The problem this solves
Many plants still learn about yesterday’s performance from a spreadsheet compiled this morning. Machine stoppages are logged by hand, or not at all; reasons are recorded inconsistently; and the gap between the plan on the whiteboard and the reality on the line becomes clear only at the end of a shift. Equipment from different vendors and decades speaks different protocols, and much of it was never designed to share data.
This blueprint shows how Twara Technologies would design a monitoring platform that gathers data from mixed equipment, protects the operational technology (OT) network, and gives operators, supervisors and managers a live and trustworthy picture of production. It is a reference design; a typical implementation begins with a single line and grows from there.
Architecture
The architecture keeps a clear boundary between the plant’s control systems and everything above them.
Level: control Level: plant edge Level: enterprise / cloud
[PLCs, CNCs, sensors] --OPC UA / Modbus--> [Edge gateway] --MQTT/HTTPS, outbound only--> [Ingestion]
[Legacy SCADA] --OPC UA----------> [Local buffer] |
[Local andon] [Historian / time-series DB]
|
[OEE engine] [Rules & alerts] [ML models]
|
[Dashboards] [Reports] [ERP / MES / CMMS APIs]- Control level. Devices remain on their existing network. The platform reads data and, by default, writes nothing back to control systems.
- Plant edge. Gateways sit in a separate network zone, poll or subscribe to machine data, add context (machine ID, units, timestamps) and buffer locally if the uplink fails. Shop-floor andon screens can run from the edge so they keep working without internet access.
- Enterprise or cloud. Data is stored, states and OEE are calculated, and dashboards and integrations are served. This tier can run in a public cloud or in an on-premises data centre.
Key design decisions
Protocols. OPC UA is the preferred interface where controllers support it; the OPC Foundation describes it as a platform-independent, service-oriented architecture with built-in security features such as encryption, signing and certificate-based authentication. For older equipment, the gateway uses native drivers (Modbus, vendor protocols) or retrofit sensors. Between edge and cloud, MQTT, often with a structured payload convention such as Sparkplug B, decouples producers from consumers.
Build on a platform or compose. Industrial platforms such as AWS IoT SiteWise, Azure IoT Operations or commercial historians bring ready-made connectors and asset models. A composed stack, for example Node-RED or a custom collector at the edge with TimescaleDB or InfluxDB and Grafana above it, offers more flexibility and lower licence cost but needs more engineering. The blueprint chooses based on existing plant software, the client’s cloud strategy and internal skills.
Edge or central processing. State detection and short-term buffering belong at the edge, where latency and connectivity matter. OEE calculation, cross-line comparison and analytics belong centrally. Keeping the edge simple reduces what must be maintained across many sites.
Read-only by default. Writing set-points back to machines can bring value, but it moves the platform into the safety and control domain. The blueprint keeps the first releases strictly read-only and treats any write capability as a separate, safety-reviewed project.
OEE definitions. Many disputes about the numbers are really disputes about definitions: what counts as planned downtime, which ideal cycle time to use. These are agreed with production and quality teams and configured centrally, not buried in code.
Security and compliance
Connecting OT to IT networks creates new paths for attack, and the consequences can be physical. NIST’s Guide to Operational Technology Security (SP 800-82 Rev. 3), published in September 2023, provides guidance on securing OT while respecting its performance, reliability and safety requirements. The ISA/IEC 62443 series addresses cybersecurity for industrial automation and control systems across their life cycle; as the IEC’s overview explains, part 3-2 partitions a system into zones and conduits, and part 3-3 defines four security levels.
The blueprint applies those ideas directly:
- control networks, edge gateways and enterprise systems sit in separate zones, with controlled conduits between them;
- gateways initiate outbound connections only, so no inbound path from the internet or office network reaches the plant;
- certificate-based authentication for OPC UA and MQTT connections, and hardened, centrally patched gateways;
- remote access for support goes through an audited, time-limited mechanism rather than permanent VPNs.
Where the platform processes operator identities (for example, who logged a downtime reason), the safeguards of India’s Digital Personal Data Protection Act, 2023 also apply. Final security levels and zone design are agreed with the client’s OT and safety owners.
Phased rollout
- Site survey. Inventory machines, controllers, protocols and network layout; agree KPIs and OEE definitions with production teams.
- Pilot line. Connect one line, deploy the edge gateway, historian and core dashboard, and validate signals against observed reality.
- Downtime capture. Introduce operator reason entry and shift reporting, refining reason codes with the people who use them.
- Plant rollout. Extend to remaining lines using templates for common machine types; add alerts and integrations with ERP, MES or maintenance systems.
- Advanced analytics. With sufficient history, add anomaly detection and condition-based maintenance models, and replicate to further sites.
Risks and how the design handles them
| Risk | How the design responds |
|---|---|
| New connectivity exposes control systems | Zoned networks, outbound-only gateways, read-only design and alignment with NIST SP 800-82 and ISA/IEC 62443 |
| Older machines expose no usable data | Retrofit sensors and signal-based state detection |
| Network outages create data gaps | Edge buffering with back-fill, and local andon that runs without the cloud |
| Operators distrust the numbers | Agreed OEE definitions, pilot validation against observation, and visible raw data behind every metric |
| Dashboards nobody uses | Screens designed per audience with operators and supervisors during the pilot |
| Platform sprawl across sites | Standard templates, a common data model and central configuration management |