario. Status: illustrative. Sources: S03, S05. Illustrative figures are teaching examples, not measured factory results.

Read this exhibit in its chapter ↗
Related exhibit 34 · chapter 08Decision mapillustrativeConflicts between manual and automated records require an explicit reconciliation decision
Manual-led reviewAuto-concurring releaseHold and physical recountSupervisor split auditAutomated capture evidence completeness →Manual versus automated count agreement →Matching scan and pap…Holdover scan matches…Unpowered window pape…Cumulative vs increme…Missing seq gap + cou…Clock reset + duplica…

Read-outMatching scan and paper tally: Automated capture evidence completeness 9, Manual versus automated count agreement 9. Quadrant: Auto-concurring release

Method and source

Illustrative classification of six post-outage bundle reconciliation cases on a 0-to-10 scale of automated evidence completeness (x-axis) versus count agreement between manual and automated logs (y-axis). Design basis: atomic ledger integrity (S13) and independent event identification (S31).

Unit: illustrative evidence and consistency score (0 to 10). Status: illustrative. Sources: S13, S31. Illustrative figures are teaching examples, not measured factory results.

Read this exhibit in its chapter ↗

12.1 · Introduction

A disciplined business impact analysis begins by drawing a firm boundary between losses caused by the absence of motive power and losses caused by the failure of the information and control layer.

Exhibit 14, chapter 04: Edge computer

12.2 · Separate physical stoppages from information-boundary losses

To price continuity accurately, engineering and finance teams must decompose a site disruption into five operational components and retain only those that change when the digital service class changes:

Exhibit 14, chapter 04: Edge computer

12.3 · Define the counterfactual manual process honestly

Every digital continuity proposal competes against a concrete operational alternative: running the factory with a structured manual paper fallback and delayed batch entry.

Exhibit 34, chapter 08: Matching scan and paper tally

12.1 · the bodyThe film above follows these sub-steps.

A disciplined business impact analysis begins by drawing a firm boundary between losses caused by the absence of motive power and losses caused by the failure of the information and control layer.[S03][S05][S1203] In a cotton-to-garment operation, a mains failure that is not bridged by standby generation halts high-kilowatt mechanical loads immediately: carding and ring-spinning frames stop, looms arrest, dye circulation pumps require thermal management, and sewing tables come to rest.[S03] As shown in Chapter 4, an illustrative 150 W protected digital circuit with 520.833 Wh of nominal battery energy is sized to carry an edge computer, message broker, local network switch, router, time source, and supervisor console for 2 hours, not to drive production motors or high-intensity inspection lamps.[S03][S05] Multiplying total factory hourly output by the duration of a utility outage and claiming the resulting sum as the benefit of an edge computing package is a boundary error.[S05][S1203]

¶ 01 · 3 sources

and supervisor console for 2 hoursS03, S05 · illustrative

Related · Exhibit 35 · chapter 09

S03S05S1203

12.2 Separate physical stoppages from information-boundary losses

12.2

To price continuity accurately, engineering and finance teams must decompose a site disruption into five operational components and retain only those that change when the digital service class changes:[S03][S05][S1203]

¶ 02 · 3 sources

S03S05S1203

  1. Idle production machinery during mains absence: When prime power fails and standby generation is unavailable or withheld due to fuel economics, physical transformation ceases.[S03] The digital continuity architecture cannot avoid this stoppage, so its evaluation must assign zero benefit to unpowered machine hours (wider generation and solar-storage economics belong in wp06).[S03][S05]
  2. Post-restoration hold awaiting digital readiness or ledger verification: When mains power returns and mechanical lines are ready to run, production can remain held because an edge gateway failed to boot without external connectivity, a database suffered unrecovered corruption, a cached model licence expired offline, or supervisors cannot confirm which garment bundles passed inspection before the blackout.[S03][S06][S15] Because a local-first architecture with bounded recovery eliminates or shortens this post-mains hold, the avoided delay is attributable to the digital continuity investment.[S05][S06]
  3. Quarantine, re-inspection, and downgrade from lost dispositions: If an abrupt power cut rolls back committed inspection records (for example, under a write-ahead log set to synchronous=NORMAL rather than FULL) or drops in-flight quality dispositions before durable storage, quality assurance must hold the affected rolls or bundles.[S13][S16] Re-inspecting finished bundles or downgrading unverified export lots carries a direct cost that atomic local capture prevents.[S13][S1203]
  4. Clerical capture and manual reconciliation burden: When electronic capture fails, operators and line clerks switch to pre-printed paper dockets, record bundle identifiers and defect codes by hand, and later key those sheets into the performance-management system (PMS) while resolving sequence gaps and duplicates.[S05][S31] The incremental labour hours required to execute and audit that manual bridge represent a direct cost of operating without automated local survival.[S05][S1203]
  5. Delayed management reporting and upstream scheduling lag: When the wide-area backhaul drops while the local network stays alive, shift huddles continue on local consoles while central dashboards wait until the store-and-forward spool drains.[S08][S18] Unless stale central visibility triggers a verified contractual penalty, emergency freight premium, or stockout within the offline window, delayed cloud reporting is a convenience degradation rather than a cash loss.[S05][S18]

The waterfall in Exhibit 47 illustrates how this boundary discipline filters an illustrative outage event before any investment comparison takes place.[S03][S05][S1203]

