TRUSTED FACTORYFLOW
Core–Edge. Continue within authority.
Expiring delegation, local queues and owner-led reconciliation after reconnection.
Core owns domain data. Edge holds bounded authority.
Reference deployment; delegation lifetime, local capability and safety are designed per site.
| Core | Factory Edge | Field |
|---|---|---|
| Selected WMS/ERP owns the ledger and source task. | Cache site-scoped revisions and queue delegated work. | Controllers and safety PLCs implement field control and safety. |
| Issue scoped expiring policy and record authorization. | Check expiry and gates before execution; no authority expansion. | Authorized staff confirm intervention, LOTO and recovery. |
What may continue during WAN loss?
| Situation | Reference rule |
|---|---|
| Received task with valid authority | Only delegated work with sufficient data may execute; retain results locally. |
| New demand or expired policy | Hold; do not create Core reservations or grant new authority. |
| Insufficient safety information | Apply engineered field safety; Edge cannot infer a safe state. |
| Inventory outcome | Do not create a second ledger; await WMS business confirmation after reconciliation. |
Reconnect by checkpoint, not overwrite.
-
Check policy
Fetch revisions and compare expiry and remaining authorized work.
-
Replay
Preserve IDs, sequence, trace and acknowledged checkpoint; no identity changes on retry.
-
Quarantine conflict
Changed tasks and overlapping results go to the data owner; no default last-write-wins.
-
Confirm business
WMS checks handover and ledger before confirmation and retains the decision.
Equipment done, Core unconfirmed.
TASK-080 completes at Edge during an outage. Core receives a late callback after the task changed. Retain local results, query the mission, compare revisions and obtain the WMS owner decision before stock posting.