1.2 Interoperability and Governance

DigitalA transformationsystem frequentlyarchitecture failswithout whengovernance treatedis strictly asnot an ITarchitecture; initiative.it is a "spaghetti topology" of fragile point-to-point connections. In a high-volume manufacturing environment, interoperability is the discipline of defining boundaries and contracts. If System A digital-firstwrites strategydirectly dictates thatinto the Informationdatabase Technologyof departmentSystem providesB, you have violated the infrastructureboundary. (theIf roads),System butA Operationschanges ownsa message format and crashes System B, you have violated the vehiclecontract.

and

This determineschapter establishes the destination."Constitution" Transferringfor ownershiphow ofsystems in your landscape (ERP, MES, SCADA) coexist. These rules are non-negotiable architectural constraints.

Architectural Topology Rules

Stop building fragile bridges. Enforce Decoupling.

Rule 1: Abolish DB-to-DB Integration.

• Prohibition: Never allow an external system to execute INSERT, UPDATE, or DELETE directly on another system's SQL database.
• Why: This bypasses business logic andvalidation data(e.g., qualitychecking if a Part Number exists before creating a Work Order). It creates "Zombie Records."
• Mandate: All integration must occur via an Abstraction Layer (API, Message Broker, or Enterprise Service Bus).

Rule 2: The "Hub" vs. "Mesh" Decision.

• Constraint: Avoid direct mesh connections (System A ↔ System B, A ↔ C, B ↔ C). This scales with N(N-1)/2 complexity.
• Mandate: Use a Hub-and-Spoke or Unified Namespace (UNS) pattern. Systems publish events to thea businesscentral unitbroker ensures(MQTT/Kafka) or call a central API Gateway.
• Benefit: When you replace the toolsERP, reflectyou physicalonly realityupdate ratherone thanconnector abstractat databasethe schemas.Hub, not 50 distinct point-to-point scripts.

The SeparationInterface ofControl PowersDocument (ICD)

ClearThe boundariesICD prevent finger-pointing during downtime. Define ownership based onis the layerlegal ofcontract between two architectural blocks. No integration code is written until the technologyICD stack.is signed.

ITMandatory DepartmentICD ResponsibilitiesComponents:

1. Transport Protocol: (e.g., HTTPS REST, MQTT, TCP Socket).
2. Directionality: Who initiates? (Push vs. Pull).
3. Authentication: API Key, OAuth, or Certificate.
4. Schema Definition: The Enabler)exact payload structure (JSON/XML).
   • Strict Typing: Define quantity as Integer, not String.
   • Unit of Measure: Define temperature as Celsius, not just 240.
5. Error States: How does the system signal failure? (HTTP 400 vs 500).

Pro-Tip: Store ICDs in a Git repository alongside the code. They are living documents, not PDFs buried in SharePoint.

Semantic Governance: Naming & IDs

If you cannot uniquely identify an object, you cannot control it.

Naming Strategy: The ISA-95 Hierarchy

Do not invent names. Use the physical hierarchy to create logical namespaces.

• Format: Site/Area/Line/Cell/Device
• Example: MEX01/SMT/Line04/PickPlace02/Feeder12
• Why: This allows you to aggregate data logically. A query for MEX01/SMT/* returns all SMT performance for the site.

Identity Strategy: The Immutable UID

• InfrastructureThe & Security:Problem: ServerVendor uptime,Serial networkNumbers latency,are cybersecurity,not andunique patchglobally. management.A resistor reel from Vendor A might have the same ID as a capacitor reel from Vendor B.
• Architecture:The Mandate: EnsuringGenerate newan toolsInternal integrateUnique withIdentifier (UID) at the existingpoint ecosystemof entry (SSOT) without creating data silos.Receiving).
• Availability:Implementation: GuaranteeingUUID (e.g., 550e8400-e29b...) or a prefixed integer (UID-999999). Use this Internal UID as the systemPrimary isKey accessiblein 24/7.all database relations.

Temporal Governance: Time Synchronization

Distributed systems essentially function as a time-machine. If clocks drift, cause-and-effect logic breaks.

The NTP Mandate

• Master: Deploy a local Stratum 1/2 NTP Server in the OT Network.
• Drift Tolerance: ±500ms max.
• UTC Standardization:
  • Storage: All timestamps in databases and logs must be UTC (ISO 8601).
  • Display: Convert to Local Time only at the UI layer (Operator Screen).
  • Risk: If you store Local Time, a Night Shift crossing Daylight Savings Time will duplicate or lose one hour of production data.

Message Resilience & Versioning

Assume the network will fail. Assume the API will change.