¶ 03 · 3 sourcesExhibit 47

S03S05S1203

In Exhibit 47, an illustrative gross outage disruption of 1,200 thousand XAF across cutting, sewing, and finishing is stripped of 780 thousand XAF in unpowered motor downtime and 140 thousand XAF in unpowered camera-bench stoppage, leaving 280 thousand XAF of exposure inside the digital boundary.[S03][S05] Subtracting an illustrative 45 thousand XAF of unavoidable floor supervision during the power transition leaves 235 thousand XAF per qualifying event as the net avoidable loss ceiling.[S05][S1203] What Exhibit 47 cannot establish is the actual monetary loss at a specific Cameroonian mill, which requires observed site outage durations and verified accounting records.[S02][S05]

¶ 04 · 4 sources

an illustrative gross outage disruption of 1,200 thousand XAF across cuttingS03, S05 · illustrative

Exhibit 47

S03S05S1203S02

12.3 Define the counterfactual manual process honestly

12.3

Every digital continuity proposal competes against a concrete operational alternative: running the factory with a structured manual paper fallback and delayed batch entry.[S05] In GFT's Cameroon textile programme, phase one of the PMS begins with structured point-of-work logs before automated edge capture and vision inspection are scaled up.[S03][S05] During an outage, operators write the 128-bit universally unique identifier (UUID) or pre-printed barcode sequence of each bundle, the operation code, the shift identifier, and the piece count onto a traveller card, and a clerk later keys those cards into the local ledger and reconciles discrepancies against supervisor tallies.[S13][S31]

¶ 05 · 4 sources

operators write the 128-bit universally unique identifier (UUID) or pre-printed barcode sequence of each bundleS13, S31

S05S03S13S31

Pricing the counterfactual manual process requires measuring four parameters during a floor drill: extra seconds per bundle to write paper dockets, the error rate of handwritten entries under shift pressure, clerical minutes per hundred bundles to key and reconcile the backlog after power returns, and batch-hold time while shipments await verified bundle genealogy.[S05][S13][S31] In Cameroon, statutory labour floors provide context: the national minimum wage (SMIG) rose from 41,875 XAF per month in 2023 to 43,969 XAF per month from 23 February 2024 (about US$76, a 5 percent rise), within an economy where the standard working week is 40 hours (48 hours maximum, with overtime at 1.2 times base pay) and cross-sector average salaries sit near US$359 per month.[R14][R15][R16] Because ledger reconciliation and quality release consume shift supervisors, quality controllers, and IT technicians rather than entry-level operatives, the counterfactual calculation must use the loaded hourly cost of those supervisory roles during normal or overtime hours, labelled as an estimate or site-accounting input.[R14][R16][S05]

¶ 06 · 6 sources

…minimum wage (SMIG) rose from 41,875 XAF per month in 2023 to 43,969 XAF…R14, R15, R16

S05S13S31R14R15R16

12.44 min · 2 sub-steps · read with a related exhibit

Use contribution margin when estimating lost output value

Related · chapter 026 paragraphs step it

Related exhibit 07 · chapter 02TimelineillustrativeConnectivity recovery can lag restoration of mains
0Mainsvoltage re…2Stablepower and…5Link up andDNS recove…7TCP and TLS1.3 handsh…8Firstremote dur…45Backlogclearance…

Read-out0: Mains voltage returns. Utility feeder re-energises at t = 0 min; ATS waits for voltage stability.

Method and source

Illustrative event sequence in relative minutes from physical voltage return (t = 0). Timings are hypothetical scenario values showing protocol and operational ordering under RFC 9293 (TCP), RFC 9846 (TLS 1.3) and NIST SP 800-184; they are not measured site timings.

Unit: illustrative relative minutes from mains return. Status: illustrative. Sources: S06, S23, S24. Illustrative figures are teaching examples, not measured factory results.

Read this exhibit in its chapter ↗
12.4 · Introduction · paragraph 1 of 6

When a digital failure halts output after prime power is restored (for example, when a corrupted local database, a failed certificate bootstrap, or an unverified model update blocks an inspection gate for 90 illustrative minutes after mains return), the model must value the lost production volume accurately.[S03][S05][S23] Valuing every delayed or lost garment bundle at its full wholesale selling price treats raw cotton lint, yarn, dyestuffs, finishing chemicals, packaging, and piece-rate consumables as if they were destroyed during the hold, whereas an idle line consumes no raw materials.[R06][S05][S1203]

12.5 Price delayed and lost units at contribution margin, not gross revenue

Under managerial accounting, the loss from an unrecovered production hour depends on whether deferred output is made up within the scheduling window and what variable costs are saved while the line stands still.[S05][S1203] Publicly reported sector figures show the weight of persistent underutilisation in Cameroon's textile industry: a July 2023 report on CICAM recorded capacity utilisation at 33.7 percent at Garoua, 48.9 percent at CICAM 1, and 10.83 percent at CICAM 2, noting that underutilisation cost about 2 billion XAF in 2020 alongside restructuring estimates of 30.7 billion to 48.2 billion XAF (and one relaunch plan cited at 70.2 billion XAF).[R12][R13] Those third-party observations reflect broad industrial and equipment conditions rather than digital outage losses at a GFT facility.[R11][R12] For a single line evaluating digital continuity, the analyst must distinguish three cases:[S05][S1203]

