Plant and shop-floor systems, where the OT/IT boundary is a hard constraint and a bad deploy can stop a production line.
21 published across 7 topics.
PLCs, SCADA, historians and the MES, and how they relate to ERP.
The two systems are not counting the same thing: one counts units completing an operation, the other counts stock received into a location in a posting period, and scrap, packing units, partial confirmations and backflush assumptions each open a gap. Reconcile at the boundary daily, with a named owner.
The line survives on cached work orders and locally queued events, so the difficulty is the merge, not the outage. Reconciliation has to be idempotent, ordered by source timestamp rather than arrival, and honest about units that passed a gate nobody could evaluate. It also connects degraded mode to the point an interviewer is testing.
A PLC runs the machine on a deterministic scan cycle and holds the truth about plant state; SCADA gives operators a view and supervisory control; a historian archives the resulting time series; an MES turns a production plan into work orders and a batch record; ERP sits above with the commercial view.
Network segmentation, the unidirectional-flow instinct, and safe data extraction.
Establish reachability before severity, then remove or narrow the paths that lead to the affected asset rather than trying to fix the asset. Patch the systems around it that can be patched, and record a risk acceptance with an owner and an expiry date instead of a permanent silence.
Segment the network into zones, put a broker or historian replica in a DMZ between plant and enterprise, and have the plant side initiate every connection outbound so no firewall rule ever permits traffic into the control zone. Nothing in the cloud reaches a controller.
Plants accumulate business-system dependencies nobody deliberately chose: a label printed from ERP, a recipe fetched over a link, an authentication call, a licence check. You find them by asking of each system what stops if it disappears, then give every answer a written degraded mode and rehearse it.
OPC UA, Modbus and MQTT at the level of what each is for and how each fails.
Answering a poll is work the controller does with the processor that runs its logic, so a second master competes with the control function rather than sitting beside it. Take the feed from the existing aggregation point, and treat the tag map as somebody else's change-controlled artefact.
On any protocol that reports by exception, no new value and an unchanged value look identical, so liveness has to be carried deliberately. Status codes, source timestamps, birth and death messages and a source-side counter each establish it at a different layer of the path.
Modbus is a register read/write protocol with no types and no security; OPC UA is an information model with certificate-based security and subscriptions; MQTT is a broker-based transport that says nothing about payload meaning. They sit at different layers rather than competing.
High-cardinality sensor data, downsampling, retention and edge buffering.
Size the stream from stated assumptions, keep series identity narrow so cardinality stays bounded, choose sampling deliberately and downsample keeping min, max and count rather than means alone, tier retention, and buffer at the edge with a bounded queue and a rate-limited drain. Use this time series answer to show the decision, trade-off, and evidence rather than a memorised definition.
Retention is a bet about which questions get asked later, and averaging is the bet that loses, because the transient that explains a failure disappears into a mean. Keep min, max and count per bucket rather than an average, and let events freeze a window of full-rate data at the edge.
Every derived figure that joins on time is affected, and none of them error. Duration and attribution metrics take the skew directly, so a shift with twelve stops mis-measures availability by nearly four points, and only storing both event time and ingestion time makes the offset visible.
Failure labelling, feature windows, and why most projects fail on data rather than models.
Start by instrumenting outcomes, because you almost certainly cannot say what happened to any past alert. Delivered recall is model recall multiplied by the rate at which alerts are acted on, so at a fifteen per cent action rate a better model changes nothing that anyone experiences.
Eleven events will not support a supervised remaining-life model, and evaluating one row-wise will make it look excellent. Build a per-machine deviation model with physics-derived features, and score it on how many of the eleven it caught with useful warning and how many alerts that cost per machine per month.
They fail on labels rather than models: failures are recorded as repair dates in free-text work orders, the positive class is nearly empty, feature windows leak the outcome, and no baseline was established, so an encouraging first result cannot be trusted or beaten.
Genealogy, batch and serial traceability, recall, and statistical process control.
Genealogy is the recorded graph linking consumed lots, equipment and process settings to what was produced, and it makes a recall narrow instead of total. SPC monitors a process against its own variation, so it detects drift before anything breaches a specification limit. Use this traceability answer to show the decision, trade-off, and evidence rather than a memorised definition.
Intersect the lineage of the three units to find what they share, then forward-trace from every shared factor you cannot yet exclude. Containment starts as the union of those populations, because narrowing later is cheap and widening later is the thing that destroys credibility.
The record is an append-only history, so the replacement adds an install event and a removal event rather than editing the bill of material, and both test results survive. The part that comes out needs a traceable destination, because a component with no exit event is the hole a recall falls through.
Safety systems, change control on a running line, and availability expectations.
Downtime has a per-hour cost someone can quote, so changes go in during planned windows under change control, rollback must be instant, and no staging environment reproduces a physical process. Safety functions live in separate assessed systems your software must never join. It also connects availability to the point an interviewer is testing.
Your path may read from the safety layer and must never write to it, and independence means separate devices, separate logic and separate change control rather than a separate screen. You detect alteration by watching programme identity, key-switch position and proof-test records, not by assuming nobody would.
Your first deliverable is a fast, evidenced answer to whether you are in the path, measured at the station rather than on your own dashboards. Restoring production outranks diagnosis, so take a cheap evidence snapshot and then get yourself out of the path.