--- title: "Terminal Automation System Architecture: 4 Layers | Citia" description: "Terminal automation system architecture has four layers: field, control, application and enterprise. See the links, failure modes and network segmentation." url: https://citia-engineering.com/en/knowledge/tas-architecture language: en updated: 2026-11-13 type: article site: Citia Engineering Indonesia --- # Terminal automation system architecture: field, control, application and enterprise layers TAS architecture has four layers, from field devices to ERP. See how they connect, what fails at each layer, where redundancy pays and how to segment the network. | Field | Value | | --- | --- | | Topic | Engineering Practice | | Author | Tim Engineering Citia | | Updated | 2026-11-13 | Key takeaways Terminal automation system (TAS) architecture consists of four layers: field devices (meters, valves, tank gauges, sensors), controllers (batch controllers, PLCs), terminal applications (TAS, TMS, gate) and enterprise systems (ERP, reporting), each needing its own interfaces and failure plan. Drawing those layers is easy. Deciding which layer owns which decision, and what happens when the link between two layers breaks, is the real design work. The INTEGRA TAS product page shows one implementation of this chain, and the article on TAS, TMS and TPS explains how the application layer is divided. - TAS architecture has four layers: field devices, controllers, terminal applications and enterprise systems, and each layer needs its own interfaces and failure plan. - The ISA-95 model (IEC 62264) places the TAS at Level 3, between plant control at Level 2 and ERP at Level 4. - Safety and the running batch belong to the lower layers, so a loading can stop safely even when the server or network above it fails. - Network boundaries between layers are the natural place for firewalls; IEC 62443-3-3 sets system security requirements and security levels for them. ## The four layers and how they connect Data moves up from the field and commands move down from the applications. Each arrow in the diagram is an interface that needs a protocol, an owner and a rule for what happens when it stops. At the bottom, meters send pulses to batch controllers and tank gauges send levels to a gateway, often over Modbus. Controllers talk to the TAS over serial or Ethernet links. The TAS and TMS exchange orders, results and stock with the ERP over an application interface. Every protocol change is a translation point, and translation points are where data is lost or misread. - Flow meter: Measures loaded volume at each arm. - Tank gauge: Reads level and temperature in each tank. - RFID reader: Identifies trucks and drivers at gate and bay. - Batch controller: Runs each loading to its preset. - PLC: Pumps, valves, interlocks and permissives. - Gateway: Polls gauges and normalises their data. - TAS: Orders, queue, authorization, transactions. - TMS: Tank stock, history and tank tickets. - ERP: Orders in, results and stock postings out. ## Where a TAS sits in the ISA-95 model ISA-95, also published as IEC 62264, is the common reference for splitting plant systems into levels. It describes five levels from the physical process (Level 0) to business planning and logistics (Level 4), and deals mainly with the interface between Levels 3 and 4. A TAS fits Level 3, the operations layer, together with SCADA and the TMS. Batch controllers and PLCs sit at Level 2, sensors and valves at Level 1, and the ERP at Level 4. Using the same numbers in your drawings helps when IT and OT teams discuss who owns which server and which network. - Level 4: Business planning and logistics: ERP - Level 3: Operations management: TAS, TMS, SCADA - Level 2: Monitoring and supervisory control: PLC, batch controller - Level 1: Sensing and manipulating: meters, valves, sensors - Level 0: Physical process: tanks, pumps, product ## What fails at each layer, and what keeps running Each layer fails differently, so each needs its own answer to the question of what keeps running. The table gives the usual pattern. - Field: Meter drift, sensor fault, loose pulse cable | Other bays and tanks | Diagnostics in the controller, spare devices - Control: Controller or PLC fault, power loss | Safe stop at the affected bay | UPS, fail-safe outputs, tested backups - Application: Server or network down | Running batches finish or stop safely | Standby server, local buffering, restore drill - Enterprise: ERP link down | Loading against received orders | Queued postings with retry and reconciliation ## Redundancy: where it pays and where it does not Redundancy is worth paying for where one failure stops the whole terminal, and rarely elsewhere. A single bay controller failing stops one bay; a single TAS server failing can stop all of them. That is why the TAS server, its database and the core network switch are the usual candidates for a standby. Power is the other common single point: a PLC panel without a UPS turns a short outage into a restart