Modernize the plant's software without taking the line down.
OT/IT integration, SAP and MES migrations, and legacy-to-cloud cutovers engineered around the reality that every minute of unplanned downtime has a dollar figure attached.
Most manufacturing modernization programs stall the same way: the plant can't afford the cutover the architecture demands.
A vendor sells a cloud migration and an ERP refresh. The slide deck looks clean. Then someone asks how the new system will talk to the Rockwell PLCs, the Wonderware historian, the SAP IDoc partner profiles, and the homegrown labor-reporting app written in 2008. Suddenly the program needs a 72-hour outage window the plant will never approve, because that line bills $40K an hour. The program slips a year, then two, then becomes a permanent hybrid mess where nobody trusts either system as the source of truth.
- ▸ Cutover plan assumes a maintenance window the plant will never grant on a 24/7 line running at 85%+ OEE.
- ▸ Nobody mapped the IDoc, BAPI, and OPC UA touchpoints, so integration discovery happens during go-live instead of before it.
- ▸ MES and SCADA changes get treated as IT tickets, then break interlock logic the controls engineers signed off on years ago.
- ▸ Rollback plan is a Confluence page titled 'Rollback Plan' with three bullet points and no rehearsal.
Modernize around the line, not against it. The plant runs whether your migration is ready or not.
- STEP-01
Map the OT/IT seam first
Before touching code, we document every PLC, historian (PI, Ignition, Wonderware), MES handoff, and SCADA tag that crosses into IT. We tag each integration by criticality, latency budget, and what breaks the line if it goes silent for 30 seconds.
- STEP-02
Strangle the monolith, don't replace it
We put a façade in front of the legacy system — usually a Kafka or MQTT broker plus a thin API gateway — and migrate one bounded context at a time. Order release, quality holds, and labor reporting move independently. The ERP cutover becomes 12 small cutovers, not one weekend.
- STEP-03
Shadow-run before you cut
New services run in shadow mode against live OPC UA and SAP IDoc traffic for 2-4 weeks. We diff every transaction. If the new path disagrees with the legacy path on a single material movement or work order confirmation, it doesn't get promoted. Period.
- STEP-04
Cutover during a planned downtime window
We schedule the irreversible steps — DNS flips, MES database promotions, IDoc partner profile changes — inside an existing maintenance window. Rollback scripts are written and rehearsed before the window opens. We've never used 'we'll figure it out live' as a plan.
- STEP-05
Hand off with runbooks plant ops can actually use
Your controls engineers and IT ops team get printed runbooks, Grafana dashboards tied to OEE-relevant signals, and on-call rotation coverage from us for 30-90 days post-cutover. No knowledge transfer over Zoom and a wiki dump.
# Shadow-mode comparator for SAP IDoc -> new order service
# Runs in parallel during cutover. Flags any divergence before we promote.
import hashlib
import logging
from dataclasses import dataclass
log = logging.getLogger("shadow.cutover")
@dataclass
class OrderEvent:
work_order: str
material: str
qty: float
plant: str
posting_date: str
def canonical_hash(evt: OrderEvent) -> str:
payload = f"{evt.work_order}|{evt.material}|{evt.qty:.3f}|{evt.plant}|{evt.posting_date}"
return hashlib.sha256(payload.encode()).hexdigest()
def compare(legacy: OrderEvent, candidate: OrderEvent) -> bool:
if canonical_hash(legacy) == canonical_hash(candidate):
return True
log.error(
"DIVERGENCE wo=%s legacy=%s candidate=%s",
legacy.work_order, legacy, candidate,
)
# Block promotion. Page the on-call. Do not auto-resolve.
raise CutoverDivergence(legacy.work_order)
class CutoverDivergence(Exception):
pass
Shadow-mode diffing is the only honest way to validate a new MES or ERP path against live plant traffic before flipping production.
Field FAQ.
→ How do you modernize an ERP like SAP ECC without halting production?
We don't do weekend big-bang cutovers on plants that run 24/7. The pattern is event-driven decoupling: put a message broker between SAP and the floor, mirror IDocs and BAPIs into a canonical event stream, and migrate consumers one at a time. S/4HANA or a custom replacement comes online behind the broker. The plant keeps posting to the same interface contract while we swap what's behind it. Cutover risk drops from a single high-stakes weekend to dozens of low-stakes promotions.
