104 Real-Time ISA-95: Timing Foundations
104.1 Start With the Decision
A factory message can be correct and still arrive too late for control. Timing class and ISA-95 level set the safe boundary for each decision.
104.2 Route Overview
This is part 1 of 3. Continue with Real-Time ISA-95: Determinism and Technology Mapping.
104.3 Part Objectives
- Distinguish hard, firm, and soft real-time industrial deadlines.
- Map timed data and control responsibilities across ISA-95 levels.
104.4 Start With the Story
104.4.1 Keep Fast Control Below Slow Planning
A filling line must close a valve before a bottle overflows. The line controller can act in a fraction of a second. A production system can count finished bottles over minutes, while business planning may work across days. Sending the fast decision upward through every layer would add delay and mix duties that need different owners.
Draw the action from the machine outward. Keep immediate safe control near the process. Give supervisors current state and a bounded way to change approved settings. Let production planning combine orders, materials, and results. Let business planning use summaries. State who may command, who may observe, and which record crosses each boundary.
Then test the timing and authority. Delay an upper system. Send an old setting. Remove the business link. Restart the line controller. Ask an unauthorized user to change a limit. Check that local safety continues, stale commands are refused, summaries catch up without rewriting history, and each accepted change has a time and owner.
The layers are not fixed brands or a promise that every factory is arranged alike. They separate decision speed and responsibility. The deeper sections name the formal levels, timing classes, control loops, production records, and evidence needed when information moves between fast operations and slower planning.
Review each boundary with a plain question. Which action must happen at the machine? Which state does the operator need now? Which setting may a supervisor change? Which work order guides the shift? Which summary guides the week? Who owns each rule? Which upper loss must not stop safe local work?
Keep commands and reports distinct. A machine state may rise to planning. A plan may set an approved target. Neither path should let an old report act like a live command. Mark source, event time, approval time, version, and owner. Reject a value whose age or authority is wrong for the receiving layer.
Run the line with slow upper systems. Queue a report. Change a plan. Restart the local control. Switch shifts. Restore the link. Check that the valve still closes on time. Check that the operator sees the local truth. Check that the later summary keeps the original event time. Check that no saved command repeats.
Then test access. Let a planner view the result but not drive the valve. Let a supervisor change only an allowed setting. Let a service worker enter a safe repair mode. Record each accepted change. Refuse each wrong role. The boundary is useful when the factory can show who observed, who decided, and who acted.
Begin with a control decision and ask how fast it must be made and who is allowed to make it. ISA-95 and real-time design tell the story of boundaries: field control, supervisory visibility, production execution, and business planning each operate on different timing promises.
The mathematical gist. A 4–20 mA loop across 250 ohms becomes 1.00–5.00 V, a 4.00 V ADC span. At the chapter’s 1 ms sample period, 1 kHz sampling sets a 500 Hz Nyquist limit. A 1.00 kohm, 398 nF low-pass gives the chapter’s illustrative 400 Hz pole and a 0.398 ms time constant, while a 12-bit conversion steps through the span in 0.977 mV increments. Because 400 Hz is 80% of Nyquist, that single pole is not by itself a validated anti-alias filter.
- Start With the Story
- Phoebe’s Field Notes: Sizing the Anti-Alias Filter for a 1 kHz Motor Loop
- Prerequisites
- ISA-95 Timing Boundaries
- Put Decisions at the Lowest Level
- Deadlines Beyond Network Speed
- Introduction
- Real-Time and ISA-95 Basics
- Factory Speed Limits
- ISA-95 Automation Pyramid
- Key Concepts
- Timing Requirements by Level
- Checkpoint: Timing Ladder
- Real-Time Requirements Calculator
104.5 Learning Objectives
After completing this chapter, you will be able to:
- Differentiate between ISA-95 automation levels and their timing constraints
- Distinguish hard real-time from soft real-time requirements and their engineering implications
- Design real-time industrial control systems with appropriate latency requirements
- Map technologies to appropriate automation levels
- Apply the ISA-95 model to industrial IoT architectures
104.6 Prerequisites
Before diving into this chapter, you should be familiar with:
- Industry 4.0 Fundamentals: Core concepts of Industry 4.0 and vertical integration
- Industrial Protocols: Protocol characteristics including latency and determinism
- Networking Basics: Latency, jitter, and network timing concepts
104.7 ISA-95 Timing Boundaries
ISA-95, published as IEC 62264, is useful because it prevents one architecture from treating every factory message as the same kind of message. A servo drive, PLC task, HMI alarm, MES work order, and ERP purchase plan all matter, but they live on different time scales and carry different consequences when they arrive late.
