An industrial edge device that connects the plant to the enterprise.
A fanless industrial PC that mounts in the panel next to your PLCs. One network port faces the plant and talks to ControlLogix, SIMATIC, and groov EPIC, and through them to every 4–20 mA loop, drive, and flowmeter on the floor. The other port opens an outbound-only encrypted tunnel to your central platform and sends the plant's data up already cleaned, named, and in context. It runs local SCADA too, needs no inbound firewall rules, and gets updated remotely, so there's no six-month IT project.
The data path, from PLC to enterprise.
Your PLCs already have the data; that part works. The hard part is getting it off the floor, into usable shape, and up to the people and systems that need it, without exposing the control network to the internet. That's the job the edge device does.
Duplicate IP addresses on OEM skids.
Machine builders ship every skid with the same address plan, so a plant with ten packaging lines ends up with ten copies of 192.168.1.10. Re-addressing a validated OEM program is risky, and it breaks the builder's remote support and more than a few warranties. So we leave the skids alone. An industrial NAT switch on each cell (Cisco IE-3400 / Rockwell Stratix class) translates the machine's private subnet to a unique block on the plant network, and the edge device reads every PLC as if there were no conflict.
The skid keeps its image
The OEM program, its backups, its HMI addressing, and the builder's remote-support setup all stay byte-for-byte as delivered. Spares, a cloned line, or a restore after a failure all start from the standard OEM image, because the plant network adapts to the machine and not the other way around.
skid config · untouchedOne small table per cell
The NAT switch holds a short static map that pairs each inside address with one outside address, translated in hardware at line rate. EtherNet/IP, S7 and other TCP/IP traffic pass straight through, and the PLC never knows it has a second address.
192.168.1.10 ⇆ 10.10.21.10A clean namespace upstream
The edge device polls each PLC at a unique, stable plant address, so the model engine can treat Line 1's filler and Line 2's filler as separate assets built from the same model. Adding line eleven means a new NAT block and a copied model, done before lunch.
one /24 per cell · zero conflictsLocal SCADA and data aggregation.
A PLC will happily hand you ten thousand cryptically named tags at machine speed, and streaming all of that into a data lake gets you a swamp. The edge device does the cleanup on site. It collects close to the source, models the tags into named assets with units and context, and publishes payloads an analytics team can use without someone from the plant floor translating.
SCADA runs on site
Operator screens, alarming, and trending run locally on the box. When the WAN drops, screens stay live, alarms still fire, and history keeps recording. The cloud gets the plant's data, but the plant never needs the cloud to run.
local screens · local alarmsStore and forward
Every value is written to solid-state storage before it's sent. After an outage of minutes or days, the backlog replays in order when the link returns, with quality codes intact. The gap on the enterprise dashboards fills itself in, and nobody re-keys anything.
buffer → replay → no gapsModels instead of tag dumps
An intelligence-hub layer (we deploy HighByte, or the modeling engine your stack prefers) maps raw tags into reusable asset models, so an "Evaporator" looks the same in every plant, whatever the PLC calls its tags. If a tag address changes, you update the model and nothing upstream has to change.
tag → model → payloadProtocols on both sides
Native drivers for EtherNet/IP, Siemens S7, OPC UA, and Modbus on the plant side; Kafka, MQTT with Sparkplug B, REST, and SQL on the enterprise side. Legacy serial gear plugs into the box's own serial ports. One box replaces the drawer full of one-off protocol converters.
EtherNet/IP ↔ Kafka / MQTTOutbound connections only.
The edge device only makes outbound connections. It dials home over an encrypted tunnel (Cloudflare Tunnel, or a private link where policy requires) and keeps that session open. Nothing on the internet can dial in, because nothing is listening: no inbound firewall rules, no port forwards, no public IP, and no VPN concentrator to patch. Your IT team approves one outbound HTTPS flow, and that's it.
Outbound only
The tunnel is opened from inside the plant, outbound on port 443, so there are no listening ports for anyone on the internet to find. Telemetry goes up and authorized management traffic comes back down the same authenticated session.
no inbound rules · port 443 outIdentity over addresses
Each device has its own certificate, and every session uses mutual TLS. Access to the device's services is controlled centrally by identity and policy, so "who can see plant 4" is a rule you set once and can revoke in one click.
per-device mTLS · central policyOT and WAN, physically split
Two network interfaces, no routing between them. The control network stays flat, private, and invisible from the WAN side; the only thing that crosses is data the model engine explicitly publishes.
dual NIC · no forwardingA managed fleet
Health data, updates, and configuration all go over the same secure channel. We monitor every device centrally, patch the OS and containers remotely, and can roll a new data model out to twenty sites in an afternoon. Site 21 is set up the same way the day its box comes online.
monitored 24/7 · managed remotelyThe box is just how the data gets there. What you're paying for is what shows up on the enterprise side:
- Data that explains itself. Every value arrives named, unit-tagged, and joined to its asset, line, and running order, ready for ERP, quality, and ML systems to consume.
- Up and running in days. There's no plant IT project and nothing to rip out. The box sits next to what you already have and starts reading from it.
- History that survives outages. Store-and-forward buffering keeps the central record complete even when the network drops.
- Security IT will sign off on. One outbound HTTPS flow to approve, nothing exposed inbound, and the OT network can't be seen from outside.
- The same build at every site. Each new site gets the same box, models, and tunnel, so plant 12 costs a fraction of plant 1 and works the same way.
Tell us about your plant network.
Tell us what's on your plant network: which PLCs, how many lines, where the data should land. We'll spec the box, the models, and the tunnel, and put a pilot on your bench.
Talk to an engineer