Research libraryFactories on a Weak Grid
Chapter 04 of 14 · Part II · Draft web edition
Protecting a selected record-keeping load can be practical even when the production machinery must stop.
The cloth is woven from this chapter's 4 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.
Read-out
Illustrative GFT load boundary. Assumed values: edge computer 60 W, broker 25 W, switch 20 W, router 15 W, time source 5 W and local console 25 W. Total = 60+25+20+15+5+25 = 150 W. Cameras, illumination, machinery and production control are excluded. This protects proposed record capture and local reporting only; it is not an equipment selection or an operating result.
Unit: watts, illustrative steady operating scenario. Status: illustrative. Sources: S03, S05. Illustrative figures are teaching examples, not measured factory results.
Overture · 1 min
A factory on an unreliable grid should protect a declared digital duty, not an indiscriminate collection of electronic equipment. The useful boundary is the smallest complete chain that can capture, retain and display the records the operator has chosen to preserve during a power interruption. That chain may remain useful after production machinery stops, provided its sensors, network, compute, storage and operator interface share a suitable protected supply. GFT recommends measuring that chain in its actual operating modes, sizing energy from an agreed interruption duty and qualifying both transfer and exhaustion. The result is a testable continuity specification, not a claim that a UPS keeps the factory producing.
This distinction prevents two common design errors. A circuit sized only for an edge computer may lose the record because a switch, time source or local console has stopped. A circuit expanded to include every digital device may consume its reserve on work that could safely wait. Contingency planning begins with operational priorities, while OT design must retain performance, reliability and safety requirements. The protected-load decision therefore belongs to the production owner, electrical engineer and digital system owner together.[S03][S05]
4.1
Related · chapter 098 paragraphs step it
Read-out
Illustrative six-layer physical, runtime, and transactional stack required to sustain local optical inspection during a WAN or mains interruption. Design synthesis based on NIST SP 800-82r3, SP 800-193, SQLite atomic commit, and RFC 7228.
Unit: qualitative architecture. Status: illustrative. Sources: S03, S04, S13, S18. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗Start with the work that must remain possible. Record capture can sometimes continue when machines are stationary because operators still need to identify completed bundles, record their state and preserve evidence of the interruption. Inspection is different. An automated inspection duty needs its required camera, illumination, trigger, compute and disposition interface. If any required input is unpowered, a live model server cannot produce a valid inspection result. Machinery control is different again and remains under the responsible process and electrical engineering authorities. This chapter does not place production drives or protective functions on the digital continuity circuit.[S03]
GFT proposes a load inventory that follows the selected duty from observation to acknowledgement. For manual or supervisor-assisted capture, inspect the edge computer, local broker, access switch, router where local routing requires it, operator display, time source and any barcode or identification device. For automated inspection, add the complete sensing and illumination chain. For local reporting, include every display and network component needed to make the record understandable at the workplace. An item belongs in the inventory because the duty fails without it, not because it happens to use electricity.
The survey should also expose hidden auxiliaries. Check power injectors, media converters, small floor switches, external storage, licence or security appliances, and the supply used by the monitoring function itself. Record the physical socket, protective device, upstream board and normal supply mode for each item. Identify which UPS outlets are actually backed, since a device plugged into an unprotected outlet on a protected cabinet does not inherit continuity. Treat these as site verification tasks rather than assumptions about a particular product.
For every load, record whether it is required continuously, only during capture, during recovery or not at all during the declared outage. A remote-upload radio may be unnecessary while the wide-area path is known to be unavailable, but the local switch that carries events to the store remains essential. Non-urgent displays and diagnostic equipment can be candidates for an approved load-shedding state. The operating instruction must say who authorises that state and how its reduced coverage is displayed.
The illustrative stack in Exhibit 14 defines a record-only duty. It includes a local console and time source, but excludes inspection cameras and lighting. Its component values are assumptions chosen to demonstrate load accounting. They are neither measurements from a factory nor recommended equipment ratings.
The stack makes the service boundary inspectable. Adding an inspection duty would change both the component list and the operating modes to measure. Removing the console might be acceptable only if another powered and authorised means of supervising capture remains. The exhibit cannot establish that the listed devices are compatible, that their combined peak demand is acceptable or that the proposed duty is safe for a particular process.
