Designed for Reliable Performance and Enterprise Security
FrameworX combines deterministic real-time performance with comprehensive security architecture. Built on the [Technology Foundation] of 100% managed .NET code, the platform delivers millisecond response times while maintaining defense-in-depth protection and full compliance capabilities.
Operational Excellence:
- Performance monitoring with <100ms tag updates & 1ms timestamps
- Multi-layer security with RBAC, Secrets and encryption
- Compliance ready: FDA, IEC 62443, NERC-CIP
- Git-based DevOps with JSON export
- Hot-standby redundancy with <5 second failover
On this page:
Table of Contents maxLevel 2 minLevel 2 indent 10px exclude Steps style none
Optimized Architecture
Technology Stack
Both .NET & Java and powerful platforms for enterprises, with benefits and tradeoffs on specific scenarios.
The one area, there is technical nonsense in the market is that .NET is the technology to go when performance is key.
Add:
C# vs Python 3 vs Jython
Add:
WebAssembly
Add FactoryFloor Operations Performance Requirements
(Research other .NET unique features, JIT, MamageCode, Dynamic Loading, Domain, etc)
Performance Architecture
Optimization Layers
Layer | Optimization | Impact |
|---|---|---|
| Application | Efficient scripts, optimized queries | CPU usage |
| Runtime | Thread pool tuning, memory management | Response time |
| Database | Indexing, partitioning, archiving | Query speed |
| Network | Compression, protocol selection | Bandwidth |
| Hardware | CPU cores, RAM, SSD storage | Overall capacity |
Built-in Performance Monitoring tools
Diagnostic Architecture
Logging Infrastructure
Technology Stack
Both .NET & Java and powerful platforms for enterprises, with benefits and tradeoffs on specific scenarios.
The one area, there is technical nonsense in the market is that .NET is the technology to go when performance is key.
Add:
C# vs Python 3 vs Jython
Add:
WebAssembly
Add FactoryFloor Operations Performance Requirements
(Research other .NET unique features, JIT, MamageCode, Dynamic Loading, Domain, etc)
Performance Architecture
Optimization Layers
| Layer | Optimization | Impact |
|---|---|---|
| Application | Efficient scripts, optimized queries | CPU usage |
| Runtime | Thread pool tuning, memory management | Response time |
| Database | Indexing, partitioning, archiving | Query speed |
| Network | Compression, protocol selection | Bandwidth |
| Hardware | CPU cores, RAM, SSD storage | Overall capacity |
Scalability Factors
Enterprise Unlimited (Distributed) (*2)100,000+
Enterprise Unlimited (Stand-alone)
15,000-100,000 I/O (*)
Enterprise Scaled
MachineHMI
Up to 1,000 I/O
(*1) The distributed model is frequently used in smaller applications.
It provides easier management with the distributed nodes:
- DataHubNode: I/O acquisition and Alarm/Historian processing
- ApplicationNode: Automation Islands for Displays & Users self-governance.
(*2) There are no restrictions to deploy larger systems.
That is just the typical usage.
(*3) EdgeConnect has unlimited I/O, but not included in this chart, as it as Edge services to another app.
Performance Metrics
| Metric | Target | Measurement |
|---|---|---|
| Tag Update Rate | <100ms | Device to display. Test case: 100,000 Modbus tags in < 1s |
| Alarm Response | <1 second | Condition to notification, keeping 1ms timestamp on logs |
| Client Response | <200ms | User display action to feedback |
| Displays Update | < 50ms | Code behind execution and realtime updates on diaplays |
| Historian Write | <1 second | Tag change to storage, keeping 1ms timestamp on logs |
| Failover Time | <5 seconds | Primary to |
Diagnostic Architecture
Logging Infrastructure
Performance Monitoring
AI Assistant Data
<details> <summary>Structured Information for AI Tools</summary>
json
{
"page": "Platform Architecture",
"type": "Technical Architecture Guide",
"purpose": "Explain FrameworX system architecture and deployment patterns",
"sections": {
"components": ["Three-tier architecture", "Runtime engine", "Module system"],
"deployment": ["Standalone", "Distributed", "Redundant", "Cloud/Hybrid"],
"dataFlow": ["Real-time processing", "Event-driven", "Message bus"],
"security": ["Defense in depth", "Security zones", "Authentication/Authorization"],
"performance": ["Scalability", "Optimization", "Metrics"]
},
"keyArchitecture": {
"tiers": ["Presentation", "Application", "Data"],
"core": "TServer Runtime Engine",
"communication": "TCP/IP, HTTP/S, WebSocket",
"storage": "In-memory tags, SQL databases"
},
"scalability": {
"small": "Up to 5,000 tags",
"medium": "5,000-50,000 tags",
"large": "50,000-500,000 tags",
"enterprise": "500,000+ tags"
}
}</details>
Introduction
Our platform caters to mission-critical systems in sectors like Energy, Oil & Gas, and Pharma. Whether meeting NERC or FDA standards, it provides a stable, secure infrastructure from HMI to IoT. This section delves into key features.
