Architecture

Outside the control path.

MOFF runs on a single Windows machine in your DMZ, at Purdue level 3.5. It polls downward into the OT network and delivers upward into IT. Data crosses the boundary in one direction only.

Installation

One machine, one Windows service. Nothing is deployed on the controllers and no firmware is touched.

The boundary

Read-only polling downward, signed delivery upward. MOFF holds no write path into the OT network at all.

Failure mode

If the MOFF machine stops, production continues unchanged, because nothing in the control path depends on it.

One layer, more than one place to put it

The DMZ is the common case, not the only one. Where MOFF sits is a question of where your network boundary is and who needs the data.

In the DMZ

The usual placement. One machine reads down into OT and delivers up into IT, and the signed record crosses the boundary in one direction only.

At the edge, per site

A local instance close to the controllers, useful where a site is remote, a link is unreliable or the plant should keep signing when the line is down.

Several instances, one record

More than one site can run its own MOFF and deliver into the same destinations, each with its own signed chain that verifies independently.

In ISA-95 terms

The levels on the diagram are the ones your architects already use. MOFF polls equipment at levels 0 to 2, runs at the boundary most sites call level 3.5, and delivers to business and analytics systems at levels 4 and 5. If a network drawing already places a DMZ between OT and IT, MOFF goes where that drawing says.

What it does

Moves data across the level boundary in one direction and attaches proof of origin to every value on the way. It is transport and evidence between the levels.

What it does not do

MOFF does not implement the ISA-95 information models. There is no B2MML, no equipment hierarchy and no manufacturing transaction model. Your MES keeps owning that.

On the security side the same logic applies. A read-only path out of the OT zone with no inbound route is what a zone and conduit model asks for, and MOFF is designed that way. No IEC 62443 certification is claimed, because none has been carried out.