  • Deferred output recovered in normal shift hours: If the line has slack capacity later in the week and clears held bundles during regular paid shifts without missing a delivery window, lost contribution margin is zero; the only cost is temporary buffer handling.[R12][S05]
  • Deferred output recovered through overtime shifts: If the plant meets its delivery commitment by running authorised overtime (at or above the statutory 1.2x overtime multiplier in Cameroon), the attributable cost is the incremental overtime labour premium, auxiliary energy, and supervisory overhead required to catch up, not the unit's contribution margin.[R16][S05]
  • Permanently lost output on a bottleneck line: Only when the affected workstation is a bottleneck operating at full scheduled utilisation, or when a missed export shipping cutoff cancels the order, does an hour of post-restoration digital hold forfeit sales volume.[S05][S1203] Even then, the lost value per unit is the contribution margin (selling price less variable fibre, yarn, trim, dye, variable energy, and direct piece-work costs), never the gross selling price.[S1203]

12.6 Keep safety and mandatory traceability as gates, not trade-offs

Two requirements must never be traded off inside a payback spreadsheet: machinery safety interlocks and mandatory lot traceability.[S03][S05] As NIST SP 800-82 Rev. 3 emphasises, operational technology security and continuity architectures must address unique performance, reliability, and safety requirements.[S03] Hardwired emergency stops, thermal cutouts, pressure relief valves, and guard interlocks belong to the physical safety authority and must fail safe independently of any edge computer, database, or network switch.[S03] An economic model must never evaluate whether to fund a safety interlock based on avoided downtime, nor permit an automated restart after power return to bypass physical operator clearance.[S03][S06]

Similarly, when a buyer contract or customs regime requires complete bundle-to-bale traceability for shipment acceptance, preserving the event ledger is a market-access gate.[R06][S13] Safety and mandatory compliance define the minimum permissible service class, while contribution-margin and labour-saving calculations determine whether to invest in higher levels of automation, battery autonomy, and hardware redundancy.[S05][S1203] Capital budgeting, discount rates, tax treatment, and financing structures belong in wp13.[S05]

12.72 min · 1 sub-steps · 1 exhibit

Expose the ownership cost across the selected period

A credible economic evaluation pairs its conservative benefit boundary with a complete total cost of ownership (TCO) ledger across the evaluation horizon (such as an illustrative 36-month or 60-month window).[S04][S05] In industrial digital projects deployed in hot, dusty, and electrically harsh environments, initial capital expenditure on edge computers and switches often represents less than half of the multi-year cash commitment.[S03][S05] Suppliers routinely quote attractive unit hardware prices while omitting the recurring costs required to keep that hardware functional, licensed, and recoverable on a weak grid.[S04][S1201]

¶ 01 · 4 sources

…horizon (such as an illustrative 36-month or 60-month window)S04, S05 · illustrative

Related · Exhibit 17 · chapter 04

S04S05S03S1201

12.8 Itemise lifecycle, replacement, and verification costs before signing

12.8

To prevent post-award budget surprises, the procurement lead should require every bidder to populate a standardised cost schedule separating one-time acquisition from recurring obligations and condition-triggered replacements:[S04][S05][S1201]

¶ 02 · 3 sources

S04S05S1201

  • Protected power path and battery replacement cycles: Uninterruptible power supplies, converters, surge protection, transfer relays, and enclosure fans degrade faster under deep discharges and high ambient temperatures.[S03][S05] Even for an illustrative 150 W digital load requiring 520.833 Wh of nominal battery capacity (at 0.90 conversion efficiency, 0.80 usable fraction, and 0.80 end-of-life capacity), the budget must include scheduled battery cell replacement and periodic load testing.[S05]
  • Local storage endurance and spare media: Continuous write-ahead logging (WAL) with synchronous=FULL durability, MQTT broker persistence (mosquitto.db), systemd journal storage (journald.conf), and image spooling generate sustained write wear on solid-state drives.[S14][S16][S20][S22] Because SQLite WAL requires same-host storage and cannot run over a network filesystem, high-endurance industrial flash media and pre-imaged spare drives belong in the bill of materials.[S14][S15][S29]
  • Cold-spare hardware and rehearsed handover: As shown in Chapter 11, a recovery time objective cannot be met on an isolated site if a failed edge computer or switch requires weeks of shipping and customs clearance.[S04][S06] Holding at least one firmware-verified spare node on site (with documented UUID handover and SQLite online backup tools) is a base-case inventory cost.[S04][S17][S31]
  • Backhaul retainers and secondary path fees: Contracting a primary link alongside a secondary cellular or satellite path for store-and-forward replay (such as clearing an illustrative 0.72 decimal GB 8-hour backlog at 100,000 bytes/s of useful goodput) incurs monthly standby retainers and burst data tariffs whether or not an outage occurs.[S08][S18][S24]
  • Software licensing, certificates, and fault commissioning: Commercial edge runtimes, offline licence tokens, local certificate integration under TLS 1.3 and NTS, firmware recovery signing, and witnessed fault-injection tests (Chapter 13) must be priced explicitly prior to award.[S04][S06][S23][S27][S28][S1201]