On this page:
| Table of Contents | ||||
|---|---|---|---|---|
|
Security Highlights
Security and Reliability
We prioritize stability and security throughout our platform's design, from technology selection to module architecture.
Easy Configuration and Maintenance
Our platform offers secure, straightforward configuration and maintenance for various scenarios, ensuring scalability and consistency.
Operational Stability
Operational stability is guaranteed with our platform's 100% managed code implementation, featuring robust exception handling and seamless failure recovery.
Redundancy and Availability
For high availability, our platform offers redundancy with a proven hot-standby system for real-time databases, alarms, and historians, catering to diverse network setups.
FDA 21 CFR Part 11 and NERC
The software platform has a range of security and compliance features that can be used to help organizations meet the requirements of FDA 21 CFR Part 11. It is important to note that compliance is an ongoing process, and therefore, organizations should regularly monitor and update their systems and policies to ensure adherence to the standards established by the FDA.
The platform was also designed following the applicable recommendations from NERC CIP, such as the CIP-007-1 - Cyber Security-System Management.
Title 21 CFR Part 11 is the part of Title 21 of the Code of Federal Regulations that establishes the United States Food and Drug Administration (FDA) regulations on electronic records and electronic signatures (ERES).
Part 11, as it is commonly called, defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records.
Listed below and described are some security-related features available in the product:
| Panel | ||
|---|---|---|
| ||
|
For detailed Explanation on how to add security management in project consist with these rules, go to the page FDA 21 CRT Compliance page.
For addition information on NERC CIP-007-1 - Cyber Security-System Management, go to the page NERC CIP Overview.
standby |
(*) Those are expected numbers in a typical implementation. Exact metrics depending on solution design and hardware
Built-in Performance Monitoring Tools:
- Real-time performance dashboards
- Resource utilization tracking
- Bottleneck identification
- Historical trend analysis
Operational Stability
- 100% Managed Code - No memory leaks or pointer errors
- Exception Handling - Graceful failure recovery at every level
- Multi-threaded Execution - Parallel processing with thread safety
- Resource Management - Automatic garbage collection and optimization
Security Architecture
Defense in Depth Implementation
| Layer | Protection Level | Components |
|---|---|---|
Layer 1: Network. Security | Perimeter defense |
|
Layer 2: Application Security | Access control |
|
Layer 3: Data Security | Information security |
|
Layer 4: Operational Security | Process integrity |
|
Security Zones Architecture (ISA-99/IEC 62443)
TSecureGateway enables secure data transfer across zones, bridging Level 2 (factory floor) to Level 4 (enterprise) while maintaining isolation and protection against threats.
Authentication & Authorization
Flexible Authentication Methods
| Enterprise Integration | Native Options |
|---|---|
|
|
Role-Based Access Control (RBAC)
- Granular Permissions - Display, object, and action-level control
- Group Hierarchies - Inherited permissions with override capability
- Dynamic Roles - Runtime permission changes based on context
- User Policies - Password complexity, session duration, auto-logoff
Compliance & Standards
Industry Standards Implementation
| Standard | Implementation | Key Features |
|---|---|---|
| ISA-95 | UNS design patterns | Enterprise/control integration model |
| ISA-101 | HMI design compliance | Operator effectiveness standards |
| FDA 21 CFR Part 11 | Electronic records/signatures | Audit trails, data integrity, validation |
| High Performance HMI | Display design principles | Situational awareness, alarm management |
| IEC 62443 | Cybersecurity guidelines | Security zones, defense in depth |
| NERC-CIP | Critical infrastructure | Access control, monitoring, recovery |
DevOps & Version Control
Enterprise Development Practices
| Native Tool | Feature |
|---|---|
| JSON-Git Export | Human-readable diffs for Git integration |
| Change Tracking | Keep track of changes at object level, with automated version numbering |
| Cross Reference | Dependency analysis and automated rename for all configuration objects |
| Build Procedure | Validation of all server scripts and all displays scripts |
| Publish Procedure | Readonly deployment files for regulated areas |
| Execution Profiles | Management for Development, Validation, Production and Custom environments. |
| DevOps APIs | Programmatic control of configuration and execution |
| Health Monitoring | Built-in runtime metrics and web dashboard |
| Container Support | Docker deployment including support for App Hosting in Cisco Routers |
| Execution Integrity | Built-in diagnostics to verify if running solution matches a given configuration. |
Solution Configuration Protection
- Encrypted Configuration - All settings in protected .dbsln file
- IP Protection - Source code and binaries secured
- Single File Deployment - Simplified distribution and management
- Access Control - Role-based modification rights
