Research libraryFactories on a Weak Grid
Chapter 05 of 14 · Part II · Draft web edition
Local name resolution, switching, identity and observability need their own continuity plan when external connectivity disappears.
The cloth is woven from this chapter's 4 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.
Read-out
Illustrative plant LAN dependency stack derived from NIST SP 800-82 Rev. 3 zone segmentation principles (S03) and RFC 7228 constrained-network topology considerations (S18). Every component in Layers 1 to 3 must operate with Layer 4 physically disconnected.
Unit: illustrative architecture layers. Status: illustrative. Sources: S03, S18. Illustrative figures are teaching examples, not measured factory results.
Overture · 1 min
A factory network on a weak grid remains useful during a wide-area outage only if every service required to address, authenticate, route and observe local traffic lives inside the plant boundary and shares a protected power path [S03][S18]. Many industrial sites protect an edge server or wide-area router with an uninterruptible power supply, yet lose internal operations when the backhaul drops or a feeder trips because floor switches, address leases, name resolvers, broker credentials or operator consoles depend on unbacked distribution boards or external cloud endpoints [S03][S05]. Designing for intermittent connectivity starts on the local area network (LAN) before it touches a wide-area carrier. When local switching, naming, time distribution, transport sessions and maintenance access function without an internet route, the plant can record production events, display local alarms and coordinate floor workstations for hours or days until upstream links return [S06][S08].
This chapter defines the controls that keep a plant network operational during external disconnection and disciplined during link recovery. Following the power boundary of Chapter 4 and preceding the storage rules of Chapter 6, it maps external and electrical dependencies on the LAN [S03][S18], replaces advertised carrier bandwidth with useful application goodput measured at durable commit [S12][S24], compares transport protocols under channel loss [S09][S12][S19][S24], evaluates multi-carrier diversity through common-cause failure paths [S05][S18], bounds retry and backlog admission during recovery [S06][S19][S20], establishes controlled offline administration under cached identity and bounded clock uncertainty [S23][S27], and specifies a fault-injection qualification protocol before production cutover [S06][S28].
5.1
Related · chapter 117 paragraphs step it
Read-out
Illustrative recovery order proposed by GFT. Equal numeric positions show precedence only and carry no measured or promised durations. Remote replay may transmit after local capture is ready, but its closure remains subject to reconciliation and release evidence.
Unit: illustrative dependency position, not elapsed time. Status: illustrative. Sources: S03, S05, S21. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗Industrial digital systems frequently fail during a backhaul outage not because the application logic requires remote compute, but because basic network plumbing relies on external reachability or unprotected floor power [S03][S18]. In a typical commercial deployment, a barcode terminal or programmable logic controller gateway resolves an edge broker hostname through a domain name system (DNS) forwarder pointing to a public resolver, obtains its dynamic host configuration protocol (DHCP) lease from an office router, validates transport certificates against an online revocation responder, and authenticates operator sessions through a remote identity provider [S03][S23]. While the wide-area link is healthy and every distribution board is energised, this chain appears local to the shop floor. When upstream fibre is cut or a brownout drops an intermediate switch cupboard, the chain breaks inside the factory even though the edge server remains powered [S03][S05].
Keeping the local network useful requires treating the plant LAN as an autonomous survivorship zone with its own power, addressing, naming, time and session authorities [S03][S11]. NIST SP 800-82 Rev. 3 emphasises that operational technology networks must be segmented and engineered so that loss of external connectivity or corporate IT services does not impair essential local monitoring and control [S03]. Similarly, RFC 7228 notes that constrained networks combine node limitations with channel loss, unpredictable bandwidth and dynamic topology changes [S18]. As shown in Exhibit 18, every layer between the capture terminal and the local edge store must remain complete inside the site boundary when wide-area carriers are dark.
A common procurement mistake on industrial sites is placing an uninterruptible power supply under the wide-area router and edge server while leaving intermediate access switches on raw lighting circuits [S03][S05]. Under Dependency Inference, a path is only as available as the minimum of its series elements. If a line scanner connects through an unpowered 8-port floor switch on a pillar, or through a wireless access point whose power-over-Ethernet (PoE) injector sits on an unprotected sub-board, the edge server is unreachable during a mains sag even if its own battery holds for 60 minutes (illustrative site configuration) [S03][S05].