of every bay. Citia's UPS installation for PLC panels at the Donggala depot added UPS and automatic transfer switch units so the safety and process control panels stay powered while supply moves between the PLN grid and the generator. Redundancy only helps if switchover is tested; an untested standby server often fails on the day it is needed. Field tip: label the rack before you need it: In the LPG Panjang support work, untidy wiring in the server rack made cable tracing slow during faults, and the team tidied and labelled it in stages. Ask for a labelled rack and an as-built network drawing as part of handover. ## Network segmentation and IEC 62443 The boundaries between layers are the natural places to control traffic. A firewall between the application layer and the enterprise network stops an office problem from reaching the filling shed. IEC 62443-3-3:2013 sets system security requirements for industrial control systems, tied to seven foundational requirements, and defines security levels a system can reach. The wider ISA/IEC 62443 series assigns shared responsibility to asset owners, product suppliers, integrators and service providers. In practice, a terminal starts with a few steps that need little new hardware. - Draw the zones: Mark which devices belong to field, control, application and enterprise networks. - Place the firewall: Put it between the application layer and the office or ERP network. - Use an exchange zone: Let the ERP and TAS meet on a server in between, not directly. - Control remote access: One controlled entry point, named accounts, sessions logged. - Keep restorable backups: Back up PLC, SCADA and TAS, and test a restore. ## On-premise, edge or cloud A TAS can run fully on site, or split between edge equipment on site and a cloud service. The deciding question is what the terminal must still do when the internet link is down. Citia's INTEGRA CTP , still in development, takes the split approach: gateways and edge software at each site collect data and keep local work going, the cloud layer handles workflows, inventory and documents, and PLC control and safety permissives stay in the local control system. How each site runs when the connection drops is assessed per implementation, which is the right question to ask of any cloud design. Citia's micro webinar on reliable terminals uses the same layered view to diagnose faults, and the PLC/SCADA assessment article explains how to separate equipment, communication and application problems before deciding on replacement. At Pulau Layang , the support scope spans the SCADA system, electrical systems and safety equipment such as motor-operated valves and emergency shutdown valves, which is a reminder that the layers are maintained together. - Where the application runs: Servers at the terminal | Edge at site, workflows in the cloud - Internet outage: No effect on loading | Edge must carry local work until the link returns - Multi-site view: Needs a separate reporting layer | Built in - Site IT effort: Servers, backups and patching at each site | Smaller footprint, more network dependence ## Terms used in this article - ISA-95 / IEC 62264: Standard model that splits plant systems into Levels 0 to 4 and defines the business-to-operations interface. - Layer: A group of systems with the same role, such as control or application. - Gateway: Device that reads field protocols and passes normalised data upward. - Standby server: A second server that takes over when the main one fails. - Network segmentation: Splitting a network into zones with controlled traffic between them. - Edge: Computing equipment at the site that keeps local work running and syncs with the cloud. - Security level: In IEC 62443, a measure of how strongly a system resists attack. ## Frequently asked questions Q: Does a TAS server need redundancy? A: Yes, in most terminals the TAS server should have a tested standby, because its failure can stop every bay at once. Bay controllers usually do not need duplicates, since a single fault stops only one bay. Q: What keeps running when the connection to the ERP is lost? A: Loading against orders already received should keep running when the ERP connection is lost. The TAS queues the results and posts them when the link returns, with a reconciliation report. Q: Where should the firewall be placed in a terminal network? A: The main firewall belongs between the application layer and the enterprise or office network. Many terminals add an exchange zone in between so the ERP and TAS never connect directly. Q: When does a cloud-based TAS make sense? A: A cloud-based TAS makes sense when several sites need one view and the design keeps control and safety local. The edge at each site must be able to carry local work through an internet outage. Q: Which protocols connect the layers of a TAS? A: The layers of a TAS are usually connected by pulses and discrete signals at the bay, Modbus or vendor protocols to controllers and gauges, and application interfaces to the