Industrial control systems architect · Industrial AI · IEC 62443

Aradh Suresh

Industrial data that can be diffed, tested, and trusted next to a control system.

Sixteen years inside industrial control systems — panel-level commissioning, PLC programming, SCADA, and the OT/IT boundary where plant data stops being the plant's problem and starts being everyone else's.

I now work on that boundary at the level where it is actually decided: architecture. That means the data layer a plant can trust downstream, the industrial AI that sits beside control rather than inside it, and the zone-and-conduit security model IEC 62443 asks for, which most estates have only in part.

I build the reference stacks end to end, measure them under load, publish the numbers including the runs that contradicted what I expected, and write the argument that follows from them.

years in control systems
16
essays published
52
instrumented builds
33
products shipped solo
4
2010 – 2014Controls & commissioningApplication then project engineer, Dubai
2014 – 2025Estate, security & digitalisationSenior SCADA engineer leading a team, Dubai
2025 – nowArchitecture, writing, productIndependent

Career

Fifteen years, in order.

Nov 2025 — present

Independent architect, writer, builder

Synopse Technologies · Remote

Left full-time employment to work on industrial data architecture in the open. The output is deliberately two-sided: instrumented builds that produce numbers, and essays that make the argument those numbers support. Both are public, and the builds that failed are published as readily as the ones that worked.

  • Reference stacks built and measured end to end: Ignition on k3s, a SCADA fleet generated from one repository, Sparkplug B interoperability, a Unified Namespace assembled from parts, TimescaleDB and ClickHouse under a ten-million-reading load.
  • Comparative decisions published with the measurement attached — Redpanda Connect against Node-RED, ClickHouse against TimescaleDB, Proxmox against VMware. Two of them found that the rig, not the software, was what I had actually measured.
  • Production multi-tenant SaaS shipped solo: Next.js, Supabase/PostgreSQL with row-level security, Vercel, Playwright and Vitest gates, Sentry, nightly encrypted backups with a tested restore path.
  • AI placed next to control without a write path. A tag copilot and an energy-systems copilot answer questions against live plant data, and are read-only by construction rather than by policy.
  • Upstream contributor to FUXA (open-source SCADA): a permissions guard merged into the project.
IgnitionKubernetesMQTT / Sparkplug BKafka / RedpandaOPC UATimescaleDBClickHouseAnsibleProxmoxTypeScriptPython

2014 — Oct 2025

Senior SCADA Engineer

Empower, Dubai · Dubai, UAE

Responsible for the automation, SCADA and OT security estate, and for the engineers and the projects that changed it. The work ran in two directions at once: keeping a very large installed base running, and leading the security and digitalisation programmes that modernised it.

  • Estate scale: 70+ plants, roughly 1,200–1,500 PLC systems, 100+ SCADA systems, around 600 protocol gateways and 1,200 meters — a distributed estate carrying more than 400,000 tags, brought together in a central command and control centre.
  • Led a team of engineers, and owned the project side with it — scope of work, tender documentation, vendor evaluation and delivery management for the security and digitalisation programmes.
  • Multi-protocol integration across Modbus, BACnet, EtherNet/IP and OPC, plus the rest of the mix a heterogeneous estate accumulates over two decades.
  • OT security programme: IEC 62443 alignment, firewall and segmentation design, security auditing, threat detection, centrally managed antivirus, and automated patching across assets that cannot simply be rebooted.
  • Virtualised the SCADA and historian infrastructure on VMware ESXi — consolidation, snapshots and a real recovery path for systems that had been running on individual machines.
  • The estate itself was principally Rockwell. On top of it I built the IIoT monitoring layer — MQTT with Sparkplug B, time-series storage, Grafana — and Python acquisition against Allen-Bradley controllers reading 600 addresses in 40 ms via pylogix.
  • Alarm management, and geospatial asset mapping of the estate in GeoPandas and Folium.
RockwellAllen-BradleyVMware ESXiModbusBACnetEtherNet/IPOPCIEC 62443MQTT / Sparkplug BGrafanaInfluxDBPython

2018 — 2019

Data science, deliberately

A parallel track rather than a pivot: Python, Pandas, time-series analysis and machine-learning fundamentals, applied straight back into the industrial domain — pump-health monitoring, compliance analytics, geospatial mapping. It is the reason the later work reaches for a measurement instead of an opinion.

2012 — 2014

Project Engineer

Larsen & Toubro (L&T) · Dubai, UAE

Straight controls work, and the years that put the hours in: PLC programming and commissioning, SCADA integration, application development, and the reporting layer on top. Nothing written on this site treats the plant floor as an abstraction, and this is why.