The register in Exhibit 48 provides a structured template for capturing these commitments without inventing market prices.[S04][S05][S1201]

¶ 03 · 3 sourcesExhibit 48

S04S05S1201

Exhibit 48RegisterillustrativeCost ownership should remain explicit after procurement
Cost category
Edge compute, switches, and local time source
Budget owner
Factory IT / OT lead
Cadence
Initial capex + spare pool
Currency and basis
Quoted XAF or EUR landed
Replacement or trigger condition
Hardware failure or firmware end-of-support (S04)

Read-outCost category: Edge compute, switches, and local time source. Budget owner: Factory IT / OT lead. Cadence: Initial capex + spare pool. Currency and basis: Quoted XAF or EUR landed. Replacement or trigger condition: Hardware failure or firmware end-of-support (S04)

Open the full register (6 rows)
Edge compute, switches, and local time sourceFactory IT / OT leadInitial capex + spare poolQuoted XAF or EUR landedHardware failure or firmware end-of-support (S04)
Protected digital UPS, transfer path, and cellsElectrical engineeringInitial + cell cycleQuoted XAF landedMeasured autonomy below 0.80 end-of-life threshold (S05)
Industrial SSD media for WAL and broker spoolFactory IT / OT leadInitial + wear replacementQuoted XAF landedSMART wear threshold or write-barrier fault (S14, S29)
Primary and secondary WAN backhaul retainersNetwork operationsMonthly recurringContracted XAF / monthShared-path audit failure or goodput breach (S18, S24)
Edge software, model, and offline licence tokensDigital programme leadAnnual recurringQuoted EUR / USD + XAF taxVersion renewal or offline cold-boot failure (S1201)
Witnessed fault commissioning and recovery drillsQuality and operationsAcceptance + quarterlyInternal labour + vendor feeFailed ledger reconciliation or runbook change (S06, S28)
Method and source

Illustrative procurement cost-register template for a multi-year continuity evaluation. No market prices or vendor quotations are invented; bidders and site engineers must populate quoted values, currencies (XAF, EUR, or USD), quote dates, and replacement triggers before investment sign-off.

Unit: procurement register fields. Status: illustrative. Sources: S04, S05, S1201. Illustrative figures are teaching examples, not measured factory results.

As Exhibit 48 shows, every line item is tied to a named internal owner, a billing cadence, an explicit currency basis, and an engineering replacement condition.[S04][S05][S1201] Because the CFA franc (XAF) is pegged to the euro at 655.957 XAF per euro, quotations in euros carry a stable reference parity against local XAF budgets, whereas US dollar quotations introduce exchange-rate variance that finance must record with the quote date and source.[R32] What Exhibit 48 cannot supply is a substitute for live commercial tenders: customs duties, tax treatment, installation rates, and freight to Douala or Garoua must be verified by commercial, tax, and legal advisers when bids arrive.[S26][S1201]

Interlude · the cloth half-woven

4 exhibits carry this chapter's argument.

Woven: sections 12.0 to 12.7Still to weave: 12.9 to 12.16

  1. 47Only attributable losses belong in the benefit caseReconciliation
  2. 48Cost ownership should remain explicit after procurementRegister
  3. 49The preferred option changes when outage and recovery assumptions changeControl map
  4. 50The purchase must specify how continuity will be provedDecision map
Hover or focus an exhibit to light its weft; select it to jump to it.

12.95 min · 2 sub-steps · 1 exhibit

Test sensitivity instead of publishing an unsupported payback

Step 1 of 512 events/yr (1/mo)

Exhibit 49 · illustrativeThe preferred option changes when outage and recovery assumptions change

30 kXAF/event50 kXAF/event80 kXAF/event120 kXAF/event12 events/yr (1/mo)-1,440-1,200-840-36024 events/yr (2/mo)-1,080-6001201,08048 events/yr (4/mo)-3606002,0403,96084 events/yr (7/mo)7202,4004,9208,280120 events/yr (10/mo)1,8004,2007,80012,600
30 kXAF/…50 kXAF/…80 kXAF/…120 kXAF…12 events/yr (1/…-1,440-1,200-840-36024 events/yr (2/…-1,080-6001201,08048 events/yr (4/…-3606002,0403,96084 events/yr (7/…7202,4004,9208,280120 events/yr (1…1,8004,2007,80012,600

12 events/yr (1/mo)

12 events/yr (1/mo): 30 kXAF/event -1,440, 50 kXAF/event -1,200, 80 kXAF/event -840, 120 kXAF/event -360 (thousand XAF per year) · illustrative

A single-point payback claim is analytically meaningless when the site failure distribution has not yet been measured.

24 events/yr (2/mo)

24 events/yr (2/mo): 30 kXAF/event -1,080, 50 kXAF/event -600, 80 kXAF/event 120, 120 kXAF/event 1,080 (thousand XAF per year) · illustrative

48 events/yr (4/mo)

48 events/yr (4/mo): 30 kXAF/event -360, 50 kXAF/event 600, 80 kXAF/event 2,040, 120 kXAF/event 3,960 (thousand XAF per year) · illustrative

84 events/yr (7/mo)

84 events/yr (7/mo): 30 kXAF/event 720, 50 kXAF/event 2,400, 80 kXAF/event 4,920, 120 kXAF/event 8,280 (thousand XAF per year) · illustrative

120 events/yr (10/mo)

120 events/yr (10/mo): 30 kXAF/event 1,800, 50 kXAF/event 4,200, 80 kXAF/event 7,800, 120 kXAF/event 12,600 (thousand XAF per year) · illustrative

The method behind it: Worked example.