ERP. Each change of protocol needs a tested translation point. ## Sources and further reading 1. ISA-95 Standard: Enterprise-Control System Integration, International Society of Automation (ISA) (https://www.isa.org/standards-and-publications/isa-standards/isa-95-standard) 2. IEC 62443-3-3:2013 System security requirements and security levels, International Electrotechnical Commission (IEC), 2013 (https://webstore.iec.ch/en/publication/7033) 3. ISA/IEC 62443 Series of Standards, International Society of Automation (ISA) (https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards) 4. INTEGRA CTP (Connected Terminal Platform), PT Citia Engineering Indonesia (https://citia-engineering.com/en/products/connected-terminal-platform) 5. Reliable terminals: TAS and control system reliability, PT Citia Engineering Indonesia, 2026-10-23 (https://citia-engineering.com/en/webinars/reliable-terminals-tas-reliability) 6. LTSA for LPG Panjang, PT Citia Engineering Indonesia, 2022 (https://citia-engineering.com/en/projects/ltsa-for-lpg-panjang) 7. Cover photo by Achim Hering, public domain, Wikimedia Commons (https://commons.wikimedia.org/wiki/File:Control_room_pt_tupper.jpg) Reviewing your terminal architecture?: Share a network or system drawing with siTia on WhatsApp, and a Citia engineer will discuss the weak points with you. ## Contact - Company: PT Citia Engineering Indonesia - siTia - Virtual Assistance: [WhatsApp +62 813-2206-507](https://wa.me/628132206507). siTia answers questions about our products, projects and enquiries on WhatsApp. Replies are automated, and a person from the Citia team follows up. - Email: services@citiaengineering.com - Phone / WhatsApp (siTia): +62 813-2206-507 - Location: Bandung, Indonesia [Contact Citia](https://citia-engineering.com/en/contact.md) ## Structured data (JSON-LD) ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://citia-engineering.com/#organization", "name": "Citia Engineering Indonesia", "legalName": "PT Citia Engineering Indonesia", "alternateName": "Citia", "url": "https://citia-engineering.com", "logo": { "@type": "ImageObject", "url": "https://citia-engineering.com/media/citia-logo.png", "width": 950, "height": 328 }, "description": "Citia is an engineering and system integration company in Bandung, Indonesia. We connect field devices, PLC and SCADA, terminal software and enterprise systems, then install, test and maintain them.", "email": "services@citiaengineering.com", "telephone": "+62 813-2206-507", "address": { "@type": "PostalAddress", "addressLocality": "Bandung", "addressRegion": "Jawa Barat", "addressCountry": "ID" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "services@citiaengineering.com", "telephone": "+62 813-2206-507", "url": "https://citia-engineering.com/en/contact" }, { "@type": "ContactPoint", "contactType": "customer support", "name": "siTia - Virtual Assistance", "telephone": "+62 813-2206-507", "url": "https://wa.me/628132206507", "areaServed": "ID", "availableLanguage": [ "id", "en" ] } ], "areaServed": { "@type": "Country", "name": "Indonesia" }, "knowsAbout": [ "Terminal automation system", "Automatic tank gauging", "Tank management system", "SCADA", "Programmable logic controller", "Modbus", "Field instrumentation", "Weighbridge", "Pipeline pressure monitoring", "Industrial IoT" ], "brand": [ { "@type": "Brand", "name": "INTEGRA" }, { "@type": "Brand", "name": "CATALYST" } ], "sameAs": [ "https://www.facebook.com/citiaengineering/", "https://www.instagram.com/citiaengineering/" ] }, { "@type": "WebSite", "@id": "https://citia-engineering.com/#website", "url": "https://citia-engineering.com", "name": "Citia Engineering Indonesia", "inLanguage": [ "en", "id" ], "publisher": { "@id": "https://citia-engineering.com/#organization" }, "potentialAction": [ { "@type": "SearchAction", "name": "Search Citia News", "target": { "@type": "EntryPoint", "urlTemplate": "https://citia-engineering.com/en/news?q={search_term_string}" }, "query-input": "required name=search_term_string" }, { "@type": "SearchAction", "name": "Cari di News Citia", "target": { "@type": "EntryPoint", "urlTemplate": "https://citia-engineering.com/id/news?q={search_term_string}" }, "query-input": "required name=search_term_string" } ] }, { "@type": "WebPage", "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#webpage", "url": "https://citia-engineering.com/en/knowledge/tas-architecture", "name": "Terminal automation system architecture: field, control, application and enterprise layers", "description": "Terminal automation system architecture has four layers: field, control, application and enterprise. See the links, failure modes and network segmentation.", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/#website" }, "publisher": { "@id": "https://citia-engineering.com/#organization" }, "about": { "@id": "https://citia-engineering.com/#organization" }, "breadcrumb": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#breadcrumb" }, "dateModified": "2026-11-13", "mainEntity": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#entity" } }, { "@type": "BreadcrumbList", "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Citia", "item": "https://citia-engineering.com/en" }, { "@type": "ListItem", "position": 