Transaction load
Record shift demand and bursts, steps per execution, callbacks and consumers. Separate synchronous work from telemetry; robot count alone does not define service load.
TRUSTED FACTORYFLOW
Design for operations and scale.
Assess deployment, sizing, recovery, upgrades and monitoring before making a pilot a long-term operation.
Place the core according to data and operations.
Reference architectures for assessment; delivery configuration, infrastructure and commitments belong in the project design.
| Configuration | Design decisions | Verification |
|---|---|---|
| Core on factory infrastructure | Compute administration, IT/OT segmentation, time sources, backups and support access. | Service failure, data restore and source-system connectivity. |
| Central core + site Edge | Data boundaries, latency/WAN, delegated work and local outcome retention. | Policy expiry, reconnect, replay and conflicts. |
| Multiple sites | Shared/site data, access scope, releases and freshness-aware central monitoring. | Cross-site denials and target-specific acceptance. |
Sizing begins with the work profile.
Volume and retention
Separate business records, audit, files/images and telemetry. Estimate from frequency, size, retention and replicas, then measure overhead and actual growth.
Connectivity and freshness
Assess WAN, Wi-Fi/OT, timeouts and source freshness by vendor profile. Stale data must be visible before decisions use it.
HA/DR needs an end-to-end verification exercise.
Recover services and business work
Availability, RPO and RTO targets need defined incidents and data scope. Databases, messaging, identity/gateway, file storage and Edge all affect outcomes. A successful backup does not establish recovery of in-flight work.
Recovery exercises inspect open tasks/missions, posted ledgers, outbox/inbox, checkpoints and idempotency records. Reconcile source and physical state before resuming. No RPO/RTO figure is published without configuration and measurement evidence.
Upgrades affect data and active execution.
| Before change | During the window | After change |
|---|---|---|
| Compare contracts/schemas and profiles; record current/target revisions, backups and rollback triggers. | Reconcile in-flight work; deploy approved revisions to selected targets only. | Check records, health and the business journey and retain outcomes and deployed revisions. |
| Migrations may need explicit forward-fix/restore plans; reversibility is not assumed. | Missing safety or authority blocks field-impacting work. | Rollback rechecks data/checkpoint compatibility and equipment state. |
Monitoring must identify the failing boundary and resolver.
Track latency/errors, queues/consumer lag, freshness, Edge revisions and conflicts. Bind alerts to sites, source IDs and runbooks; remote support has purpose, expiry and revocation. Support scope and SLAs are contractual.