Method and source · Exhibit 49

Illustrative sensitivity matrix computing Net Benefit = (Annual qualifying outages * Avoidable loss per event) - 1,800 thousand XAF incremental annual cost for Option B over Option A. Negative cells indicate conditions where the manual-plus-local-store baseline (Option A) is more economical; positive cells favour the supervised protected edge architecture (Option B). All figures are illustrative scenario calculations, not observed GFT results.

Unit: thousand XAF per year. Status: illustrative. Sources: S01, S02, S05. Illustrative figures are teaching examples, not measured factory results.

12.9 · the bodyExhibit 49 above; its figures are illustrative where marked.

A single-point payback claim is analytically meaningless when the site failure distribution has not yet been measured.[S01][S02][S05] The World Bank Enterprise Surveys Cameroon 2024 Country Profile reports that 93.3 percent of surveyed firms experienced electrical outages (compared with 69.7 percent across Sub-Saharan Africa and 55.0 percent across lower-middle-income economies) and records 10.4 electrical outages in a typical month for Cameroon (against 6.9 for Sub-Saharan Africa and 5.3 for lower-middle-income comparators).[S01] However, as the Enterprise Surveys methodology documents, those indicators come from stratified, weighted responses across a broad national sample frame.[S01][S02] The 10.4 monthly figure is not a site-level textile measurement, states no outage duration distribution, and does not record whether wide-area telecommunications failed simultaneously.[S01][S02]

¶ 01 · 3 sources

The 10.4 monthly figure is not a site-level textile measurementS01, S02

Related · Exhibit 25 · chapter 06

S01S02S05

12.10 Model correlated failures and break-even surfaces explicitly

12.10

Inserting 10.4 outages per month into a cash-flow projection as a fixed constant hides two opposite risks.[S01][S05] If a mill sits on a dedicated feeder that limits unbridged digital disruptions to 2 qualifying events per month, an expensive active-active cluster will never recover its incremental cost.[S05] Conversely, if a mill faces 15 power and backhaul interruptions per month during the rainy season and common-cause failures drop the local cellular tower battery alongside the factory feeder, an undersized buffer or unverified database configuration will suffer repeated rollbacks and post-restoration holds.[S05][S16][S18]

¶ 02 · 4 sources

Inserting 10.4 outages per month into a cash-flow projection as a fixed constant hides…S01, S05

S01S05S16S18

Rather than guessing a point payback, the engineer should evaluate a sensitivity surface and break-even thresholds across three candidate continuity options:[S05][S1203]

¶ 03 · 2 sources

S05S1203

  • Option A (Manual-plus-local-store baseline): Pre-printed bundle dockets with UUID barcodes, clerical transcription into a single local SQLite database configured with WAL and synchronous=FULL, daily verified backups via the SQLite Backup API to removable media, and delayed batch upload.[S13][S16][S17][S31]
  • Option B (Supervised protected edge node): The Option A durable database augmented by automated point-of-work capture, an atomic event-and-outbox transaction boundary, an illustrative 150 W UPS providing 2 hours of digital ride-through and orderly shutdown (520.833 Wh nominal capacity), an 8-hour local spool (0.72 decimal GB payload draining in 9,600 seconds at 75,000 bytes/s net drain), a local freshness console, and one cold-spare device on site.[S05][S08][S13][S18]
  • Option C (Redundant dual-node cluster with dual backhaul): Clustered local compute nodes, automated failover supervision, dual independent WAN carriers (subject to physical path audit), and extended 8-hour battery autonomy across the switching and inspection chain.[S03][S05][S18]

The heatmap in Exhibit 49 maps the net annual benefit of Option B over Option A across annual qualifying outage frequencies and per-event avoidable losses, holding the illustrative incremental annual cost at 1,800 thousand XAF.[S01][S02][S05]

¶ 04 · 3 sources

holding the illustrative incremental annual cost at 1,800 thousand XAFS01, S02, S05 · illustrative

Exhibit 49

S01S02S05

Inspecting Exhibit 49 shows why site measurement (Chapter 2) must precede procurement freeze.[S02][S05] At 12 qualifying events per year, Option B is negative across all four loss columns (-1,440 to -360 thousand XAF), favouring Option A's manual docket and local SQLite ledger.[S05][S13] At 24 events per year and 80 thousand XAF avoidable loss per event, net benefit turns positive (+120 thousand XAF) and reaches +7,800 thousand XAF at 120 events per year.[S05] What Exhibit 49 cannot prove is where a specific Cameroonian facility sits on this grid without site logging and a timed reconciliation drill.[S01][S02]

¶ 05 · 4 sources

At 12 qualifying events per yearS05, S13

Exhibit 49

S02S05S13S01

12.11 Account for correlated failures before paying for redundancy

12.11

Sensitivity analysis must also test common-cause failure correlation before allocating budget to dual-carrier network links.[S05][S18] Vendors often justify a second cellular SIM or wireless ISP by multiplying independent unavailability figures (claiming that two links each with 5 percent illustrative unavailability yield 0.25 percent combined unavailability).[S18] If both providers share a local tower whose battery exhausts 90 minutes into a regional blackout, or cross the same duct bridge outside the industrial zone, their failures during prolonged outages are correlated.[S03][S18] When the local edge queue already holds 8 to 24 hours of production events durably (Chapter 7), paying monthly retainers for a second carrier that fails during the same blackout buys no additional record durability.[S08][S18]