A useful boundary also names what happens beyond the protected circuit. If production stops, identify the approved method for recording material already in progress and the point at which manual capture replaces automated input. If the record depends on an unprotected sensor, mark the resulting interval as unknown rather than filling it with inferred production. Protected storage can preserve events it receives; it cannot reconstruct observations that were never made.
4.2
A nameplate is a procurement clue, not an autonomy measurement. It may describe a maximum input, a typical output or a supply rating rather than the power drawn by the configured device in the promised duty. GFT recommends measuring at the boundary that the continuity system will actually feed, with the intended software, peripherals and network state. Record the instrument, its operating range, the sampling method and the measurement uncertainty alongside the trace. The responsible electrical engineer should confirm that the method is suitable for the load and supply waveform.
Measure a set of modes that follows the production record. Idle capture establishes the standing duty. Active ingestion adds storage and communication work. Inference, if included, may create a different compute profile. Boot and service restart can produce a temporary peak while several components initialise together. Backup, database checkpointing and log rotation can change storage demand. Communication bursts can add radio or network load. These modes should be observed with their simultaneous auxiliaries rather than reconstructed from unrelated device readings.
The measurement plan should retain mode identity as carefully as watts. Each interval needs the software state, active peripherals, capture rate, network condition and any operator action that explains a change. A high reading during boot must not disappear into an average, and a quiet period with inspection disabled must not represent full inspection duty. Where the recorder itself loses power, mark the interval missing. Do not turn a gap in the baseline into an assumed low-load period.
Energy and power answer different questions. Power, expressed in watts, is the instantaneous rate of use. Energy, expressed in watt-hours, accumulates power over time. A suitable energy estimate integrates the measured load profile across the declared duty, while a transfer and supply-capacity assessment must consider the relevant peaks and equipment limits. Multiplying one convenient watt reading by the outage duration is defensible only when that reading represents the whole duty or is explicitly adopted as a conservative scenario.
Use a mode-weighted calculation when operation is repetitive and the mode durations are evidenced. For each mode, multiply measured power by its duration, sum the resulting energy and divide by the total interval to obtain average power. Retain the maximum observed simultaneous demand separately. If the factory has no representative trace, present a bounded illustrative scenario and commission measurement before procurement. A larger arbitrary margin can hide ignorance without proving that the power path will start or carry the load.
The electrical boundary also determines which losses belong in the arithmetic. Measure or document whether the load figure describes device input, UPS output or UPS input. Conversion losses between those points cannot be counted twice, and a device-level total cannot be applied directly to a battery without an identified conversion path. Supplier efficiency and surge information should apply to the intended model, configuration and operating condition. Where no suitable documentation exists, retain an explicit assumption and make its verification an acceptance action.
Finally, preserve the raw trace and its context as design evidence. A summary table should show the mode, observation window, mean demand, relevant peak, missing intervals and measurement qualification. It should distinguish observations from values assumed for sizing. This record lets the electrical engineer assess supply behaviour while the digital owner checks that the measured mode really performed the promised capture duty. A watt number without that context is not yet a protected-load specification.
4.3
Load: 120 to 180 W
Load: 120 to 180 W: low 417, central 521, high 625 (nominal watt-hours, illustrative one-factor scenarios) · illustrative
The energy calculation should begin only after the load and duty are explicit.
Duty: 1.5 to 2.5 h
Duty: 1.5 to 2.5 h: low 391, central 521, high 651 (nominal watt-hours, illustrative one-factor scenarios) · illustrative
Efficiency: 0.85 to 0.95
Efficiency: 0.85 to 0.95: low 493, central 521, high 552 (nominal watt-hours, illustrative one-factor scenarios) · illustrative
Usable: 0.70 to 0.90
Usable: 0.70 to 0.90: low 463, central 521, high 595 (nominal watt-hours, illustrative one-factor scenarios) · illustrative
Capacity: 0.70 to 0.90
Capacity: 0.70 to 0.90: low 463, central 521, high 595 (nominal watt-hours, illustrative one-factor scenarios) · illustrative
The method behind it: Worked example: nominal energy is a calculated scenario, not an equipment choice.
