Architecture reference

Component detail for architects and OT engineers: what runs inside the plant, what runs in the cloud, how data moves between them, and exactly what happens when part of the chain fails.

Updated July 2026 · 14 min read

Layer detail

The platform is four layers. Each can be deployed independently; acquisition always runs inside the plant network. An interactive version of this diagram is on the platform page.

Layer 01 · Acquisition

Reads from the equipment, gauges and inspection systems already installed on the line. Nothing is replaced and no control loop is taken over.

Runs on:: Edge gateway on the plant network (virtual machine, industrial PC or container host)
Latency:: 10–200 ms from tag change to buffered record
Interfaces:: OPC UA · MQTT / Sparkplug B · Modbus TCP · REST · SQL / historian · SFTP file drop
Failure behaviour:: If the uplink fails, inspection continues at the line and records sync in order once connectivity returns.

Layer 02 · Governed data model

Every reading is bound to a product, operation, characteristic, lot and asset, so a measurement can be traced in both directions later.

Runs on:: Regional cloud tenant (EU, US, APAC) or customer-managed private cloud
Latency:: < 1 s to queryable, sub-second on hot partitions
Interfaces:: Columnar time series · Immutable event log · Versioned master data
Failure behaviour:: Released quality records are append-only; corrections create a new version with the prior state intact.

Layer 03 · Intelligence

Statistical and machine-learning engines score the incoming stream continuously: capability, special-cause rules, defect classification and escape risk.

Runs on:: Cloud inference cluster with optional edge deployment for vision
Latency:: < 2 s signal to alert; vision inference at line rate
Interfaces:: SPC rule engine · Anomaly models · Vision classifiers · Gradient-boosted risk models
Failure behaviour:: Models degrade to statistical rules if a model is withdrawn; alerting never depends on a single model.

Layer 04 · Action & decision

Signals become owned work: containment, corrective action, supplier escalation and management review, each with evidence attached.

Runs on:: Cloud application with role-based access scoped by site, line and product family
Latency:: Alert routing in seconds; workflow SLAs configurable per plant
Interfaces:: Workflow engine · Webhooks · Email / Teams / Slack · REST + streaming API
Failure behaviour:: Write-back to MES or ERP is opt-in per integration and always reversible with a full audit trail.

Edge gateway

The gateway is the only component that must sit inside the plant network. It is stateless with respect to configuration (pulled from the tenant) and stateful with respect to buffered data.

Gateway sizing and behaviour
Property	Default	Note
Host requirement	4 vCPU / 8 GB RAM / 100 GB disk	Add GPU only where on-edge vision inference is required
Ingest capacity	50,000 messages/second per site	Aggregated across configured sources
Local buffer	14 days	Configurable; sized by disk allocation
Outbound	HTTPS 443 to tenant only	No inbound ports required
Update model	Signed bundles, staged rollout	Offline bundles for air-gapped sites
High availability	Active/passive pair	Recommended where inspection cannot pause

Data flow and latency budgets

Stage budgets
Stage	Where	Budget	Output
01 Capture	Machine, gauge, camera	10–50 ms	Raw reading with asset and timestamp
02 Contextualise	Edge gateway	20–80 ms	Reading bound to product, operation and characteristic
03 Evaluate	Edge and cloud	< 500 ms	Control-chart state, capability, rule violations, defect class
04 Decide	Intelligence layer	< 2 s	Ranked cause candidates, escape risk, recommended action
05 Act	Workflow engine	Seconds to minutes	Routed task, containment record, CAPA draft
06 Verify	Analytics and audit	Days to quarters	Effectiveness verdict, audit evidence, baseline comparison

Data residency and tenancy

Each tenant is bound to one primary region: EU (Frankfurt), US (Virginia) or APAC (Singapore).
Measurement data, images and audit records never leave the primary region unless you configure an export.
Model training is per tenant. Your process data is never used to train a model served to another customer.
Private cloud deployment places the entire stack in your own subscription with your key management.
Air-gapped deployment removes the egress requirement entirely; updates arrive as signed offline bundles.

Failure behaviour

The relevant question in a plant is not whether components fail but what production does while they are failing. The behaviour below is what an OT review normally probes.

Failure scenarios
Scenario	Effect on production	Recovery
Uplink to cloud lost	Inspection continues; local evaluation and alerting continue at the line	Buffered records reconcile in order when the link returns
Gateway host failure	Passive node takes over where an HA pair is deployed	Single-node sites lose collection until restart; source systems retain their own data
Source system unavailable	Characteristics fed by that source pause; others unaffected	Backfill on reconnection, with gap flagged in the record
Model service degraded	Statistical detection and alerting unaffected	Model verdicts resume; the gap is visible in the model log
Cloud region incident	Local operation continues; dashboards unavailable	RPO 15 minutes, RTO 4 hours under the enterprise SLA

Observability and change management

Gateway and connector health, ingestion rate and buffer depth are exposed per site, with alerting on staleness.
Every configuration change to a characteristic, limit or rule set is versioned with author and timestamp.
Model promotions and withdrawals are recorded as change events suitable for a validated environment.
Metrics can be scraped into your own monitoring stack in private and on-premise deployments.

Need something this page does not cover?

Solution architects answer technical questions directly — no ticket triage for pre-sales evaluation.

Ask an engineer