Mapping the physical LAN path requires tracing every active device between the data source and the local store: media converters, PoE midspans, floor switches, wireless bridges and industrial firewalls [S03]. Each intermediate device must share the protected DC or UPS circuit of the service class it supports (Chapter 3) or be bypassed by a direct home-run cable to a protected switch [S03][S05]. Where a floor switch serves both essential terminals and non-essential office loads, shedding non-essential PoE ports during mains loss prevents peripheral devices from draining the switch backup supply (illustrative operational rule) [S03].
Even when every switch remains powered, software dependencies can sever local communication after a link failure or cold reboot. Four control-plane traps must be eliminated by design [S03][S11][S23]:
broker.plant.example and the local DNS resolver acts only as a forwarding cache, cached records expire once their time-to-live (TTL) elapses [S03]. A 300-second TTL (illustrative setting) means that five minutes after the backhaul drops, any restarting client fails with a name-resolution error even though the broker sits on the same VLAN [S03]. The plant network must run a local authoritative DNS zone for internal service names, backed by static host entries on critical gateways [S03].5.4
Related · chapter 079 paragraphs step it
Read-out
Derived from illustrative C02 and C03 assumptions: arrival 25,000 bytes/s for 28,800 s creates 720 MB. Useful restored capacity 100,000 bytes/s less live arrivals 25,000 bytes/s gives net drain 75,000 bytes/s and clearance 9,600 s. Elapsed labels are categorical and unequally spaced; 10.67 h is rounded from 10 h 40 min. Storage overhead and later interruptions are excluded.
Unit: decimal MB of queued payload. Status: derived. Sources: S08, S18.
Read this exhibit in its chapter ↗Carrier quotations state nominal peak bit rates, such as a 10 megabits per second (Mbit/s) wireless link or a 50 Mbit/s shared fibre circuit (illustrative offerings) [S18]. On a weak grid or across contended last-mile infrastructure, advertised link bandwidth is a poor predictor of whether an edge store can clear its backlog before the next outage window [S08][S18]. RFC 7228 warns that constrained networks exhibit limited, unpredictable bandwidth alongside lossy channels [S18]. Engineers must separate raw channel capacity from effective application goodput: the volume of unique, schema-valid application payload durably committed and acknowledged by the receiving endpoint per unit of elapsed wall-clock time [S12][S13][S24].
Between reading queued records from a local SQLite store and receiving remote confirmation of durable acceptance, a TCP stream (RFC 9293) must complete a three-way handshake, negotiate TLS 1.3 parameters (RFC 9846) and open its congestion window [S13][S23][S24]. Packet loss or wireless fading forces TCP to retransmit segments, reduce its congestion window and stall delivery until in-order sequence continuity is restored [S24]. If the bearer drops before the receiving application commits the batch and returns an application-layer confirmation (an HTTP 2xx status under RFC 9110 or an MQTT PUBACK under OASIS MQTT v5.0), the partially transmitted payload must be sent again when the link recovers [S12][S19][S24].
Useful upload capacity over an observation window $T_{\text{window}}$ (such as a 1-hour recovery interval or 24-hour operating day, illustrative intervals) is defined at the application commit boundary [S12][S13]:
$$G_{\text{eff}} = \frac{B_{\text{committed}}}{T_{\text{window}}}$$
Here $B_{\text{committed}}$ is the total number of unique application payload bytes (excluding duplicate replays, aborted partial transfers, TLS record headers, TCP/IP headers and link framing) for which the local sender receives an explicit, durable commit acknowledgement during $T_{\text{window}}$ (illustrative formula convention) [S12][S19][S23][S24]. This metric penalises four sources of waste hidden by interface counters [S18][S24]:
PUT requests in RFC 9110), lost acknowledgements trigger retransmission of already-stored records, consuming uplink capacity even when idempotent deduplication preserves data integrity [S12][S19].No carrier performance figures are asserted in this paper for any region or operator, because links vary by tower load, weather, power state and time of day [S01][S18]. Before freezing batch sizes or backlog clearance budgets on a target site, the engineering team must instrument a local probe across working shifts and outage windows to record six distinct time series [S18][S24]:
RST or bearer drops, governing batch size between interruptions [S18][S24].5.7
CoAP NON (UDP, RFC 7252)
CoAP NON (UDP, RFC 7252): Built-in session state and ordering (0 to 100) 18, Lossy and low-MTU link fit (0 to 100) 88. Quadrant: Constrained datagram telemetry (RFC 7252) · sourced
No single transport protocol is universally superior across both the shop floor and the wide-area backhaul .