¶ 06 · 4 sources

If both providers share a local tower whose battery exhausts 90 minutes into a regional blackoutS03, S18

S05S18S03S08

12.123 min · 1 sub-steps · 1 exhibit

A vendor claim should become an acceptance obligation

Even a sound economic case fails if the purchased hardware and software do not deliver the assumed recovery behaviour when the grid drops.[S04][S06][S1201] Commercial proposals routinely rely on vague assurances such as "offline-capable edge AI", "enterprise persistence", or "guaranteed delivery".[S19][S20][S1201] Primary specifications show why none of those phrases establish an end-to-end production record contract:[S13][S24]

  • Transport reliability is not application durability: RFC 9293 specifies that TCP provides a reliable, in-order byte-stream service to applications, not proof that a receiving database has durably committed a bundle record to non-volatile media.[S13][S24]
  • Protocol quality of service is not idempotent ledger posting: OASIS MQTT Version 5.0 defines QoS 1 ("At least once", where duplicates can occur), and Eclipse Mosquitto writes state to mosquitto.db only when persistence is configured and checkpointed.[S19][S20] Without transactional deduplication keyed by source UUID at the consumer (comparable to idempotent method semantics in RFC 9110 for HTTP), replaying an offline queue can double-count piecework output.[S12][S13][S31]
  • Database consistency is not crash durability: SQLite documents that a transaction committed in WAL mode with synchronous=NORMAL might roll back following a power loss or crash, and full durability further depends on ext4 write barriers and storage media that honour flush commands.[S15][S16][S29]

12.13 Translate technical requirements into milestone-gated contract schedules

12.13

Aligning with NIST SP 800-161 Rev. 1 and CSF 2.0 supply chain risk management practices (GV.SC-05 and ID.RA-09), resilience and integrity requirements must be integrated into supplier contracts and verified prior to final payment.[S26][S1201] The purchase contract should hold back an acceptance milestone payment until the supplier demonstrates six behaviours under witnessed fault injection (Chapter 13):[S06][S28]

¶ 02 · 4 sources

Aligning with NIST SP 800-161 Rev. 1 and CSF 2.0 supply chain risk management…S26, S1201

S26S1201S06S28

  1. Cold boot without external network reachability: With wide-area links disconnected and upstream DNS unreachable, the edge appliance and inspection software must cold-boot, validate local licences and cached weights, authenticate operators, and record events within the recovery time objective.[S03][S04][S05]
  2. Readback of synchronous durability settings: The system must provide an auditable readback proving that the local event store and outbox run on a local filesystem with WAL enabled, synchronous=FULL, and write barriers active.[S13][S14][S16][S29]
  3. Zero committed-record loss under abrupt power removal: Pulling input power during active synthetic event generation must result in zero loss of any locally acknowledged event, verified against an external test ledger.[S13][S28]
  4. Bounded queue overflow and explicit backpressure: Filling the offline spool to its high-watermark limit must preserve mandatory trace records, discard only pre-authorised diagnostic streams, increment a visible rejected-event counter, and alert the supervisor.[S03][S05][S08]
  5. Idempotent replay without duplicate business actions: Replaying a backlog containing injected duplicate UUIDs, reordered timestamps, and interrupted transfers must produce exactly one committed business record per unique source event in the receiving PMS.[S12][S13][S19][S31]
  6. Interrupted update rollback and spare handover: Cutting power mid-update must leave the node booting cleanly into the previous signed version, and restoring an online backup onto the cold-spare unit must preserve source identity and sequence continuity.[S04][S06][S17][S31]

The compliance matrix in Exhibit 50 maps these procurement obligations along implementation effort versus avoidable-loss and recovery protection.[S04][S05][S06][S1201]

Exhibit 50Decision mapillustrativeThe purchase must specify how continuity will be proved
Core contract gatesEngineered proofRoutine clausesOver-specifiedImplementation and verification effort →Avoidable loss and recovery protection →Offline cold-boot testWAL FULL readbackOpen schema exportAtomic outbox + dedupCold-spare restore dr…Interrupted update ro…Shared-path WAN auditActive-active cluster…

Read-outOffline cold-boot test: Implementation and verification effort 2.5, Avoidable loss and recovery protection 9.2. Quadrant: Core contract gates

Method and source

Illustrative procurement prioritisation matrix scoring candidate contract obligations on implementation and verification effort (x-axis, 0 to 10) versus avoidable-loss and recovery protection (y-axis, 0 to 10). Upper-left items represent low-effort, high-protection mandatory contract gates; upper-right items require deeper engineering integration and witnessed fault testing. Scores are illustrative method weights, not empirical measurements.

Unit: illustrative score (0 to 10). Status: illustrative. Sources: S04, S05, S06, S1201. Illustrative figures are teaching examples, not measured factory results.

