CIOS daily operations are the on-site loop for an MDCX plant: install the stack, watch live points, work alarms into tickets, and keep the plant in a known state.
Reads are always on. You query by path, you acknowledge alarms, you move tickets. Writes are a separate, gated flow — see controlled writes.
Installation
Start with one site. The start envelope is C21. The site stack is designed to run as a full operations loop on that installation: gateway and drivers, local store, alarm engine, and the site API used by the CLI and the ops portal.
Published ports bind locally by default. Bring-up is power, network, and load the stack; you do not need a cloud path for the operations loop. Offline autonomy is C20.
When you grow beyond one site, a fleet plane registers sites, ingests an uplink from each, and serves a superset of the site API. Each site still runs its own stack. Fleet does not replace the site — it aggregates it. Site-to-cloud traffic is outbound only.
Backup and restore cover the site database and the telemetry store. Retention of backup artifacts is the operator's job.
Dashboards and data
Every live value is a path. Query by path or glob from the CLI (cios query) or the site API. Dashboards project the same paths; they are views, not a second naming scheme.
Raw telemetry stays on site. When a fleet plane is in use it holds downsampled telemetry plus the full alarm, event, and ticket stream. On-demand raw history is requested back from the site.
Usage measurement (meter readings and usage records) is part of the operations loop. Pricing, invoices, and ERP are not.
Alarms
Alarms have four severities:
| Severity | Meaning |
|---|---|
| Critical | Plant, data, or people at immediate risk — act now |
| Major | Function impaired or redundancy lost — act soon |
| Minor | Degraded but running — handle in working hours |
| Info | Notice only — no action required |
A firing alarm is acknowledged, then resolved when the condition clears. During a maintenance window, alarms under that asset path are suppressed so planned work does not open noise tickets.
Tickets and maintenance
A firing alarm can open a ticket (one active alarm maps to at most one open ticket). Ticket states are open → acknowledged → resolved → closed. You cannot skip backwards. Notes append; they are not edited away.
Maintenance work sits next to tickets:
- Maintenance windows suppress alarms on the path being worked
- Inspections are scheduled checks against an asset path
- Spares track the part that will occupy a slot after a swap
- PM schedules fire from run-hours and calendar, not from tribal knowledge
The path stays the slot; the serial moves with the physical device. A replacement writes an occupancy change — telemetry history on the path continues.