CoAP CON (UDP, RFC 7252)
CoAP CON (UDP, RFC 7252): Built-in session state and ordering (0 to 100) 38, Lossy and low-MTU link fit (0 to 100) 82. Quadrant: Constrained datagram telemetry (RFC 7252) · sourced
MQTT v5.0 QoS 0 (TCP, OASIS)
MQTT v5.0 QoS 0 (TCP, OASIS): Built-in session state and ordering (0 to 100) 52, Lossy and low-MTU link fit (0 to 100) 35. Quadrant: Stateless transactional batches (RFC 9110) · sourced
MQTT v5.0 QoS 1 (TCP, OASIS)
MQTT v5.0 QoS 1 (TCP, OASIS): Built-in session state and ordering (0 to 100) 78, Lossy and low-MTU link fit (0 to 100) 64. Quadrant: Store-and-forward brokered session (MQTT) · sourced
MQTT v5.0 QoS 2 (TCP, OASIS)
MQTT v5.0 QoS 2 (TCP, OASIS): Built-in session state and ordering (0 to 100) 92, Lossy and low-MTU link fit (0 to 100) 42. Quadrant: Stateless transactional batches (RFC 9110) · sourced
HTTP PUT/POST batches (RFC 9110)
HTTP PUT/POST batches (RFC 9110): Built-in session state and ordering (0 to 100) 65, Lossy and low-MTU link fit (0 to 100) 48. Quadrant: Stateless transactional batches (RFC 9110) · sourced
Source-based comparison of protocol mechanics specified in RFC 7252 (CoAP, S09), RFC 9110 (HTTP Semantics, S12), OASIS MQTT v5.0 (S19) and RFC 9293 (TCP, S24). Coordinates represent relative design placement (0 to 100); exact wire specifications and GFT outbox recommendations are tabulated in the text.
Unit: relative design score (0 to 100). Status: sourced. Sources: S09, S12, S19, S24.
5.7 · the bodyExhibit 19 above; its figures are illustrative where marked.
No single transport protocol is universally superior across both the shop floor and the wide-area backhaul [S09][S12][S19]. Each protocol embodies specific assumptions about transport reliability, framing overhead, state retention, message ordering and congestion control [S09][S12][S19][S24]. A protocol suited to 32-byte sensor readings on a local mesh can perform poorly when draining 50,000 queued production records over a flapping cellular link (illustrative workload contrast) [S09][S18][S19]. As mapped in Exhibit 19, selection depends on the constraint and loss profile of the network path and the delivery contract required between endpoints [S09][S12][S19][S24].