The lower levels are close to the physical process. Level 0 devices sense or actuate. Level 1 controllers run machine logic. Level 2 systems supervise and visualize. Level 3 systems coordinate production operations. Level 4 systems plan the enterprise. IoT designs fail when they move Level 0 or Level 1 control decisions into cloud services, dashboards, or business systems that were never built for deterministic deadlines.
The useful pattern is to separate control authority from information visibility. A cloud dashboard may show a motor-current trend, but it should not close a 1 ms torque loop. MES may issue a production order, but it should not bypass a PLC interlock. ERP may plan inventory, but it should not decide whether a robot can enter a safety zone. Each level can exchange data with the others, but the deadline and safety owner must stay attached to the function.
That separation also keeps industrial IoT projects honest. A machine event may need a local trip, a SCADA alarm, a historian sample, an MES quality hold, and an ERP maintenance cost update. Those are related records, not one identical message. The lower levels need deterministic response and fail-safe behavior; the upper levels need context, timestamps, ordering, reconciliation, and business meaning.
- Hard real-time: Missing the deadline is a system failure, even if the answer eventually arrives.
- Soft real-time: Delay degrades usefulness, but the system can usually continue safely.
- Best effort: Correctness depends more on completeness, ordering, and reconciliation than on millisecond delivery.
Before isa-95 timing boundaries, inspect Figure 104.1: Industry 4.0 Stack must be considered with Five-tier automation hierarchy with latency requirements. That visual pairing grounds timing boundary: each layer has a different owner, deadline, failure mode, and acceptable integration technology in named evidence.
Trace the visual from Industry 4.0 Stack to Five-tier automation hierarchy with latency requirements in Figure 104.1; verify Enterprise Layer (ERP) before concluding. Together those labels make timing boundary: each layer has a different owner, deadline, failure mode, and acceptable integration technology testable. Apply their boundary when working through isa-95 timing boundaries.
104.8 Put Decisions at the Lowest Level
A practical ISA-95 design starts with the fastest unsafe or economically damaging event. Emergency stop, light curtain, torque limit, burner management, and motion synchronization belong near certified safety controllers, drives, PLCs, or dedicated real-time hardware. A dashboard can display their state, but it should not be the path that makes them safe.
As timing relaxes, the architecture can move upward. SCADA and HMI systems can supervise lines and alarms. Historians can sample process values for trends. MES can handle work orders, batch phases, genealogy, quality checks, and OEE. ERP can plan demand, inventory, purchasing, and finance. Edge gateways and OPC UA servers often bridge the lower levels to these higher consumers without collapsing the timing boundaries.
For each function, write a timing row before selecting protocols. A packaging line may need a 4 ms registration correction, a 50 ms reject confirmation, a 500 ms HMI alarm update, a 5 second quality-hold decision, and a nightly ERP production reconciliation. These numbers point to different owners and paths. Putting them in one table exposes whether a proposed MQTT, REST, OPC UA, PROFINET, EtherCAT, or database path is being used at the right ISA-95 level.
Use gateways as translators, not as hidden control owners. An OPC UA server can expose PLC tags with semantic names and quality codes; a historian can compress and retain process values; an MES connector can attach work-order, batch, operator, and material context. None of those bridges should silently become the only place where a local stop, interlock, or critical fallback is decided.
- Write the deadline. Capture cycle time, maximum latency, jitter tolerance, timeout behavior, and safe fallback for each function.
- Name the owner. Decide whether the function is owned by a sensor/actuator, drive, PLC, safety controller, SCADA, MES, historian, gateway, cloud service, or ERP.
- Choose the path. Use deterministic paths such as PLC scan cycles, EtherCAT distributed clocks, PROFINET IRT, or CIP Sync where deadlines demand them; use OPC UA, MQTT, REST, or database interfaces only where timing allows.
- Define stale-data behavior. Specify when a value becomes stale, who may act on it, and which local action wins if the network or cloud link is unavailable.
104.9 Deadlines Beyond Network Speed
A real-time guarantee includes sensing delay, input filtering, PLC scan time, task priority, network scheduling, controller execution, output update, actuator response, and mechanical settling. A fast Ethernet link does not fix a slow scan cycle, overloaded gateway, nondeterministic task scheduler, or cloud round trip. That is why control engineers measure end-to-end response, not just bandwidth.
