Two cables in. The whole plant out.
A fanless industrial PC that mounts in the panel next to your PLCs. One network port faces the plant: it speaks ControlLogix, SIMATIC, and groov EPIC, and through them every 4–20 mA loop, drive, and flowmeter on the floor. The other port faces the enterprise: an outbound-only encrypted tunnel that streams the plant's data, already cleaned, named, and contextualized, to your central platform. Local SCADA included. No firewall holes, no site visits, no six-month IT project.
From the milliamp loop to the boardroom, one hop at a time.
Plant data already flows into your PLCs; that part works. The gap is everything above: getting that data off the floor, into shape, and up to the people and systems that need it, without exposing the control network to the internet. The edge device closes that gap from the middle.
Every OEM skid ships as 192.168.1.x. The edge still sees them all.
Machine builders deliver every skid with the same address plan, so a plant with ten packaging lines owns ten copies of 192.168.1.10. Re-addressing a validated OEM program to fix that is risky, and it breaks the builder's remote support along with more than a few warranties. So the skids stay untouched: an industrial NAT switch on each cell (Cisco IE-3400 / Rockwell Stratix class) translates the machine's private subnet to a unique block on the plant network, and the edge device ingests every PLC as if the conflict never existed.
The skid keeps its image
The OEM program, its backups, its HMI addressing, and the builder's remote-support setup all stay byte-for-byte as delivered. Commissioning spares, cloning a line, or restoring after a failure works from the standard OEM image, because the plant network adapts to the machine instead of the reverse.
skid config · untouchedOne small table per cell
The NAT switch holds a short static map: each inside address pairs with one outside address, translated in hardware at line rate. EtherNet/IP, PROFINET, and plain TCP flow through it transparently, so the PLC never knows it has a second identity.
192.168.1.10 ⇆ 10.10.21.10A clean namespace upstream
The edge device polls each PLC at a unique, stable plant address, so the model engine can bind Line 1's filler and Line 2's filler as distinct assets with identical models. Adding line eleven is a new NAT block and a copied model, finished before lunch.
one /24 per cell · zero conflictsRaw tags are noise. The edge turns them into answers.
A PLC will happily give you ten thousand cryptically named tags at machine speed. Streaming that to a data lake produces a swamp. The edge device does the refining on site, the way an intelligence-hub architecture should: collect close to the source, model it into named assets with units and context, then publish clean payloads that analytics teams can use without a plant-floor translator.
SCADA that lives on site
Operator screens, alarming, and trending run locally on the box. When the WAN drops, the plant keeps its eyes: screens stay live, alarms still fire, and history keeps recording. The cloud consumes the plant's data without ever becoming a dependency for running it.
local screens · local alarmsStore and forward
Every value is buffered on solid-state storage before it's shipped. An outage of minutes or days replays in order when the link returns, with quality codes intact. Enterprise dashboards see a gap close itself; nobody re-keys anything and no history is lost.
buffer → replay → no gapsModels instead of tag dumps
An intelligence-hub layer (we deploy HighByte, or the modeling engine your stack prefers) maps raw tags into reusable asset models: an "Evaporator" looks the same in every plant, whatever the PLC underneath calls its tags. Change a tag address and the model absorbs it; the enterprise never notices.
tag → model → payloadEvery dialect, both directions
Native drivers for EtherNet/IP, PROFINET, OPC UA, and Modbus on the plant side; MQTT with Sparkplug B, REST, and SQL on the enterprise side. Legacy serial gear rides in over gateways. One box retires the drawer full of one-off protocol converters.
EtherNet/IP ↔ MQTT/Sparkplug BThe plant network never touches the internet. The data still arrives.
Every connection the edge device makes is outbound: it dials home over an encrypted tunnel (Cloudflare Tunnel, or a private link where policy requires) and keeps that session open. Nothing on the internet can dial in, because there is nothing to dial: no inbound firewall rules, no port forwards, no public IP, no VPN concentrator to patch. Your IT team approves one outbound HTTPS flow, and that's the whole conversation.
Outbound only
The tunnel is established from inside the plant, outward, on port 443. Attack surface from the internet: zero listening ports. The same session carries telemetry up and authorized management traffic back down the established, authenticated channel.
no inbound rules · port 443 outIdentity over addresses
Each device authenticates with its own certificate; every session is mutually authenticated TLS end to end. Access to the device's services is governed centrally by identity and policy, so "who can see plant 4" is a rule you set once, and revoke in one click.
per-device mTLS · central policyOT and WAN, physically split
Two network interfaces, no routing between them. The control network stays flat, private, and invisible from the WAN side; the only thing that crosses the gap is data the model engine explicitly publishes. The edge device is a diode with a brain.
dual NIC · no forwardingA managed fleet
Health, updates, and configuration ride the same secure channel. We watch every device centrally, patch the OS and containers remotely, and roll out a new data model to twenty sites in an afternoon. Site 21 gets the same treatment the day its box comes online.
monitored 24/7 · managed remotelyThe device is the delivery mechanism. What you're actually buying is the outcome on the enterprise side:
- Analytics on data that explains itself. Every value arrives named, unit-tagged, and joined to its asset, line, and running order, ready for ERP, quality, and ML systems to consume.
- A start measured in days. No plant IT project, no rip-and-replace: the box sits beside what you already own and starts talking to it.
- History that survives outages. Store-and-forward buffering means the record at the center is complete even when the network wasn't.
- A security posture IT will sign. One outbound HTTPS flow to approve, zero inbound exposure, and the OT network stays dark from the outside.
- A pattern that scales. Each new site is the same box, the same models, the same tunnel: plant 12 costs a fraction of plant 1 and matches it exactly.
Want your plant's data on a dashboard by next month?
Tell us what's on your plant network: which PLCs, how many lines, where the data should land. We'll spec the box, the models, and the tunnel, and put a pilot on your bench.
Start a conversation