Illustrative sensitivity around E = 150*2/(0.90*0.80*0.80) = 520.833 Wh. Each row varies only the named input, with all other worked-case inputs fixed. Load range 120 to 180 W; duty 1.5 to 2.5 h; efficiency 0.85 to 0.95; usable fraction 0.70 to 0.90; remaining capacity 0.70 to 0.90. Low is the lowest resulting energy requirement and high the greatest, not an uncertainty interval. Values rounded to 0.1 Wh. S05 does not supply these inputs.
Unit: nominal watt-hours, illustrative one-factor scenarios. Status: illustrative. Sources: S05. Illustrative figures are teaching examples, not measured factory results.
4.3 · the bodyExhibit 16 above; its figures are illustrative where marked.
The energy calculation should begin only after the load and duty are explicit. For a simplified constant-load case, let P be the protected load in watts and t the required autonomy in hours. Their product is the energy required at the protected output boundary. Divide by the applicable conversion efficiency η, the permitted usable fraction u and the remaining capacity fraction c at the declared end-of-life condition. The illustrative relationship is E = P × t / (η × u × c), where E is nominal battery energy in watt-hours.
Each denominator term answers a different question. Conversion efficiency represents losses across the modelled path. Usable fraction represents the portion of nominal capacity the design permits itself to use under its operating policy. Remaining capacity represents the condition at which the owner still expects the system to perform. These are not universal battery constants. They must come from measured evidence, applicable supplier documentation or a declared scenario, and their boundaries must not overlap. A supplier figure that already incorporates one allowance should not receive the same allowance again.
Autonomy itself is an operational requirement, not a national outage average. Choose it from the site outage envelope, the approved manual fallback and the time needed for an orderly stop. State whether the duty includes continued capture, local display, controlled shutdown or all three. A longer requirement can be evaluated transparently, but it cannot be justified by an invented duration distribution. Contingency priorities supply the reason for the requirement; they do not supply its numerical value.[S05]
The calculation record in Exhibit 15 preserves the inputs and their status. It deliberately places the assumed basis beside every value so a later reviewer cannot mistake the result for a supplier specification.
Sensitivity analysis is more useful than an unexplained design margin. Change one declared input at a time and retain the others from the worked case. This shows which measurement or procurement uncertainty has the greatest effect on nominal energy. It also exposes asymmetric reasoning: a higher assumed efficiency reduces the calculated requirement, while a lower remaining capacity increases it. The direction must be checked before the scenario is used to justify a smaller device.
Exhibit 16 applies that one-factor method to the load, duty and three denominator terms. The low and high ends are scenario outputs, not statistical confidence limits. They do not describe the probability of any condition, and they should not be combined into a new apparently precise rating.
The exhibit identifies where better evidence would change the decision. If the duty is uncertain, resolve the operating requirement rather than hiding the choice in battery capacity. If conversion performance is uncertain, obtain applicable documentation or measure the path. If remaining capacity is uncertain, define the maintenance condition at which replacement is required. Sensitivity does not remove the need for a decision; it makes the consequence of that decision visible.
A fixed nominal battery can be examined with the inverse relationship, t = E × η × u × c / P, under the same simplified assumptions. That calculation estimates the autonomy associated with a scenario, not the time until every connected function stops gracefully. The operator still needs a reserve for the shutdown sequence and a rule for loads whose demand changes as services are shed. Capacity arithmetic is one gate in a wider qualification.
Interlude · the cloth half-woven
Woven: sections 4.0 to 4.3Still to weave: 4.4 to 4.7
4.4
A battery-energy balance says nothing about the interruption experienced while supply changes source. The connected computer, network devices and storage must tolerate the actual transfer behaviour of the selected power path. GFT therefore recommends a controlled qualification that observes the complete protected duty through loss of normal supply, operation on reserve, restoration and exhaustion. Electrical tests belong under the site electrical engineer, within equipment limits and an approved isolation and restoration procedure. This chapter specifies evidence, not switching instructions or protective settings.[S03]
Begin with a known operating state. Generate an identified sequence of synthetic production events, open the local console and record the software and firmware versions, active peripherals, database settings and starting ledger. Note which devices are expected to remain live and which are expected to restart. A pass criterion should describe the promised function, such as continued durable capture or an authorised manual fallback, rather than the vague survival of a glowing status lamp.