In Exhibit 50, the upper-left quadrant ("Core contract gates") highlights three low-effort, high-protection obligations that every tender should mandate: offline cold-boot testing (x: 2.5, y: 9.2), WAL and synchronous=FULL readback (x: 2.0, y: 8.8), and open schema export (x: 3.0, y: 8.5).[S04][S16][S1201] The upper-right quadrant ("Engineered proof") groups atomic outbox deduplication (x: 6.2, y: 9.5), cold-spare restore drills (x: 5.8, y: 8.4), and interrupted update rollback (x: 6.8, y: 7.8), which require witnessed fault testing to protect the ledger.[S06][S13] By contrast, an active-active cluster service-level agreement (x: 9.0, y: 3.2) sits in the lower-right quadrant ("Over-specified") when local skills and common-cause power failures make complex clustering fragile.[S05] What Exhibit 50 cannot replace is formal legal drafting of remedies and warranty terms by qualified counsel.[S26][S1201]

¶ 01 · 7 sources

2.5S04, S16, S1201

Exhibit 50

S04S16S1201S06S13S05S26

12.142 min · 1 sub-steps · read with a related exhibit

Choose a maintainable option for the actual local team

An architecture that passes a vendor demonstration can still fail economically if its operation and post-outage restoration exceed the staffing, skills, and spare-parts reality of the plant.[S03][S05][S06] In Cameroon's textile sector, where industrial sites operate across regional contexts such as Garoua in the north and Douala or Dibamba near the coast, immediate access to vendor field engineers and proprietary modules cannot be assumed during an outage.[R03][R10][S05] When a multi-node cluster enters a split-brain state after battery exhaustion, a plant that waits 72 illustrative hours for external support suffers worse downtime than a plant running a simpler, locally maintainable design.[S05][S06]

¶ 01 · 5 sources

a plant that waits 72 illustrative hours for external support suffers worse downtime than…S05, S06 · illustrative

Related · Exhibit 43 · chapter 11

S03S05S06R03R10

12.15 Match architectural complexity to site restoration duties

12.15

To align the investment with the people who will run it (connecting to workforce training in wp09), the evaluation team should compare the three candidate options across four maintainability dimensions using the build-or-buy and use-case-portfolio decision tools:[S03][S05]

¶ 02 · 2 sources

S03S05

  1. Routine shift supervision burden: Under Option A (manual fallback), staff distribute, write, and key paper dockets for every bundle.[S05] Under Option B (supervised protected edge), operators scan bundles locally while the UPS holds the 150 W digital circuit, and the supervisor watches a single local freshness and queue indicator.[S03][S05] Under Option C (redundant cluster), quorum or failover anomalies present diagnostic states that line supervisors cannot resolve locally.[S05][S06]
  2. Local fault diagnosis and service restart: A single Linux edge host managed via documented systemd.service units, persistent journald.conf logs, chrony RTC drift compensation (rtcfile with -s), and a local SQLite store can be inspected by a trained plant technician following a printed runbook.[S17][S21][S22][S30] A proprietary appliance that hides logs behind a remote-support tunnel leaves local technicians blocked when the WAN is down.[S03][S22]
  3. Spare-part replacement and identity handover: Under Option B, swapping in a pre-staged identical edge box, restoring the latest verified online backup (SQLite Backup API), advancing the boot identity counter, and resuming capture is a deterministic 30-to-60-minute illustrative procedure.[S04][S17][S31] Under Option C, replacing a cluster node often requires online licence re-activation that fails while backhaul is degraded.[S04][S23]
  4. Custom integration versus bought sub-assemblies: Standard industrial UPS units, managed switches, and cameras should be bought with hardware warranties, whereas the transaction-and-outbox contract, UUID event schema, and reconciliation ledger should remain transparent so no black-box vendor locks up the system of record.[S13][S31][S1201]
Note · 4 sources

S05S13S17S06

12.163 min · 2 sub-steps · read with a related exhibit

Contractual exit must preserve the production history

The final test of a continuity investment occurs at the end of a supplier contract, software subscription, or pilot phase.[S26][S1201] As NIST CSF 2.0 subcategory GV.SC-10 notes, cybersecurity supply chain risk management plans should include provisions for activities that occur after the conclusion of a partnership or service agreement.[S26] In industrial digital programmes, a recurring commercial failure is traceability lock-in: a factory pays for edge hardware and multi-year software licences, only to discover upon non-renewal that its historical production events, defect images, and quality dispositions are trapped inside a proprietary binary format or an edge agent that disables local queries when its subscription token expires.[S26][S1201]

¶ 01 · 2 sources

As NIST CSF 2.0 subcategory GV.SC-10 notesS26

Related · Exhibit 46 · chapter 11

S26S1201

12.17 Mandate open schemas, portable dumps, and survival after licence expiry

12.17

To ensure that accumulated evidence remains a permanent industrial asset (linking to data governance in wp14 and regulatory framing in wp17), procurement specifications should make exit portability a condition of contract award:[S26][S1201]

