Industrial control systems architect · Industrial AI · IEC 62443
Aradh Suresh
Industrial data that can be diffed, tested, and trusted next to a control system.
Sixteen years inside industrial control systems — panel-level commissioning, PLC programming, SCADA, and the OT/IT boundary where plant data stops being the plant's problem and starts being everyone else's.
I now work on that boundary at the level where it is actually decided: architecture. That means the data layer a plant can trust downstream, the industrial AI that sits beside control rather than inside it, and the zone-and-conduit security model IEC 62443 asks for, which most estates have only in part.
I build the reference stacks end to end, measure them under load, publish the numbers including the runs that contradicted what I expected, and write the argument that follows from them.
- years in control systems
- 16
- essays published
- 52
- instrumented builds
- 33
- products shipped solo
- 4
Career
Fifteen years, in order.
2025 —
Nov 2025 — present
Nov 2025 — present
Independent architect, writer, builder
Synopse Technologies · Remote
Left full-time employment to work on industrial data architecture in the open. The output is deliberately two-sided: instrumented builds that produce numbers, and essays that make the argument those numbers support. Both are public, and the builds that failed are published as readily as the ones that worked.
- Reference stacks built and measured end to end: Ignition on k3s, a SCADA fleet generated from one repository, Sparkplug B interoperability, a Unified Namespace assembled from parts, TimescaleDB and ClickHouse under a ten-million-reading load.
- Comparative decisions published with the measurement attached — Redpanda Connect against Node-RED, ClickHouse against TimescaleDB, Proxmox against VMware. Two of them found that the rig, not the software, was what I had actually measured.
- Production multi-tenant SaaS shipped solo: Next.js, Supabase/PostgreSQL with row-level security, Vercel, Playwright and Vitest gates, Sentry, nightly encrypted backups with a tested restore path.
- AI placed next to control without a write path. A tag copilot and an energy-systems copilot answer questions against live plant data, and are read-only by construction rather than by policy.
- Upstream contributor to FUXA (open-source SCADA): a permissions guard merged into the project.
2014
2014 — Oct 2025
2014 — Oct 2025
Senior SCADA Engineer
Empower, Dubai · Dubai, UAE
Responsible for the automation, SCADA and OT security estate, and for the engineers and the projects that changed it. The work ran in two directions at once: keeping a very large installed base running, and leading the security and digitalisation programmes that modernised it.
- Estate scale: 70+ plants, roughly 1,200–1,500 PLC systems, 100+ SCADA systems, around 600 protocol gateways and 1,200 meters — a distributed estate carrying more than 400,000 tags, brought together in a central command and control centre.
- Led a team of engineers, and owned the project side with it — scope of work, tender documentation, vendor evaluation and delivery management for the security and digitalisation programmes.
- Multi-protocol integration across Modbus, BACnet, EtherNet/IP and OPC, plus the rest of the mix a heterogeneous estate accumulates over two decades.
- OT security programme: IEC 62443 alignment, firewall and segmentation design, security auditing, threat detection, centrally managed antivirus, and automated patching across assets that cannot simply be rebooted.
- Virtualised the SCADA and historian infrastructure on VMware ESXi — consolidation, snapshots and a real recovery path for systems that had been running on individual machines.
- The estate itself was principally Rockwell. On top of it I built the IIoT monitoring layer — MQTT with Sparkplug B, time-series storage, Grafana — and Python acquisition against Allen-Bradley controllers reading 600 addresses in 40 ms via pylogix.
- Alarm management, and geospatial asset mapping of the estate in GeoPandas and Folium.
2018
2018 — 2019
2018 — 2019
Data science, deliberately
A parallel track rather than a pivot: Python, Pandas, time-series analysis and machine-learning fundamentals, applied straight back into the industrial domain — pump-health monitoring, compliance analytics, geospatial mapping. It is the reason the later work reaches for a measurement instead of an opinion.
2012
2012 — 2014
2012 — 2014
Project Engineer
Larsen & Toubro (L&T) · Dubai, UAE
Straight controls work, and the years that put the hours in: PLC programming and commissioning, SCADA integration, application development, and the reporting layer on top. Nothing written on this site treats the plant floor as an abstraction, and this is why.
2010
2010 — 2012
2010 — 2012
Application Engineer
Masseera Industrial Automation · Dubai, UAE
Where it started. PLC and SCADA application engineering across the vendor platforms an integrator sees in rotation, which is the fastest way there is to learn that no two plants agree on anything.
Evidence
Five things I claim, and where to check.
A CV asserts; a link can be audited. Every capability below points at work you can read in full — the measurement, the method, and the verdict, including the ones that went against me.
Fleet thinking
Designing for the second, tenth and hundredth site rather than the first one. Configuration generated from a repository, sites reproducible from version control, blast radius understood before it is needed.