Clocking and scheduling matter. Motion systems may use EtherCAT distributed clocks, PROFINET IRT time slots, CIP Sync with IEEE 1588 PTP, or TSN mechanisms such as IEEE 802.1AS time synchronization and 802.1Qbv time-aware shaping. Safety functions may rely on certified PLCs, safety relays, safety-rated drives, PROFIsafe, CIP Safety, or IEC 61508/IEC 61511 engineering practices rather than ordinary application code.
Higher levels have their own correctness rules. MES transactions need sequence, genealogy, batch state, operator action, and quality disposition. Historians need timestamp source, compression, exception/deviation rules, and data quality. ERP integrations need reconciliation and retry. These concerns are different from sub-millisecond determinism, but they are still part of a reliable industrial IoT architecture.
Determinism is normally engineered by bounding every queue and scheduler in the path. A PLC task with a fixed scan period, a drive with synchronized clocks, a switched industrial Ethernet segment with reserved time slots, and a local fail-safe output can be analyzed for worst-case behavior. A Wi-Fi channel, TCP retransmission, broker queue, cloud function, or shared database can still be valuable, but it belongs on a telemetry or coordination path where late data degrades usefulness instead of breaking the machine.
When data crosses levels, preserve both time and authority. A value should carry timestamp source, quality code, equipment mode, work-order or batch context, and source system so that SCADA, historian, MES, and ERP consumers do not mistake an old value for a live control signal. This is why ISA-95 integration is not only a network diagram; it is a contract between real-time behavior, operational semantics, and business records.
- Measure latency budget: Include sensor, controller, network, compute, output, and mechanical response.
- Separate authority: Keep certified control and safety functions local; let upper layers request, supervise, or record unless engineered for direct control.
- Preserve context: Carry timestamp, quality code, equipment state, recipe or work-order context, and source system with data that crosses ISA-95 levels.
104.10 Introduction
Industrial systems have strict timing requirements that vary by automation level. A motor control loop that misses its 1 ms deadline can cause equipment damage, while an enterprise report delivered a few seconds late has no operational impact. Understanding these timing requirements is fundamental to designing effective industrial IoT systems.
Core Concept: The ISA-95 standard defines a five-level automation pyramid that maps industrial systems from field devices (sub-millisecond response) up to enterprise planning (hours-to-days). Each level has distinct timing requirements, and choosing the wrong technology for a given level can cause equipment damage, safety incidents, or wasted resources.
Why It Matters: A missed deadline in a servo, safety, or interlock path can damage equipment, create a safety hazard, or interrupt production. Conversely, using hard real-time hardware for enterprise reporting wastes budget. ISA-95 gives engineers a systematic framework for matching timing requirements to technology choices, keeping safety-critical functions on bounded local paths while business functions use ordinary IT infrastructure.
Key Takeaway: Always design from the bottom up — identify the hardest real-time constraint first (usually Level 0-1 safety or motion control), select deterministic protocols and RTOS platforms for those functions, then relax requirements as you move up the pyramid toward enterprise integration. Never attempt to use cloud or IT technologies for hard real-time control.
Hey there, young engineer! Temperature Terry has discovered that factories have speed limits — just like roads!
The Factory Speed Pyramid: Imagine a factory is like a tall building with 5 floors:
- Basement (Level 0): This is where the actual machines live — robot arms, conveyor belts, temperature sensors. They need to react SUPER fast — like catching a ball that is thrown at you! (Less than 1 millisecond — that is 1/1000th of a second!)
- Floor 1 (Level 1): The “brain boxes” (PLCs) that tell machines what to do. They need to be fast too — like a goalkeeper saving a penalty! (1-10 milliseconds)
- Floor 2 (Level 2): The big screens where humans watch everything happening. Humans are slower than machines, so updates every second are fine — like checking the scoreboard during a game!
- Floor 3 (Level 3): The factory managers planning what to make next. They work in minutes and hours — like a coach planning the next play.
- Floor 4 (Level 4): The big bosses deciding what products to build next month. They work in days and weeks — like planning what sport to play next season!
Why Speed Matters: Imagine if the brain box (PLC) told a robot arm to STOP, but the message took 5 whole seconds to arrive. The robot would have already crashed into something! That is why faster floors need special “express delivery” networks, while the upper floors can use regular internet — just like how an ambulance needs a siren to go fast, but a mail truck can take the regular road.
Sensor Squad Memory Trick:
- Level 0-1 = Lightning fast (machines talking to machines)
- Level 2 = Human speed (people watching screens)
- Level 3-4 = Planning speed (thinking and deciding)
- Hard real-time = MUST arrive on time, or something breaks!