→ What's the real cost of an hour of unplanned downtime during migration?
Depends on the line, but in discrete manufacturing we typically see $10K-$50K per hour for mid-volume plants and well over $100K/hour for automotive, semiconductor, or pharma. That number drives every architectural choice we make: shadow-running, blue/green deploys at the integration layer, manual rollback rehearsals, and a hard rule that no irreversible step happens outside a planned maintenance window. If your finance team can quote the per-minute number, your migration plan should reference it explicitly.
→ Can you integrate with our existing MES and SCADA without ripping them out?
Yes — and usually that's the right call. MES platforms like Rockwell FactoryTalk, Siemens Opcenter, GE Proficy, and Ignition are deeply wired into PLC logic and operator workflows. We integrate via OPC UA, MQTT Sparkplug B, ISA-95 message schemas, or direct database reads where the vendor supports it. Modernization usually means surrounding MES/SCADA with better APIs, observability, and analytics — not replacing the system that's controlling the line.
→ Do you handle OT/IT network segmentation and security during cutover?
We design to the Purdue model and stay on the right side of it. New services live in the IT/DMZ layers and talk to OT through hardened brokers, data diodes where required, or vendor-approved gateways. We don't put cloud agents on Level 2 controllers. For regulated environments — defense, pharma, food — we align with NIST 800-82, IEC 62443, and any plant-specific change control. Your controls engineers stay in the loop on every firewall rule.
→ What does staff augmentation look like for a plant modernization project?
Typically 2-5 senior engineers embedded with your team for 3-9 months. We bring people who have shipped SAP integrations, MES interfaces, and cloud migrations in industrial environments — not generalists who'll learn on your dime. They work inside your Jira, your Git, your change control. Day one they're reading PLC logic and IDoc segment definitions, not asking what an OEE metric is. We rotate out as your team picks up ownership.
→ Are you eligible for federal and defense manufacturing contracts?
Yes. VooStack is SDVOSB-certified and veteran-owned, which makes us eligible for set-aside contracts under FAR 19.1405 and sole-source awards up to the SDVOSB threshold. We've worked inside environments that require CMMC alignment, ITAR handling, and DFARS 7012 compliance. For defense industrial base (DIB) manufacturers and DoD-adjacent suppliers, that procurement path is often faster than going through a large prime. Reach out and we'll walk through your specific contracting vehicle.
→ How long does a typical manufacturing modernization engagement run?
Discovery and architecture: 4-8 weeks. First production cutover of a bounded context (e.g., labor reporting or quality holds): another 8-12 weeks. Full ERP or MES modernization across multiple plants: 12-24 months, sequenced plant by plant. We don't quote 6-week 'digital transformations' for industrial environments — that's how you end up with a stalled program and a finance team asking what they paid for. Realistic timelines, written down, with go/no-go gates.
→ Where does AI integration actually help on the plant floor?
Narrow, well-defined places: anomaly detection on historian data, RAG over maintenance manuals and SOPs for technician copilots, vision QA on discrete parts, and document extraction from supplier PDFs and COAs. We don't recommend LLMs in any control loop or any path that affects safety interlocks. The honest ROI is in the IT layer adjacent to OT — reducing the time technicians spend hunting for tribal knowledge, not replacing PLCs with prompts.
→ What happens if the cutover goes sideways?
Rollback scripts are written, reviewed, and dry-run before the maintenance window opens. We define explicit go/no-go criteria — IDoc throughput, MES handshake latency, order-release round-trip time — measured at fixed checkpoints during the window. If any threshold misses, we roll back inside the window and regroup. We've never had to invent a recovery plan at 2 a.m. on a Sunday, and we're not going to start on your line.
Continue recon.
Modernization services
How we approach legacy-to-cloud migrations across regulated and industrial environments.
REL-02Past engagements
Cutover patterns and outcomes from prior ERP, MES, and integration projects.
REL-03Engagement packages
Fixed-scope discovery, shadow-run, and cutover packages with defined deliverables.
REL-04Scope a project
Talk to an engineer about your plant, your ERP, and your cutover constraints.
Planning a plant-floor modernization where downtime isn't an option? Let's scope it.
Talk to a VooStack operator. We respond within one business day.