During each test, retain three aligned records. The electrical record should capture the supply event and relevant transfer observation using a method approved by the electrical engineer. The device record should show restarts, interface state, alarms and service readiness. The application record should show accepted event identities, local commits, rejected intake and any interval in which capture was unavailable. Aligning these records reveals whether an apparently successful power transfer still caused a network reset, a missed sensor observation or an uncertain application acknowledgement.
Test restoration as a separate event. Returning supply can restart devices, recharge batteries and initiate deferred work at the same time. The acceptance record should show whether the power path remains stable, whether services start in their required order and whether remote replay is prevented from displacing local capture. Cold-start behaviour also needs its own test because a system that remained live through a short transfer has not demonstrated that it can boot from an exhausted or disconnected state without external services.
Battery exhaustion is part of the same envelope. Establish what warning the system emits, which component receives it and what happens if the warning is late or absent. Observe whether the controlled stop completes within the available reserve and whether the last acknowledged event remains recoverable. Do not infer a shutdown window solely from nominal autonomy. The actual reserve depends on the measured duty and the state of the protected system at the time of the event.
SQLite's crash-testing documentation explains why software projects simulate power failures, but a supplier's simulation does not qualify the factory's physical power path. Conversely, a successful hardware transfer does not qualify the application's storage settings. The project needs both forms of evidence on the selected configuration.[S28] In particular, SQLite documents that a transaction committed in WAL mode with synchronous=NORMAL might roll back following power loss or a system crash. A continuous screen and a durable database are therefore separate acceptance results.[S16]
NIST recovery guidance links recovery planning with playbooks, testing and improvement.[S06] Record every unexpected restart and every unexplained ledger discrepancy as a defect to investigate, not as an acceptable cost of testing. Preserve failed trials alongside successful repeats and identify the configuration change between them. The resulting evidence should state the tested boundary precisely: which load, which transfer events, which software versions and which record-loss criterion. No test conducted for this chapter is claimed here; these are proposed commissioning obligations.
4.5
Battery alarm
Battery alarm. Starting point. Leads to Quiesce capture (Signal valid), Abrupt power loss (Late or absent signal). · illustrative
An orderly shutdown is a second continuity path, not a substitute for ride-through or crash recovery.
Quiesce capture
Quiesce capture. From Battery alarm (Signal valid). Leads to Commit pending events. · illustrative
Commit pending events
Commit pending events. From Quiesce capture. Leads to Stop services, Abrupt power loss (Reserve exhausted). · illustrative
Abrupt power loss
Abrupt power loss. From Battery alarm (Late or absent signal), Commit pending events (Reserve exhausted). Leads to Verify storage and ledger. · illustrative
Verify storage and ledger
Verify storage and ledger. From Stop services (Power returns), Abrupt power loss, Hold or manual capture (Evidence restored). Leads to Authorise restart (Checks pass), Hold or manual capture (Checks fail). · illustrative
Hold or manual capture
Hold or manual capture. From Verify storage and ledger (Checks fail). Leads to Verify storage and ledger (Evidence restored). · illustrative
Authorise restart
Authorise restart. From Verify storage and ledger (Checks pass). End point. · illustrative
Illustrative GFT shutdown and recovery contract. The battery signal, capture quiesce, durable commit, service stop and retained shutdown state all require configuration evidence. The abrupt branch covers late or absent warning and reserve exhaustion. Neither route permits production release until storage and ledger checks pass. This is not a completed test or executable safety logic.
Unit: illustrative operating sequence. Status: illustrative. Sources: S0401, S13, S15, S21, S22. Illustrative figures are teaching examples, not measured factory results.
4.5 · the bodyExhibit 17 above; its figures are illustrative where marked.
