The challenge
The bakery's food safety system lived on paper. Bake temperatures were logged by hand, HACCP checks sat in binders, and batch identity dissolved somewhere between goods-in and the van. The recall plan was a phone tree. An EHO visit meant a week of assembling evidence that should have assembled itself.
Our approach, level by level
On the Purdue reference model: level 0 and 1 stay the bakery's own (ovens, probes, the PLC on the packing line). A connector runner, the only software that touches the control network, speaks Modbus and reader host-mode at level 2 and forwards one way. Level 3 execution runs the lines, stations and in-line quality; level 4 carries procurement, orders and the ledger. One data path, so a bake temperature excursion and its financial consequence are the same record seen from two floors.
HACCP stopped being a binder: critical control points are mandatory steps on the processes themselves, timed to when they matter (per batch, on changeover, daily), and the system refuses the shortcut: an unticked mandatory end-of-shift step blocks the handover; a held batch never reaches finished goods.
What the inspector sees
Every raw batch is recorded at consumption, so the drill runs live: name a suspect flour or butter batch and the trace returns the supplier, the goods receipt, when it was consumed, the finished batches in the exposure window, and every shipment and customer after it, with a verdict. The audit report generates from live records, chain-verified, with the HACCP register and dispositions inside it.
The outcome
The recall drill went from theoretical to routine. The EHO evidence pack became a button. And the bakers got their afternoons back, because the paperwork now writes itself as a by-product of the work.