- Soft real-time = Should be fast, but a tiny delay is OK
104.11 ISA-95 Automation Pyramid
The first pass above named the boundary problem. Now we turn that boundary into the standard five-level pyramid used to place real factory systems.
Key Concepts
ISA-95 Level 0 is the physical process: sensors, actuators, drives, valves, and the machine state they measure or change. Level 1 contains the PLCs, PACs, DCS controllers, safety controllers, and drives that execute local control logic. Level 2 adds supervisory SCADA, HMI, alarms, recipes, and historians for operators and engineers. Level 3 coordinates operations through MES, batch, genealogy, OEE, quality, and production-dispatch systems. Level 4 is enterprise planning, where ERP, finance, procurement, demand planning, and supply-chain systems make business decisions.
Two timing terms cut across those levels. Hard real-time describes a deadline for which lateness is failure, not merely inconvenience. Jitter is cycle-to-cycle timing variation; in synchronized motion, bounded jitter can matter more than average latency.
The ISA-95 standard (also known as IEC 62264) defines the interface between enterprise and control systems:
Figure 104.2 makes key concepts inspectable through ISA-95 Automation Pyramid and L4 Business Planning. Those diagram labels establish the scope of isa-95 separates physical process, control, supervisory, operations, and business-planning responsibilities so timing and authority are not collapsed.
Use L4 Business Planning to test ISA-95 Automation Pyramid in the diagram at Figure 104.2. Then inspect Customer order: 1000 widgets, deadline Friday as the final qualifier on isa-95 separates physical process, control, supervisory, operations, and business-planning responsibilities so timing and authority are not collapsed. That sequence keeps key concepts tied to what is visibly labelled.
104.12 Timing Requirements by Level
104.12.1 Level 0: Field Devices (Sub-millisecond)
The physical interface with the manufacturing process:
- Sensors sample physical processes
- Actuators respond to control signals
- Examples: Thermocouples (1-100 ms), high-speed encoders (50μs), servo drives (62.5μs)
Characteristics:
- Direct connection to physical process
- Continuous or very fast periodic operation
- Simple devices with minimal processing
- Often intrinsically safe for hazardous areas
104.12.2 Level 1: Basic Control (1-10 ms)
Automated control of manufacturing processes:
- PLCs execute control logic
- PID loops maintain setpoints
- Safety systems must guarantee response times
- Examples: Motion control (1 ms), discrete I/O (10 ms), process control (100 ms)
Characteristics:
- Deterministic execution cycles
- Real-time operating systems
- Redundancy for critical functions
- Direct I/O to Level 0 devices
104.12.3 Level 2: Supervisory (100 ms-1s)
Monitoring and supervision of production processes:
- SCADA systems collect data from multiple PLCs
- HMIs display process status to operators
- Alarm systems notify of abnormal conditions
- Examples: Data logging (1s), trend displays (5s), alarm response (500 ms)
Characteristics:
- Soft real-time requirements
- Human interaction interfaces
- Historical data storage (historians)
- Recipe and batch management
104.12.4 Level 3: Operations (Seconds to Minutes)
Manufacturing operations and workflow management:
- MES manages production schedules
- Tracks work orders, genealogy, and quality
- Batch control coordinates recipes
- Examples: Batch phase transitions (10s), reporting (1min), scheduling (hours)
Characteristics:
- Integration with enterprise systems
- Production workflow coordination
- Quality management and traceability
- Resource allocation and tracking
104.12.5 Level 4: Enterprise (Hours to Days)
Business planning and logistics:
- ERP handles business planning
- Supply chain management coordinates materials
- Customer relationship management
- Examples: Daily production planning, weekly demand forecasting, monthly financial closing
Characteristics:
- Business process integration
- Long-term planning horizons
- Financial and customer data
- Corporate-wide visibility
Checkpoint: Timing Ladder
You now know: Begin with level 0 field devices can operate below 1 ms, while Level 1 control commonly sits in the 1-10 ms range. Next consider level 2 supervision moves at 100 ms-1s, Level 3 operations moves in seconds to minutes, and Level 4 enterprise work moves in hours-days. Then test a single machine event can create a local trip, SCADA alarm, historian sample, MES quality hold, and ERP cost update without giving each record the same deadline.
104.13 Real-Time Requirements Calculator
Try it: Adjust the system type and number of devices to see how timing requirements and bandwidth change across ISA-95 levels. Notice how motion control requires orders of magnitude faster response times than enterprise planning.
104.14 Continue to the Next Part
Carry this evidence into Real-Time ISA-95: Determinism and Technology Mapping, which begins with Determinism vs. Throughput.