An orderly shutdown is a second continuity path, not a substitute for ride-through or crash recovery. It begins when a trustworthy signal indicates that the approved operating reserve is being consumed and ends only after the required record and shutdown state are recoverable. Network UPS Tools describes upsmon as a UPS monitoring and shutdown controller, which illustrates the role of software between the power device and the operating system. The presence of such a component does not prove that its signals, permissions, timing or application actions are correct on the selected installation.[S0401]
GFT proposes an explicit sequence. Validate the battery or shutdown signal and record its source. Stop admitting work that cannot be completed within the remaining reserve. Quiesce capture while preserving the identity of events already accepted. Commit the event and its pending-delivery record at the promised transaction boundary, then close dependent services in an order that prevents new writes from arriving after their destination has stopped. Record the reason, outcome and unresolved work before powering down the remaining compute duty.
The sequence needs deadlines and an owner. A service supervisor can provide configured stop commands and stop timeouts, but those settings must be read back and exercised rather than inferred from a default.[S21] Diagnostic evidence also needs an appropriate storage policy. systemd-journald distinguishes volatile and persistent journal storage, so a reboot may remove evidence that the team expected to inspect.[S22] Confirm the effective settings on the actual image and retain enough local evidence to explain why shutdown succeeded, timed out or never began.
Exhibit 17 shows the controlled route and its abrupt-loss alternative. Both routes converge on storage and ledger verification before an authorised restart. The diagram is a proposed operating contract. It does not imply that a database transaction guarantees the behaviour of every storage device or that an operator may release production solely because services have started.
The abrupt branch must receive the same design attention as the graceful route. The warning cable can be disconnected, the monitoring process can fail, a service can exceed its stop deadline or the remaining reserve can be smaller than expected. SQLite states that atomic commit makes all changes within a transaction occur or none occur, but it also warns that the database is not immune to corruption.[S13][S15] The recovery procedure must therefore inspect the complete storage path and reconcile identified events rather than assume that either a clean shutdown flag or a database opening successfully proves record survival.
Filesystem and device behaviour sit beneath that check. The ext4 documentation describes write barriers as enforcing on-disk ordering of journal commits when volatile disk write caches are used.[S29] A UPS can keep voltage present while an application completes a write, but it cannot by itself establish that the storage device honoured the required flush. Qualification should combine the actual power path, filesystem, storage hardware and database configuration, with unresolved assumptions retained in the acceptance record.
The ext4 documentation describes write barriers as enforcing on-disk ordering of journal commits when…
S29
On restoration, hold new production acknowledgement until the required checks are complete. Verify storage integrity, effective durability settings, the latest committed identities and any incomplete shutdown state. If the evidence conflicts, retain the affected work in recovery hold and invoke the approved manual record. An orderly shutdown reduces the number of uncertain cases; the crash-recovery path determines whether the remaining cases are detected and explained.
4.6
The calculated energy case becomes credible only inside an observed operating envelope. Collect the supplier's permitted conditions for the selected UPS, battery, computer, network devices and enclosure. Record where each item will sit, how air moves through it, what dust or other contamination it may encounter and how a technician can inspect and replace it. These are site-design inputs, not reasons to import a generic degradation rate or battery life into the model.
Measure the conditions that can alter the promised duty. Retain enclosure temperature, protected-load power, battery or shutdown status and relevant service alarms on a common maintenance record. Where the power system reports an estimated remaining time, preserve it as a device estimate and compare it with observed discharge behaviour during approved tests. Do not present that estimate as an independently measured autonomy. Missing or implausible telemetry should create an unqualified state rather than a reassuring zero.
Maintenance access is part of the continuity design. A battery that cannot be isolated and replaced under the site's approved procedure may turn a planned replacement into a longer interruption. Check physical clearances, connector identity, replacement compatibility, safe handling instructions and the availability of the required spare through the intended support channel. Assign the inspection, test, replacement and disposal responsibilities to named organisational roles without inventing local regulations or supplier intervals.
Ageing should be handled as a changing design input. Record installation identity, manufacture or batch information where supplied, commissioning date, replacements, test evidence and observed faults. Review whether the remaining-capacity assumption still reflects the condition at which the owner requires the duty to work. Network UPS Tools includes a battery-replacement notification among its defined UPS events, but an alarm definition is not proof that a particular battery needs replacement or that the site received the alarm.[S0401]
Environmental review also covers the record around the power device. Dust can contaminate more than the UPS, and an enclosure that protects one component may create a different thermal condition for another. Keep these interactions visible in the survey rather than assigning an unsupported numerical penalty. Where the combined supplier envelopes are incompatible with the intended location, change the location, protection or equipment through the responsible engineering process. A larger nominal battery does not resolve an unsuitable installation condition.