2, "name": "Knowledge", "item": "https://citia-engineering.com/en/knowledge" }, { "@type": "ListItem", "position": 3, "name": "Terminal automation system architecture: field, control, application and enterprise layers", "item": "https://citia-engineering.com/en/knowledge/tas-architecture" } ] }, { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#entity", "url": "https://citia-engineering.com/en/knowledge/tas-architecture", "mainEntityOfPage": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#webpage" }, "@type": "TechArticle", "headline": "Terminal automation system architecture: field, control, application and enterprise layers", "description": "TAS architecture has four layers, from field devices to ERP. See how they connect, what fails at each layer, where redundancy pays and how to segment the network.", "dateModified": "2026-11-13", "author": { "@id": "https://citia-engineering.com/#organization" }, "publisher": { "@id": "https://citia-engineering.com/#organization" }, "inLanguage": "en", "articleSection": "Engineering Practice", "datePublished": "2026-11-13", "image": "https://citia-engineering.com/media/covers/tas-architecture.webp" }, { "@type": "FAQPage", "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#faq", "url": "https://citia-engineering.com/en/knowledge/tas-architecture", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#webpage" }, "mainEntity": [ { "@type": "Question", "name": "Does a TAS server need redundancy?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, in most terminals the TAS server should have a tested standby, because its failure can stop every bay at once. Bay controllers usually do not need duplicates, since a single fault stops only one bay." } }, { "@type": "Question", "name": "What keeps running when the connection to the ERP is lost?", "acceptedAnswer": { "@type": "Answer", "text": "Loading against orders already received should keep running when the ERP connection is lost. The TAS queues the results and posts them when the link returns, with a reconciliation report." } }, { "@type": "Question", "name": "Where should the firewall be placed in a terminal network?", "acceptedAnswer": { "@type": "Answer", "text": "The main firewall belongs between the application layer and the enterprise or office network. Many terminals add an exchange zone in between so the ERP and TAS never connect directly." } }, { "@type": "Question", "name": "When does a cloud-based TAS make sense?", "acceptedAnswer": { "@type": "Answer", "text": "A cloud-based TAS makes sense when several sites need one view and the design keeps control and safety local. The edge at each site must be able to carry local work through an internet outage." } }, { "@type": "Question", "name": "Which protocols connect the layers of a TAS?", "acceptedAnswer": { "@type": "Answer", "text": "The layers of a TAS are usually connected by pulses and discrete signals at the bay, Modbus or vendor protocols to controllers and gauges, and application interfaces to the ERP. Each change of protocol needs a tested translation point." } } ] }, { "@type": "DefinedTermSet", "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary", "url": "https://citia-engineering.com/en/knowledge/tas-architecture", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#webpage" }, "name": "Terms used in this article", "hasDefinedTerm": [ { "@type": "DefinedTerm", "name": "ISA-95 / IEC 62264", "description": "Standard model that splits plant systems into Levels 0 to 4 and defines the business-to-operations interface.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } }, { "@type": "DefinedTerm", "name": "Layer", "description": "A group of systems with the same role, such as control or application.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } }, { "@type": "DefinedTerm", "name": "Gateway", "description": "Device that reads field protocols and passes normalised data upward.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } }, { "@type": "DefinedTerm", "name": "Standby server", "description": "A second server that takes over when the main one fails.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } }, { "@type": "DefinedTerm", "name": "Network segmentation", "description": "Splitting a network into zones with controlled traffic between them.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } }, { "@type": "DefinedTerm", "name": "Edge", "description": "Computing equipment at the site that keeps local work running and syncs with the cloud.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } }, { "@type": "DefinedTerm", "name": "Security level", "description": "In IEC 62443, a measure of how strongly a system resists attack.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tas-architecture#glossary" } } ] } ] } ```