2010 — 2012

Application Engineer

Masseera Industrial Automation · Dubai, UAE

Where it started. PLC and SCADA application engineering across the vendor platforms an integrator sees in rotation, which is the fastest way there is to learn that no two plants agree on anything.

ABB AC500ABB 800xAFactoryTalkWinCCModbus

Evidence

Five things I claim, and where to check.

A CV asserts; a link can be audited. Every capability below points at work you can read in full — the measurement, the method, and the verdict, including the ones that went against me.

Fleet thinking

Designing for the second, tenth and hundredth site rather than the first one. Configuration generated from a repository, sites reproducible from version control, blast radius understood before it is needed.

Failure-mode literacy

The rarest of the five, and the one that keeps plants running: knowing how a pipeline lies to you while every container stays green. Alarm on staleness, not liveness. Prove the alarm fires.

OT security, defensively

Protocol exposure demonstrated on a wire I control, then written up as what to do about it — never as a recipe. The point is the mitigation, and the mitigation is almost always the network.

AI adjacent to control

Language models given real plant context and no write path. Where the model fails, the finding is that the tool was wrong — schema, units, staleness — long before the model was.

Capability

What I work with.

Industrial & OT

  • PLC — Allen-Bradley, Siemens, ABB, Schneider
  • SCADA / HMI — Ignition, FUXA, N3uron
  • OPC UA & OPC DA
  • Modbus TCP/RTU, BACnet, EtherNet/IP, S7comm
  • Alarm management (ISA-18.2)
  • IEC 62443 zone-and-conduit modelling, OT/IT boundary design

Data & streaming

  • MQTT, Sparkplug B, HiveMQ, EMQX
  • Kafka, Redpanda, Redpanda Connect
  • Unified Namespace design
  • TimescaleDB, ClickHouse, InfluxDB
  • Prometheus, Grafana, Telegraf
  • Node-RED, HighByte, United Manufacturing Hub

Platform & infrastructure

  • Kubernetes (k3s), Docker, Compose
  • Proxmox, LXC, virtualisation on the plant floor
  • Ansible, infrastructure as code
  • Linux, networking, TLS and certificate handling
  • Backup, restore and disaster-recovery drills
  • Observability and staleness alarming

Software & AI

  • TypeScript, Next.js, React, Node
  • Python — pylogix, Pandas, Flask, GeoPandas
  • PostgreSQL, Supabase, row-level security
  • Playwright, Vitest, CI gates
  • LLM tooling, MCP servers, agent harnesses
  • Industrial AI architecture — grounding, provenance, read-only tool design
  • Evaluation harnesses for AI over plant data

Shipped

Software I built and operate.

Multi-tenant products designed, built, deployed and supported solo — the part of the work that keeps the architecture honest, because I am also the one on the other end of the support message.

PlayOps

Visit ↗

SaaS for indoor play centres — admissions, sessions, billing, multi-tenant by construction.

Live · paying customers

Seatroom

Visit ↗

Seat and membership management for study spaces.

Live · pilot operators

MeterSnap

Visit ↗

Meter-reading and billing intelligence for utility operations in the UAE.

Piloting · demo version

BoothManager

Visit ↗

Ground-level election operations software, built as a community project for a single constituency — my own — and genuinely useful through a 2026 regional election cycle.

Community project · no commercial obligation

Credentials

Education and contributions.

Education

  • BTech, Electronics & Communication EngineeringRajiv Gandhi Institute of Technology (RIT) · 2005 – 2009Final-year project on condition monitoring, carried out with ISRO.

Open source & community

  • FUXA — open-source SCADA

    Upstream contributor. A permissions guard for client access shipped as a merged pull request; two further issues open, one of them on making project files diffable in git.

    PR #2478
  • Public build repositories

    The rigs behind the lab pieces — telemetry simulators, fleet-as-code templates, protocol capture harnesses — published so the measurements can be reproduced or contradicted.

    github.com/aradhsai
  • Writing, on a schedule

    Essays and instrumented builds published continuously since mid-2026, cross-linked so an argument always reaches its evidence. Available by RSS and email.

    Read the writing

Off the clock

Away from the plant floor.

I live with my wife and our son, after years in Dubai. Most of what I know about patience I learned from a six-year-old and a stubborn PLC, in roughly that order.

I read across investing, psychology and long historical fiction — Housel and Greenwald on one shelf, Ken Follett on the other. Currently working through Bruce Greenwald on value investing, and a parenting book that is winning more arguments than I am.

Through late 2026 I am running a structured programme on evaluation harnesses, OPC UA information modelling, and governance for AI that sits near control systems. Each phase ships as a public build and a decision record, because the only way I trust a thing is to have built it and written down what it cost.

Hiring for the OT/IT boundary? Or arguing with something here?

Both are welcome, and I answer both. If you think something on this site is wrong, that is the more interesting message.