A protocol suited to 32-byte sensor readings on a local mesh can perform poorly…
S09, S18, S19 · illustrative
CON), Non-confirmable (NON), Acknowledgement (ACK) and Reset (RST) messages matched by a 16-bit Message ID [S09]. For CON messages, RFC 7252 specifies stop-and-wait retransmission with exponential backoff under default parameters (ACK_TIMEOUT = 2 s, ACK_RANDOM_FACTOR = 1.5, MAX_RETRANSMIT = 4, NSTART = 1, DEFAULT_LEISURE = 5 s, PROBING_RATE = 1 byte/s, MAX_TRANSMIT_SPAN = 45 s and MAX_TRANSMIT_WAIT = 93 s) and recommends fitting messages inside a single IP packet (1,280-byte IP MTU, 1,152-byte message bound and 1,024-byte payload upper bound, or 127-byte IEEE 802.15.4 frames) [S09]. CoAP fits constrained local radio links, but NSTART = 1 and the 1,024-byte payload bound limit bulk WAN replay without block-wise tuning [S09].PUBLISH and PUBACK where duplicates can occur) and QoS 2 ("Exactly once", via PUBLISH, PUBREC, PUBREL, PUBCOMP) [S19]. It also defines Clean Start and Session Expiry Interval for session state, Receive Maximum to cap concurrent unacknowledged QoS 1/2 packets, and Topic Alias to compress repeated topic strings into a 2-byte integer [S19].GET, HEAD, OPTIONS and TRACE are safe, while PUT, DELETE and all safe methods are idempotent: a client can safely repeat an unacknowledged PUT batch after a connection reset [S12]. POST is not idempotent unless keyed by an application UUID [S12][S31]. HTTP also supports compression (Content-Encoding) and byte-range resumption (Range) [S12].| Protocol | Framing | Ordering and delivery | Flow control | Weak-grid strengths | Misapplication traps |
|---|---|---|---|---|---|
| CoAP [S09] | UDP; 4-byte header, 0 to 8 byte Token, 1,024-byte payload bound [S09] | CON/ACK stop-and-wait; no cross-datagram ordering [S09] | ACK_TIMEOUT = 2 s, MAX_RETRANSMIT = 4, NSTART = 1 [S09] | No TCP head-of-line blocking on lossy radio links [S09][S18] | NSTART = 1 and 1,024-byte bound stall bulk replay [S09] |
| MQTT v5.0 [S19] | TCP (RFC 9293); 2-byte min header plus 1 to 4 byte length [S19][S24] | Ordered per TCP stream; QoS 0, QoS 1 (PUBACK) or QoS 2 [S19][S24] | Receive Maximum, Session Expiry Interval, Topic Alias [S19] | Persistent pub/sub session; low overhead; local queuing [S19][S20] | PUBACK confirms broker receipt, not database commit [S13][S19] |
| HTTP [S12] | TCP (RFC 9293) and TLS 1.3 (RFC 9846); headers and body [S12][S23][S24] | Ordered per stream; explicit status codes (2xx, 4xx, 5xx) [S12][S24] | Idempotent PUT/DELETE/GET; Range resumption [S12] | End-to-end confirmation from target API; range tooling [S12] | Verbose per-record headers; POST duplicates without UUID [S12][S31] |
Assuming that MQTT QoS 1/2 or CoAP CON guarantees end-to-end database durability is an architectural error [S09][S13][S19]. Both protocols define delivery across a single hop [S09][S19]. In MQTT, the broker returns PUBACK as soon as it accepts the packet under its local configuration [S19]. If Eclipse Mosquitto runs with persistence false in mosquitto.conf, or flushes state to mosquitto.db only on periodic autosave_interval cycles, a power cut on the broker host immediately after PUBACK loses the message after the publisher has discarded its copy [S19][S20]. Even when mosquitto.db is persisted, a bridge worker that crashes after acknowledging the broker packet but before committing to its SQLite store drops the record [S13][S19][S20].
GFT's reference architecture separates local collection from wide-area synchronisation (GFT architectural recommendation) [S08][S13]. Inside the plant LAN, use MQTT v5.0 QoS 1 over protected Ethernet/Wi-Fi (with Mosquitto persistence true and an explicit persistence_location) or CoAP CON for constrained sensor sub-networks [S09][S19][S20]. Across the intermittent WAN, commit records atomically to a local SQLite outbox (Chapter 6) and drain that outbox using batched, compressed, idempotent HTTP PUT requests (RFC 9110) or MQTT v5.0 QoS 1 batches paired with an explicit application-level commit receipt naming the committed event UUIDs [S12][S13][S19][S31].