¶ 02 · 2 sources

S26S1201

  • Unencumbered ownership of production records: The contract should state that all source events, bundle identifiers, timestamps, clock-quality metadata, inspection images, defect labels, and reconciliation audit trails generated at the site belong to the factory operator from capture.[S31][S32][S1201]
  • Documented, human-readable export without vendor assistance: The local store and central PMS must support unthrottled local export in open formats at any time without requiring a vendor release key or cloud round-trip.[S17][S1202] For SQLite-backed edge stores, the standard command-line .dump command converts the entire contents and schema of a database into a single portable UTF-8 text file, while online backup files and structured exports carrying RFC 9562 UUIDs and RFC 3339 UTC timestamps allow direct ingestion into a replacement system.[S17][S31][S32][S1202]
  • Graceful behaviour upon licence expiry: If a commercial subscription expires, the contract and acceptance test must forbid the software from deleting local data, revoking read access to historical logs, or halting safe local passthrough without notice.[S03][S26][S1201] Even if proprietary model inference stops after contract end, the local database and historical audit trail must remain readable and exportable by plant staff.[S17][S1202]
  • Retention of recovery documentation and configuration artefacts: Handover at commissioning must include schema definitions, systemd.service and journald.conf files, mosquitto.conf settings, database pragma configurations, and cold-spare restoration runbooks so plant engineers can maintain or migrate the record independently.[S16][S20][S21][S22]

12.18 Hand verified economic and contract gates to commissioning

12.18

When the boundary decomposition, contribution-margin model, lifecycle cost register, break-even sensitivity surface, maintainability review, and exit portability clauses are complete, the investment decision no longer rests on optimistic vendor brochures.[S05][S1201][S1203] The sponsor knows which losses the protected digital circuit can avoid, how many qualifying disruptions per year are needed to justify the supervised edge architecture over a manual paper bridge, which line items belong in the multi-year budget, and which behaviours the supplier must prove before receiving final milestone sign-off.[S05][S06] Chapter 13 turns those contractual obligations directly into the fault-injection and commissioning programme that every candidate system must pass before a pilot is scaled across the factory.[S06][S28]

¶ 03 · 5 sources

S05S1201S1203S06S28

Check the record

The chapter keeps its sources within reach.

Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.

41 sources · 403 citation marks on this pageMost cited: S05, 82 times

Grade AGrade BGrade CKnot size: citations on this page

All 41 records shown

R03 · Grade C · inherited record

SODECOTON

Inherited evidence R03

Company profile: more than 220,000 cotton producers supported in northern Cameroon; nine ginning plants; two oil mills.

Publication date unrecorded. Inherited source-text record. The original publication has not been independently reopened for this web edition.

Chapter source notes

S03 NIST. 2023.

S05 NIST. 2010.

S1203 NIST. 2022-11.

S13 SQLite. 2026-10-30.

S04 NIST. 2018.

S06 NIST. 2016.

S1201 NIST. 2024-11-01.

R06 Cameroon Trade Hub. Publication date unrecorded; inherited source-text check.

R07 Ecofin Agency. Publication date unrecorded; inherited source-text check.

R12 Business in Cameroon. Publication date unrecorded; inherited source-text check.

S26 NIST. 2024-02-26.

S15 SQLite. 2026-10-30.

S16 SQLite. 2026-10-30.

S31 IETF / RFC Editor. 2024.

S08 IETF / RFC Editor. 2007.

S18 IETF / RFC Editor. 2014.

S02 World Bank. 2026-10-30.

R14 WageIndicator. Publication date unrecorded; inherited source-text check.

R15 wage.is. Publication date unrecorded; inherited source-text check.

R16 WageIndicator. Publication date unrecorded; inherited source-text check.

S23 IETF / RFC Editor. 2026.

R13 Business in Cameroon; MMI News. Publication date unrecorded; inherited source-text check.

R11 Business in Cameroon; MMI News. Publication date unrecorded; inherited source-text check.

S01 World Bank. 2025.

S14 SQLite. 2026-10-30.

S20 Eclipse Mosquitto. 2026-10-30.

S22 systemd project. 2026-10-30.

S29 Linux kernel project. 2026-10-30.

S17 SQLite. 2026-10-30.

S24 IETF / RFC Editor. 2022.

S27 IETF / RFC Editor. 2020.

S28 SQLite. 2026-10-30.

R32 Wise; XE. Publication date unrecorded; inherited source-text check.

S21 systemd project. 2026-10-30.

S19 OASIS. 2019-03-07.

S12 IETF / RFC Editor. 2022.

R03 SODECOTON. Publication date unrecorded; inherited source-text check.

R10 Ecofin Agency. Publication date unrecorded; inherited source-text check.

S30 chrony project. 2026-10-30.

S32 IETF / RFC Editor. 2002.

S1202 SQLite. 2026-10-30.

Keep the thread · chapter 12 of 14

Chapter 13 picks up the thread.

Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.

The paper's rack · 14 boltsBolt length: reading time

13Part IV: Prove and govern continuity

Commissioning must challenge the system at its failure boundaries

A repeatable fault programme should verify declared losses, restart behaviour and reconciled records before a pilot is expanded.

  • 13.1Map each requirement to an observable failure experiment
  • 13.3Simulation and hardware exercises answer different questions
  • 13.4A deterministic event ledger reveals missing and duplicate work
  • 13.6Combine faults that share a plausible dependency
Reading time
25 min
Exhibits
4
Sections
7
Continue to chapter 13
← Previous: chapter 11, Recovery finishes when the record and the process agreeContinue the threadChapter 13 · Commissioning must challenge the system at its failure boundaries

Find a thread.

Type to search.