The maintenance record should close with a current qualification status. Distinguish as-designed capacity, factory documentation, site acceptance, latest observed test and overdue evidence. Repeat the relevant transfer and recovery checks after a material change to the battery, power path, connected load or control software. This keeps the autonomy claim attached to the system that exists now rather than to the configuration that was originally purchased.
4.7
Related · chapter 138 paragraphs step it
Read-out
Illustrative timestamps for method demonstration, not measured equipment performance. An independent monotonic observer supplies the reference time; node timestamps retain clock-quality metadata. Acceptance limits must come from the site service classes.
Unit: illustrative seconds from fault injection. Status: illustrative. Sources: S05, S21, S32. Illustrative figures are teaching examples, not measured factory results.
Read this exhibit in its chapter ↗The purchase schedule should describe the function to be proved, not only the equipment to be delivered. Attach the protected-duty card, measured load trace, outage duty, energy assumptions and acceptance tests to the request for quotation. Require the supplier to identify the exact hardware, firmware, monitoring software, licences, protected outlets and accessories included in its response. A family-level brochure cannot establish the behaviour of a different model, firmware version or outlet configuration.
GFT proposes an acceptance schedule with seven evidence rows. First, map every required device to a protected port and record excluded outlets. Second, document the power path and the applicable operating envelope. Third, demonstrate the agreed transfer cases under the approved test method. Fourth, demonstrate low-battery notification, controlled shutdown and abrupt-loss recovery. Fifth, demonstrate cold start with the declared external services unavailable. Sixth, prove replacement-battery compatibility and the maintenance procedure. Seventh, deliver the raw test traces, effective configuration and maintenance record needed for later review.
Each row needs a requirement, supplier response, evidence reference, witnessed result, exception and responsible approver. Mark unsupported claims as unresolved rather than converting them into assumed compliance. Where the supplier offers an estimated runtime, retain its load and battery conditions and compare them with the site's measured duty. Where it offers shutdown software, require the versions and permissions used in the demonstration. Acceptance should concern the complete chain that performs the record-keeping function.
Firmware and recovery assets belong in that chain. NIST's platform-firmware guidance addresses protection, detection and recovery against potentially destructive attacks, providing a reason to request authentic recovery images and controlled update behaviour rather than treating firmware as invisible infrastructure.[S04] This does not make an ordinary power outage a cybersecurity incident. It ensures that replacement and recovery do not depend on an unverified image or an undocumented external download.
Commercial evaluation should retain the cost of the whole duty. Request itemised equipment, integration, support, replacement, testing and maintenance offers with their dates and exclusions. No prices are asserted in this chapter, and this procurement framework is not financial, legal or tax advice. A lower initial equipment price can omit the switch, monitoring interface, replacement path or acceptance work required by the protected-duty card. Compare only offers that address the same evidence schedule.
The boundary with wider energy design must remain explicit. This chapter determines the protected digital load, its interruption behaviour and its record-survival evidence. Generation sizing, solar yield, recharge strategy and resource-efficiency optimisation belong to the wider energy work. The load register and sensitivity model can supply inputs to that work without pretending that the digital UPS case is a factory energy system.
Before approval, reconcile the delivered system with the original duty. Confirm that included loads remain within the measured and qualified envelope, excluded loads cannot silently migrate onto protected outlets, and the operator can see the current operating mode. Retain the approved manual fallback and recovery hold for failures outside that envelope. Expansion to powered inspection or another digital duty should reopen the load, transfer, energy and recovery assessments rather than inherit acceptance by association.
GFT's recommendation is deliberately narrow: protect the smallest complete record-keeping chain whose continuity has operational value, measure it under the promised duty, and buy evidence of its behaviour through transfer, exhaustion and restoration. That discipline gives the edge-architecture and energy-sizing work a transparent input. More importantly, it gives the factory a power boundary it can explain, test and maintain without claiming that production itself has become uninterruptible.
Check the record
Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.
12 sources · 29 citation marks on this pageMost cited: S03, 4 times
Grade AGrade BGrade CKnot size: citations on this page
All 12 records shown
c04-S03 · Grade A
SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements.