Interlude · the cloth half-woven
Woven: sections 5.0 to 5.7Still to weave: 5.10 to 5.18
5.10
When a single wide-area connection proves unreliable, the standard response is to buy a second subscription from another operator or insert a second cellular SIM into a dual-WAN router [S05]. Decision-makers are often shown a naive calculation: if Carrier A and Carrier B each offer 95 percent standalone availability, combining them in active-passive failover supposedly yields $1 - (0.05 \times 0.05) = 99.75\%$ availability, cutting expected downtime from 36 hours per month to 1.8 hours per month (illustrative naive calculation) [S05].
if Carrier A and Carrier B each offer 95 percent standalone availability
S05 · illustrative
On a weak grid, that multiplication is invalid because the two carriers are not statistically independent [S05][S18]. Reliability engineering separates independent random faults from common-cause failures where a single physical or electrical event disables both paths simultaneously [S05]. NIST SP 800-34 Rev. 1 emphasises that telecommunications contingency planning must evaluate physical routing diversity, shared central offices, local loop dependencies and backup power at intermediate facilities [S05]. Two fibres in the same street trench fail under the same excavator bucket; two mobile operators on the same roadside mast fail together once a prolonged feeder outage exhausts the mast's shared rectifier batteries [S01][S05][S18].
PCI) or tower coordinates to verify whether operators co-locate on the same mast and how long tower batteries last during blackouts [S01][S05][S18].As shown in Exhibit 20, common-cause downtime dominates combined wide-area unavailability whenever physical or power paths overlap.
Read-out
| 1. Dual SIMs, same mast and grid feeder | 36.0 (5.0%) | 36.0 (5.0%) | 24.0 (3.33%) | 1.8 (0.25%) | 24.2 (3.36%) |
|---|---|---|---|---|---|
| 2. Two retail ISPs in shared street trench | 21.6 (3.0%) | 28.8 (4.0%) | 14.4 (2.00%) | 0.9 (0.12%) | 14.6 (2.02%) |
| 3. Fibre + cellular on shared metro backbone | 21.6 (3.0%) | 36.0 (5.0%) | 7.2 (1.00%) | 1.1 (0.15%) | 7.9 (1.09%) |
| 4. Terrestrial fibre + UPS-backed satellite | 21.6 (3.0%) | 14.4 (2.0%) | 0.7 (0.10%) | 0.4 (0.06%) | 1.1 (0.15%) |
Illustrative reliability derivation applying NIST SP 800-34 Rev. 1 telecommunications diversity principles (S05) and RFC 7228 channel constraints (S18). Actual combined downtime equals shared downtime plus independent simultaneous downtime. All values are illustrative scenarios.
Unit: hours per 720-hour month (illustrative). Status: derived. Sources: S05, S18.
5.12
Bearer and IP route restored
0: Bearer and IP route restored. WAN modem re-establishes bearer; router verifies gateway without disturbing LAN. · illustrative
The most fragile moment for a weak-grid network is not the middle of a disconnection, when local services run inside the LAN, but the first ten minutes after a degraded wide-area link returns .
Control-plane check (DNS and NTS)
1: Control-plane check (DNS and NTS). Gateway validates upstream DNS and checks NTS/NTP offset without stepping clocks. · illustrative
Jittered TLS 1.3 session setup
2: Jittered TLS 1.3 session setup. Coordinator applies random jitter and completes TCP and TLS 1.3 negotiation. · illustrative
Lane P0 live alarms admitted
3: Lane P0 live alarms admitted. Current plant state, active safety alarms and queue depth metrics transmit first. · illustrative
Link stability soak probe
4: Link stability soak probe. Coordinator observes packet loss and RTT over a 30 to 120 s soak window. · illustrative
Lane P1 throttled outbox drain
5: Lane P1 throttled outbox drain. Committed SQLite outbox batches drain using bounded in-flight windows (1 to 5). · illustrative
Lanes P2 and P3 background sync
6: Lanes P2 and P3 background sync. Historical sensor series and resumable HTTP byte-range blobs transfer last. · illustrative
Illustrative recovery choreography synthesised from NIST SP 800-184 recovery prioritisation (S06), RFC 9293 TCP connection semantics (S24) and RFC 9846 TLS 1.3 handshake requirements (S23). Numeric positions represent dependency order (0 to 6) rather than fixed wall-clock minutes.
Unit: relative recovery step index (0 to 6). Status: illustrative. Sources: S06, S23, S24. Illustrative figures are teaching examples, not measured factory results.
5.12 · the bodyExhibit 21 above; its figures are illustrative where marked.