Versioning Policy

• Rule: Never break the contract.
• Implementation: Use Semantic Versioning in the Endpoint.
  • POST /api/v1/work-order (Legacy)
  • POST /api/v2/work-order (New Feature)
• Deprecation: Maintain support for v-1 for a minimum of 6 months.

Operations/BusinessError ResponsibilitiesHandling (The& Owner)Idempotency

• Process Logic:Scenario: DefiningMES howsends a "Consumption" message to ERP. ERP receives it but the systemAck behavesis (e.g.,lost. "BlockMES shipment if test fails").retries.
• Master Data:Risk: AccuracyERP ofdeducts BOMs,materials Routings, and User permissions.twice.
• Adoption:Mandate: TrainingThe shiftReceiver leadsmust andbe enforcingIdempotent. systemIt usagemust oncheck the floor.Message-ID. If it has already processed Msg-101, it simply returns "Success" without re-processing the transaction.

OwnershipStore-and-Forward Logic(Buffering)

• IfConstraint: theNetwork serverpartitions crashesare → IT Issue.
• If the barcode scans correctly but returns "Part Not Found" due to missing data → Operations Issue.
• If the workflow is technically functional but inefficient for operators → Operations Design Failure.

Pro-Tip: When a production manager says "The system is broken," ask immediately: "Is it down, or is it wrong?" "Down" is IT; "Wrong" is Operations.

The Product Owner (PO) Role

Software cannot be built by committee. Assign a dedicated Product Owner from the business side (Manufacturing Engineering or Production Management) to bridge the gap between code and concrete.

PO Mandate

The PO translates business needs into technical requirements. They possess the authority to approve or reject features.

• Profile: Must understand the physical manufacturing process deeply. An IT project manager cannot fill this role effectively.inevitable.
• Duty:Mandate: PrioritizeAll Edge Gateways and MES interfaces must buffer messages locally (Disk/Queue) if the backlogupstream basedconnection onis ROI and operational risk, not just user complaints.

Decision Logic

• If a feature request lacks a defined business value (Time saved / Quality improved) → PO rejects request.
• If Operations demands a change that violates architectural integrity (e.g., direct DB writes) → IT Architect rejects request.

Financial Accountability (P&L)

Budgets drive behavior. If the IT department pays for the MES licenses, Operations treats the system as a "free utility" and demands infinite features.

The "User Pays" Model

Shift the budget for operational software from the CIO to the COO/Plant Manager.

• Software Licenses: Charged to the Factory P&L.lost.
• Custom Development:Recovery: BilledWhen internallyconnection torestores, flush the specific Production Unit requesting the change.

The Consequence

When the Production Director sees the line item for "Custom Report Development" on their monthly P&L, irrelevant requests disappear. They become significantly more interestedbuffer in whether the tool is being used correctly.

Change Management & Validation

IT writes the code, but Operations must certify it. Never allow IT to "sign off" on a production process change.

User Acceptance Testing (UAT) Ownership

• Role: Operations must provide the test data and perform the physical test execution.
• Sign-off: Deployment to Production requires a digital signature from the Product Owner.

Change Logic

• If a bug is found in Production after UAT sign-off → Operations owns the impactFIFO (ITFirst-In, fixesFirst-Out) theorder code,to butpreserve Ops explains the scrap cost).sequence.
• If IT deploys without PO signature → IT owns the impact.

Final ChecklistChecklist: Governance Readiness

CategoryGovernance Pillar	MetricControl / ControlPoint	ThresholdMandatory /Standard	Engineering RuleConsequence
GovernanceContract	ICD	Signed & Versioned	SystemPrevents Owner	Named"Tribal BusinessKnowledge" Leaderintegrations (notthat IT)are for every Moduleunmaintainable.
RoleTopology	Decoupling	No Direct SQL Access	ProductProtects Owner	1data Dedicatedintegrity POand perallows majorindependent system (MES/ERP)upgrades.
FinanceTime	NTP Sync	UTC + Local NTP	BudgetGuarantees Allocation	License/Devaccurate costssequence chargedof toevents Opsfor P&Lgenealogy.
DataNaming	Namespace	ISA-95 Structured	MasterEnables Datascalable Quality	Opsanalytics ownsand accuracy;clear ITasset owns backupmanagement.
ChangeResilience	Retry Logic	Idempotent Receiver	Validation	OpsPrevents performsdouble-counting UAT;inventory ITduring performsnetwork Deploymentjitters.
ChangeVersioning	API Lifecycle	Explicit (v1, v2)	FeaturePrevents Request	Must"Big comeBang" fromdeployments; PO,enables notsafe individual users
Uptime	Accountability	IT owns Availability; Ops owns Utilizationrollouts.