2023. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S04 · Grade A
SP 800-193: Platform Firmware Resiliency Guidelines
This document provides technical guidelines and recommendations supporting resiliency of platform firmware and data against potentially destructive attacks.
2018. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S05 · Grade A
SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
This document provides guidance to help personnel evaluate information systems and operations to determine contingency planning requirements and priorities.
2010. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S06 · Grade A
SP 800-184: Guide for Cybersecurity Event Recovery
This publication provides tactical and strategic guidance regarding the planning, playbook developing, testing, and improvement of recovery planning.
2016. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S13 · Grade C
Atomic Commit In SQLite
Atomic commit means that either all database changes within a single transaction occur or none of them occur.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S15 · Grade C
How To Corrupt An SQLite Database File
Though SQLite is resistant to database corruption, it is not immune.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S16 · Grade C
PRAGMA Statements
A transaction committed in WAL mode with synchronous=NORMAL might roll back following a power loss or system crash.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S21 · Grade C
systemd.service
The service specific configuration options are configured in the [Service] section.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S22 · Grade C
journald.conf
Controls where to store journal data.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S28 · Grade C
How SQLite Is Tested
It is impractical to do crash testing using real power failures, of course, and so crash testing is done in simulation.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S29 · Grade C
ext4 General Information
Write barriers enforce proper on-disk ordering of journal commits, making volatile disk write caches safe to use, at some performance penalty.
2026-10-30. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗c04-S0401 · Grade A
upsmon(8): UPS monitor and shutdown controller
upsmon is the client process that is responsible for the most important part of UPS monitoring , shutting down the system when the power goes out.
2026-10-28. Register access date: 2026-10-30. Source provenance is supplied by the paper evidence register.
Open the recorded source ↗S03 NIST. 2023.
S05 NIST. 2010.
S28 SQLite. 2026-10-30.
S16 SQLite. 2026-10-30.
S06 NIST. 2016.
S0401 Network UPS Tools (NUT) Project. 2026-10-28.
S21 systemd project. 2026-10-30.
S22 systemd project. 2026-10-30.
S13 SQLite. 2026-10-30.
S15 SQLite. 2026-10-30.
S29 Linux kernel project. 2026-10-30.
S04 NIST. 2018.
Keep the thread · chapter 04 of 14
Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.
The paper's rack · 14 boltsBolt length: reading time
01Part I: Specify the interruption
GFT argues that continuity means retaining a safe operating state and an accountable record through interruption and recovery.
02Part I: Specify the interruption
A useful design envelope records the duration, coincidence and recovery of power and network failures at the intended site.
03Part I: Specify the interruption
Criticality, allowable staleness and restart dependencies should be assigned before choosing equipment or a cloud platform.
04Part II: Keep the local record alive
Protecting a selected record-keeping load can be practical even when the production machinery must stop.
05Part II: Keep the local record alive
Local name resolution, switching, identity and observability need their own continuity plan when external connectivity disappears.
06Part II: Keep the local record alive
The transaction boundary, storage path and acknowledgement semantics decide whether a production record survives abrupt loss.
07Part II: Keep the local record alive
Offline retention and recovery capacity must be designed together so a restored connection can clear its accumulated work.
08Part III: Recover a trustworthy operation
A trustworthy record separates identifiers, source sequence and clock quality so reconciliation can explain what happened during disconnection.
09Part III: Recover a trustworthy operation
An edge model supports continuity only when its inputs, licence, operator interface and fallback remain usable without the cloud.
10Part III: Recover a trustworthy operation
Local credentials, signed software, controlled access and recoverable evidence must keep working through communication loss.
11Part III: Recover a trustworthy operation
Boot order, consistent backups, authorised process release and ledger reconciliation decide whether restoration is complete.
12Part IV: Prove and govern continuity
Compare service classes using transparent operating assumptions and procurement obligations rather than promised resilience percentages.
13Part IV: Prove and govern continuity
A repeatable fault programme should verify declared losses, restart behaviour and reconciled records before a pilot is expanded.
14Part IV: Prove and govern continuity
GFT recommends a staged programme that measures site conditions, proves a local record and expands only when recovery evidence supports it.