The most fragile moment for a weak-grid network is not the middle of a disconnection, when local services run inside the LAN, but the first ten minutes after a degraded wide-area link returns [S06][S18]. During a four-hour outage, edge gateways, floor terminals and diagnostic agents accumulate thousands of queued production events, telemetry points, journal entries and images (illustrative backlog) [S08][S22]. If every process detects link restoration simultaneously and flushes its backlog at maximum concurrency, the resulting reconnection and replay storm saturates uplink buffers, inflates round-trip latency into multiple seconds, triggers TCP retransmissions and TLS timeouts, and starves live high-priority alarms [S06][S19][S24]. NIST SP 800-184 emphasises that recovery planning must establish prioritised restoration sequences so critical operational functions recover before secondary workloads [S06]. On a factory network, that requires traffic prioritisation, bounded in-flight concurrency and jittered exponential backoff [S09][S19][S20].
Range requests (RFC 9110) so link flaps do not waste transferred bytes [S12][S22].Pipelining hundreds of unacknowledged requests across a thin wide-area link merely moves the queue from the local edge disk (where it can be inspected and reprioritised) into carrier router buffers (where it causes head-of-line blocking) [S18][S24]. Edge configurations must enforce explicit concurrency bounds [S09][S19][S20]:
Receive Maximum property to cap concurrent unacknowledged QoS 1/2 PUBLISH packets [S19]. In Eclipse Mosquitto (mosquitto.conf), max_inflight_messages defaults to 20 (max_inflight_bytes defaults to 0, and max_queued_messages defaults to 1000) [S20]. On a lossy WAN bridge, tightening max_inflight_messages to 1 to 5 with an explicit byte cap (illustrative tuning) prevents a stalled batch from filling kernel TCP buffers [S19][S20][S24].NSTART = 1 by default and chooses initial Confirmable (CON) retransmission timeouts randomly between ACK_TIMEOUT (2 seconds) and ACK_TIMEOUT * ACK_RANDOM_FACTOR (3 seconds), doubling up to MAX_RETRANSMIT (4 retries) [S09]. Custom HTTP or TCP reconnect loops must apply equivalent jittered backoff so rebooting devices do not hammer gateways in lockstep [S09][S12].5.15
When a factory is cut off from corporate headquarters and cloud portals for thirty-six hours, local technicians still need to inspect queue depths, replace a failed scanner, rotate logs or restart a wedged PLC connector [S03][S06]. If the security architecture requires real-time authorisation from a cloud identity provider or remote bastion host, the site team faces an unacceptable choice during an outage: let production stall, or bypass security controls by enabling shared root passwords and opening unauthenticated management ports [S03]. NIST SP 800-82 Rev. 3 requires that operational technology maintenance and access controls account for isolated or degraded network modes without sacrificing least privilege, authentication or auditability [S03]. Offline administration must therefore be engineered as a permanent, auditable operating mode [S03][S06].
NIST SP 800-82 Rev. 3 requires that operational technology maintenance and access controls account…
S03
systemd-journald, journald.conf must set Storage=persistent (writing to /var/log/journal rather than volatile /run/log/journal), enforce SystemMaxUse= and SystemKeepFree= (defaulting to 10 percent and 15 percent of the file system, capped at 4 gigabytes) so logs cannot exhaust disk space, and enable Seal=yes for tamper-evident Forward Secure Sealing [S22]. Because journald flushes CRIT, ALERT and EMERG messages immediately while syncing lower priorities over SyncIntervalSec= (default 5 minutes), avoid ForwardToConsole=yes on slow serial consoles where a hung console can block journald [S22].SSH, HTTPS, database or broker admin ports) to untrusted Wi-Fi or cellular interfaces when cloud tunnels fail; restrict maintenance to designated local management ports [S03].Under TLS 1.3 (RFC 9846), certificate validation checks that wall-clock time falls between notBefore and notAfter [S23]. Similarly, Network Time Security (NTS, RFC 8915) uses TLS-based NTS Key Establishment (NTS-KE) to verify certificates and issue AEAD cookies for authenticated NTPv4 time exchange [S10][S27]. On a weak grid, two time-related failure modes must be prevented [S11][S23][S27]:
1970-01-01T00:00:00Z in RFC 3339 format), causing every valid TLS 1.3 certificate to fail as "not yet valid" (current_time < notBefore) and breaking local HTTPS consoles, MQTT-over-TLS and NTS-KE simultaneously [S23][S27][S32]. Every local time server and edge gateway must include a monitored hardware RTC (or local GNSS receiver) and persist the latest timestamp to disk as a monotonic floor across reboots [S11][S27].5.18
A factory network designed for weak-grid resilience cannot be qualified by checking that ping succeeds on a sunny afternoon when mains power and fibre backhaul are healthy [S06][S28]. Just as SQLite's testing guide notes that power-loss durability requires simulated crash testing across the exact failure boundary [S28], qualifying a plant network requires deliberate fault injection that reproduces weak-grid failure modes and records evidence in both local store logs and remote ingestion audit trails [S06][S22][S28].