Comparative judgment
Choosing between two credible options under real constraints, with the cost of being wrong stated. Most of these end without a winner, which is usually the honest answer.
- EssayNode-RED didn't break at 20,000 messages a second. It broke when the database did.
- EssayTwo databases for a plant historian, and why neither one wins
- EssayBroadcom made the case for Proxmox better than Proxmox ever could
- LabDoes your plant need a whole layer just for context? I tested HighByte to find out
Failure-mode literacy
The rarest of the five, and the one that keeps plants running: knowing how a pipeline lies to you while every container stays green. Alarm on staleness, not liveness. Prove the alarm fires.
- EssayYou don't have a backup problem. You have a reproducibility problem.
- EssayTest your historian with made-up numbers and it will lie to you about disk
- EssayI built a Unified Namespace myself. A third of the plant was invisible.
- LabTen million plant readings on one small box, and the mistake that cost 5.6×
OT security, defensively
Protocol exposure demonstrated on a wire I control, then written up as what to do about it — never as a recipe. The point is the mitigation, and the mitigation is almost always the network.
AI adjacent to control
Language models given real plant context and no write path. Where the model fails, the finding is that the tool was wrong — schema, units, staleness — long before the model was.
Capability
What I work with.
Industrial & OT
- PLC — Allen-Bradley, Siemens, ABB, Schneider
- SCADA / HMI — Ignition, FUXA, N3uron
- OPC UA & OPC DA
- Modbus TCP/RTU, BACnet, EtherNet/IP, S7comm
- Alarm management (ISA-18.2)
- IEC 62443 zone-and-conduit modelling, OT/IT boundary design
Data & streaming
- MQTT, Sparkplug B, HiveMQ, EMQX
- Kafka, Redpanda, Redpanda Connect
- Unified Namespace design
- TimescaleDB, ClickHouse, InfluxDB
- Prometheus, Grafana, Telegraf
- Node-RED, HighByte, United Manufacturing Hub
Platform & infrastructure
- Kubernetes (k3s), Docker, Compose
- Proxmox, LXC, virtualisation on the plant floor
- Ansible, infrastructure as code
- Linux, networking, TLS and certificate handling
- Backup, restore and disaster-recovery drills
- Observability and staleness alarming
Software & AI
- TypeScript, Next.js, React, Node
- Python — pylogix, Pandas, Flask, GeoPandas
- PostgreSQL, Supabase, row-level security
- Playwright, Vitest, CI gates
- LLM tooling, MCP servers, agent harnesses
- Industrial AI architecture — grounding, provenance, read-only tool design
- Evaluation harnesses for AI over plant data
Shipped
Software I built and operate.
Multi-tenant products designed, built, deployed and supported solo — the part of the work that keeps the architecture honest, because I am also the one on the other end of the support message.
PlayOps
Visit ↗SaaS for indoor play centres — admissions, sessions, billing, multi-tenant by construction.
Live · paying customers
MeterSnap
Visit ↗Meter-reading and billing intelligence for utility operations in the UAE.
Piloting · demo version
BoothManager
Visit ↗Ground-level election operations software, built as a community project for a single constituency — my own — and genuinely useful through a 2026 regional election cycle.
Community project · no commercial obligation
Credentials
Education and contributions.
Education
- BTech, Electronics & Communication EngineeringRajiv Gandhi Institute of Technology (RIT) · 2005 – 2009Final-year project on condition monitoring, carried out with ISRO.
Open source & community
- FUXA — open-source SCADA
Upstream contributor. A permissions guard for client access shipped as a merged pull request; two further issues open, one of them on making project files diffable in git.
PR #2478 ↗ - Public build repositories
The rigs behind the lab pieces — telemetry simulators, fleet-as-code templates, protocol capture harnesses — published so the measurements can be reproduced or contradicted.
github.com/aradhsai ↗ - Writing, on a schedule
Essays and instrumented builds published continuously since mid-2026, cross-linked so an argument always reaches its evidence. Available by RSS and email.
Read the writing ↗
Off the clock
Away from the plant floor.
I live with my wife and our son, after years in Dubai. Most of what I know about patience I learned from a six-year-old and a stubborn PLC, in roughly that order.
I read across investing, psychology and long historical fiction — Housel and Greenwald on one shelf, Ken Follett on the other. Currently working through Bruce Greenwald on value investing, and a parenting book that is winning more arguments than I am.
Through late 2026 I am running a structured programme on evaluation harnesses, OPC UA information modelling, and governance for AI that sits near control systems. Each phase ships as a public build and a decision record, because the only way I trust a thing is to have built it and written down what it cost.
Hiring for the OT/IT boundary? Or arguing with something here?
Both are welcome, and I answer both. If you think something on this site is wrong, that is the more interesting message.