Moving an 11-line production data website to a central server for an automotive parts manufacturer in Thailand

How the brief came about

The challenge in this case was to let office users open production data again after the factory separated its office network from its production line network. The separation was made through an iDMZ firewall (a buffer network zone between the office and the production lines), in line with the IT department's security policy.

Before the separation, the DTS web (Datasystem, the factory's production data website) and each line's Baratsuki KPI page were located on computers in the production lines. Office users opened these pages directly from the line computers. After the separation, the old way of access no longer worked and breached the IT department's policy.

Requirements and constraints

The new system had to work under the factory's network policy. The main requirements and constraints were as follows.

• DTS on the server must still receive data from client machines on 11 production lines as before
• Users must reach the Baratsuki KPI pages through DTS as the single channel, without connecting directly to line computers
• The system must be installed on Windows Server, IIS and an MS SQL Server database on the customer's VMware server
• The customer's IT department sets the IP Addresses, ports and installation rights on the server

Why move the existing website to a central server instead of opening access to the line computers?

Because direct access to line computers breaches the factory's security policy, whereas the central server is a point the IT department can control. The line computers still collect data as before. What changes is where the website is located and the route users take to reach it. The main steps of this approach are as follows.

1. 1

   Move DTS to the VMware server

   Install the DTS web on a virtual machine on the factory's VMware server, using Windows Server, IIS and an MS SQL Server database, instead of keeping it on a line computer.

2. 2

   Receive data from production lines as before

   Adjust the IP Addresses so that client machines on 11 production lines send data to DTS on the new server.

3. 3

   Select a line, then open its KPI page

   The line selection page on DTS lets users click the line they need, then opens that line's Baratsuki KPI page in a new tab, to view and manage data through the central server.

Deliverables

The deliverables are divided into the main work accepted by the customer and the additional configuration work afterwards. The items are as follows.

• Main work: the DTS web on a virtual machine on the factory's VMware server, with a line selection page
• Main work: project documents
• Additional work: configuring IIS as a Reverse Proxy with an SSL certificate, so that production line KPI pages can be opened through an HTTPS domain name, and a configuration guide

Work steps

This work ran from late 2022 to late 2023. The sequence was as follows.

1. Late 2022: the customer summarised the network situation and goals, and we then prepared a requirements document for the web app
2. May 2023: DTS installed on the central server, and the customer signed acceptance of the work
3. Late 2023: Reverse Proxy configured together with the customer's IT department, using the domain names set by the IT department, and a configuration guide prepared

Confirmed results

The confirmed result is acceptance of the work. An automotive parts manufacturer in Thailand signed acceptance of the move of its production data website to a VMware server, within a scope of 11 production lines, in May 2023. The evidence is the delivery and acceptance document signed by the customer and the Reverse Proxy configuration guide we prepared in late 2023.

This page reports only the delivery and acceptance of the work. It contains no usage figures or business results and does not cover the current usage status of the system.

What we learned

The main lesson from this work is that network tasks with the IT department determine the project timeline. The principles drawn from this work are as follows.

• When the IT department sets the IP Addresses, ports and installation rights, the work plan must include the IT department's steps from the start, and the team should include a network specialist
• When line computers can still collect data normally, fix the access route first and keep the existing data collection method in the line
• A single entry point must start from a complete list of machines. Every line needs a name, an IP Address and the name used to open its web page, so that the configuration of each line can be checked item by item

Can you use this approach in your factory?

Yes, if your factory has separated its office network from its production lines and existing systems on line computers cannot be opened from the office. The reusable part is moving the existing website to a central server and having users enter through a single entry point. What needs adapting depends on your servers, existing systems and network policy.

Before starting, please also check the following.

• Whether other functions of the existing system, such as sending email, can still use the same ports after the network move
• Whether the acceptance criteria have been clearly agreed with the parties concerned