UP while dropping 100 percent of packets two hops upstream [S24]. Pass criteria: The edge synchroniser detects application-layer timeout, marks the path degraded and continues local capture without hanging threads [S12][S24].DNS_FAILURE diagnostic alert [S03][S11].Pushing a mistyped firewall rule, VLAN tag or static route over a remote link can sever both the backhaul and the shop-floor LAN [S03][S06]. Every change to routing, DNS, DHCP, firewall rules or broker bridges must therefore use an automated commit-confirm rollback timer that reverts to the prior known-good configuration if local and upstream health checks fail to confirm within 5 minutes (illustrative safeguard) [S03][S06]. While full cross-system enterprise commissioning is addressed in wp18, no plant LAN should enter service until it passes the local autonomy and degraded-backhaul qualification tests above [S06].
In summary, a factory network on a weak grid survives external disconnection when every dependency required for local capture, addressing, naming, time, security and operator visibility resides inside the plant's protected power boundary, when transport protocols and retry policies match actual channel loss and preserve headroom for live alarms, and when dual-carrier paths and recovery sequences are qualified by physical fault injection rather than brochure math [S03][S05][S06][S18]. With the local network kept alive and disciplined, the next requirement is ensuring that data arriving over that network is committed to non-volatile storage before any sender is told the record is safe, which is the subject of Chapter 6 [S13].
Check the record
Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.
20 sources · 368 citation marks on this pageMost cited: S03, 45 times
Grade AGrade BGrade CKnot size: citations on this page
All 20 records shown
c05-S01 · Grade A
Enterprise Surveys: Cameroon 2024 Country Profile
All indicators are based on the responses of firms.
2025. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S03 · Grade A
SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.
2023. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S05 · Grade A
SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
This document provides guidance to help personnel evaluate information systems and operations to determine contingency planning requirements and priorities.
2010. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S06 · Grade A
SP 800-184: Guide for Cybersecurity Event Recovery
This publication provides tactical and strategic guidance regarding the planning, playbook developing, testing, and improvement of recovery planning.
2016. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S08 · Grade A
RFC 4838: Delay-Tolerant Networking Architecture
The bundle layer forms an overlay that employs persistent storage to help combat network interruption.
2007. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S09 · Grade A
RFC 7252: The Constrained Application Protocol (CoAP)
One design goal of CoAP has been to keep message overhead small, thus limiting the need for fragmentation.
2014. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S10 · Grade A
RFC 5905: Network Time Protocol Version 4: Protocol and Algorithms Specification
A client synchronizes to one or more upstream servers, but does not provide synchronization to dependent clients.
2010. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S11 · Grade A
RFC 8633: Network Time Protocol Best Current Practices
It includes recommendations for the stable, accurate, and secure operation of NTP infrastructure.
2019. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S12 · Grade A
RFC 9110: HTTP Semantics
Of the request methods defined by this specification, PUT, DELETE, and safe request methods are idempotent.
2022. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S13 · Grade C
Atomic Commit In SQLite
Atomic commit means that either all database changes within a single transaction occur or none of them occur.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S18 · Grade A
RFC 7228: Terminology for Constrained-Node Networks
Such a network may itself exhibit constraints, e.g., with unreliable or lossy channels, limited and unpredictable bandwidth, and a highly dynamic topology.