Redundancy & High Availability
Hot-Standby Configuration
| Feature | Specification | Benefit |
|---|---|---|
| Automatic Failover | <5 seconds switchover | Minimal disruption |
| Data Synchronization | <5 seconds switchover | No data loss |
| Client Reconnection | Transparent to operators | Continuous operation |
| State Preservation | Full context maintained | Seamless recovery |
(*) Those are expected numbers in a typical implementation. Exact metrics depending on solution design and hardware
Supported Redundancy Modes:
- Server redundancy (primary/standby)
- Database redundancy (mirrored/centralized)
- Network redundancy (dual-path)
- Device redundancy (PLC communication)
External Validation
- Regular third-party penetration testing
- Veracode security assessments
- Gap analysis and remediation
- 100% approval requirement for release
Built-in .NET Security
FrameworX development is built on the .NET framework, following strict security protocols. Each module adheres to specific guidelines aligned with its function, such as FDA compliance for the Alarms module and adherence to standards like IEC61850 for modules handling electrical device communications.
Below are the main security topics along with essential details about each.
| title | Security at the Core Level |
|---|
Security implementation is ingrained at the core level rather than being applied externally. The platform's modules incorporate built-in security components designed from their very core.
For more detailed insights into security in .NET, refer to Microsoft's documentation available at: Microsoft .NET Security InformationWeb Client Communication Security
HTML5 provides flexibility in choosing between "http" or "https/ssl" protocols.
The production servers will use HTTPS, but the allowing http connection on development, simplifies the early state of the projects.
The HTTPS uses TLS security.
The TSecureGateway is a crucial part of our platform, enabling smooth data transfer across different security network zones. It serves as a bridge, moving data from lower levels, like the factory floor (Level 2), to higher levels such as the enterprise (Level 4).
Acting as a protective barrier, the TSecureGateway shields internal networks from insecure traffic. Enterprises rely on it to guard employees and users against potential threats from malicious web traffic, websites, viruses, and malware.
Files and Execution Protection
License/Softkey
The "License/Softkey" feature employs the .NET class System.Security.Cryptography.Rijndael, utilizing symmetric encryption with a key size of 256 bits.
Digital signature
All assemblies created by Tatsoft are signed digitally.
Project format (Configuration protection)
All project settings, including security measures like cryptography, power recovery, and user/password protections, are stored in a relational database (.dbsln file). The source code and compiled binaries for Scripts and Displays are also stored in this file. This centralized storage method streamlines project management and deployment, making access and maintenance easier.
User Authentication and Permissions
User Authentication
Our platform offers integration with various systems for user authentication:
| Panel | ||
|---|---|---|
| ||
|
Active-Directory / Windows Authentication
Enabling Windows Authentication bypasses the project's configured user list, relying on Windows policies instead. Windows manages user authentication directly, utilizing the currently logged-in Windows user for system access.
LDAP
When LDAP is used, the project ignores its configured user list and relies on policies managed by Windows and the LDAP Server. Authentication is handled by both Windows and the LDAP Server, with the external user logged into the LDAP Server being utilized within the system.
Runtime Users
The system dynamically generates users and stores their credentials in SQL databases. It seamlessly integrates with Active Directory or third-party systems to retrieve users, enabling integrated security and unified login capabilities.
Roles, Permission and Policies
Group and User Permissions
Our users have complete flexibility to define privileges based on groups or specific individuals. Permissions can be set globally or linked to particular displays, objects, or input actions, offering granular control over access levels.
User Policies
Our platform offers a comprehensive array of user management features, including identification policies, session duration control, automated logoff mechanisms, electronic signature capabilities, and robust audit-trail functionality.
Database Injection Protection
In database operations involving stored procedures, there is a significant concern about SQL injection. SQL injection can occur if parameters are passed as plain text within SQL statements, which could allow malicious code to be executed. To prevent this, we use the .NET API, where parameters are added to a command object’s parameter list. This approach makes SQL injection impossible by safely handling user input.
Security External Validation
Regularly the platform is accessed by Veracode, or third-party companies, on penetration testing report, gap analysis, and various other topics.
Any issues that would prevent a 100% approval are corrected.In this section...
| Page Tree | ||||
|---|---|---|---|---|
|