2014. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S19 · Grade A
MQTT Version 5.0
"At least once", where messages are assured to arrive but duplicates can occur.
2019-03-07. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S20 · Grade C
mosquitto.conf man page
If enabled, connection, subscription and message data will be written to disk in mosquitto.db at the location dictated by persistence_location.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S22 · Grade C
journald.conf
Controls where to store journal data.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S23 · Grade A
RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3
This document specifies version 1.3 of the Transport Layer Security (TLS) protocol.
2026. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S24 · Grade A
RFC 9293: Transmission Control Protocol (TCP)
TCP provides a reliable, in-order, byte-stream service to applications.
2022. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S27 · Grade A
RFC 8915: Network Time Security for the Network Time Protocol
This memo specifies Network Time Security (NTS), a cryptographic security mechanism for network time synchronization.
2020. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S28 · Grade C
How SQLite Is Tested
It is impractical to do crash testing using real power failures, of course, and so crash testing is done in simulation.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S31 · Grade A
RFC 9562: Universally Unique IDentifiers (UUIDs)
A UUID is 128 bits long and requires no central registration process.
2024. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c05-S32 · Grade A
RFC 3339: Date and Time on the Internet: Timestamps
All times expressed have a stated relationship (offset) to Coordinated Universal Time (UTC).
2002. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗S03 NIST. 2023.
S18 IETF / RFC Editor. 2014.
S05 NIST. 2010.
S06 NIST. 2016.
S08 IETF / RFC Editor. 2007.
S12 IETF / RFC Editor. 2022.
S24 IETF / RFC Editor. 2022.
S09 IETF / RFC Editor. 2014.
S19 OASIS. 2019-03-07.
S20 Eclipse Mosquitto. 2026-10-30.
S23 IETF / RFC Editor. 2026.
S27 IETF / RFC Editor. 2020.
S28 SQLite. 2026-10-30.
S11 IETF / RFC Editor. 2019.
S13 SQLite. 2026-10-30.
S01 World Bank. 2025.
S32 IETF / RFC Editor. 2002.
S31 IETF / RFC Editor. 2024.
S22 systemd project. 2026-10-30.
S10 IETF / RFC Editor. 2010.
Keep the thread · chapter 05 of 14
Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.
The paper's rack · 14 boltsBolt length: reading time
01Part I: Specify the interruption
GFT argues that continuity means retaining a safe operating state and an accountable record through interruption and recovery.
02Part I: Specify the interruption
A useful design envelope records the duration, coincidence and recovery of power and network failures at the intended site.
03Part I: Specify the interruption
Criticality, allowable staleness and restart dependencies should be assigned before choosing equipment or a cloud platform.
04Part II: Keep the local record alive
Protecting a selected record-keeping load can be practical even when the production machinery must stop.
05Part II: Keep the local record alive
Local name resolution, switching, identity and observability need their own continuity plan when external connectivity disappears.
06Part II: Keep the local record alive
The transaction boundary, storage path and acknowledgement semantics decide whether a production record survives abrupt loss.
07Part II: Keep the local record alive
Offline retention and recovery capacity must be designed together so a restored connection can clear its accumulated work.
08Part III: Recover a trustworthy operation
A trustworthy record separates identifiers, source sequence and clock quality so reconciliation can explain what happened during disconnection.
09Part III: Recover a trustworthy operation
An edge model supports continuity only when its inputs, licence, operator interface and fallback remain usable without the cloud.
10Part III: Recover a trustworthy operation
Local credentials, signed software, controlled access and recoverable evidence must keep working through communication loss.
11Part III: Recover a trustworthy operation
Boot order, consistent backups, authorised process release and ledger reconciliation decide whether restoration is complete.
12Part IV: Prove and govern continuity
Compare service classes using transparent operating assumptions and procurement obligations rather than promised resilience percentages.
13Part IV: Prove and govern continuity
A repeatable fault programme should verify declared losses, restart behaviour and reconciled records before a pilot is expanded.
14Part IV: Prove and govern continuity
GFT recommends a staged programme that measures site conditions, proves a local record and expands only when recovery evidence supports it.