Digital product engineering · IoT
Edge gateway and embedded software development
We develop edge gateway and embedded software: the software that runs on Linux gateways and edge computers beside machines and sensors, with protocol adapters, store-and-forward buffering, containerised applications, local analytics and secure over-the-air updates. We write the software on the gateway and its integration with your devices and cloud, not the electronics, and you own the code.
Checklist · IoT and devices
Industrial IoT and device integration checklist
A checklist for projects that connect devices, machines and sensors to software: use case, device inventory, protocols, gateways, data model, security, lifecycle and enterprise integration.- 01Eight areas to settle before you connect a fleet of devices or a plant.
- 02The device and signal facts that integration teams always need.
- 03Security and update items that are hard to add later.
- 04Seven questions to put to any vendor or development partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Gateway runtime and base system
A hardened Linux image with a container runtime, service supervision, watchdogs and a defined boot and recovery process. - 02
Protocol adapters
Drivers for OPC UA, Modbus, CAN, serial, BACnet and vendor interfaces, converting device data to a common message model. - 03
Local buffering and store-and-forward
Durable local queues that keep data through outages and forward it in order with original timestamps and back-pressure control. - 04
Edge applications
Containerised applications for filtering, aggregation, local rules and control-adjacent logic, deployed and versioned from the cloud. - 05
Edge analytics and inference
Models for anomaly detection, vision or prediction run locally, with model packaging, versioning and performance monitoring. - 06
Device and gateway identity
Unique identity anchored in a trusted platform module or secure element, used to authenticate to the cloud and to local devices. - 07
Remote management
Configuration, logs, metrics and diagnostics from a central console, with secure remote access that is time-limited and audited. - 08
Over-the-air updates
Signed, atomic updates of the system image and applications, with A and B partitions, health checks and rollback. - 09
Cloud and enterprise integration
Delivery to IoT platforms and data platforms over MQTT or HTTPS, with schema versioning and compatibility with older gateways.
Reference architecture.
Standards and interfaces
What we design against.
- OPC UA, Modbus, CAN and BACnet
- The device and building protocols the adapters implement, with defined data types and error handling.
- MQTT and Sparkplug B
- Uplink messaging with defined topic structure and session state.
- Container and orchestration standards
- OCI containers and lightweight orchestration for deploying and updating edge applications.
- Secure boot, TPM and update frameworks
- Hardware-rooted trust and atomic update mechanisms such as RAUC, SWUpdate and Mender.
- IEC 62443-4-1 and EU Cyber Resilience Act
- Secure development lifecycle practices, vulnerability handling and reporting expectations for products with digital elements.
- ONNX and common model formats
- Portable formats for deploying machine learning models to edge runtimes.
Data model
The core entities.
- Gateway
- Identity, hardware profile, image version, applications, health and site.
- Adapter configuration
- Protocol, endpoints, signals, polling and mapping, with version and rollout state.
- Message and queue entry
- Payload, source timestamp, sequence, delivery state and retry count.
- Edge application
- Image, version, configuration, resource limits and status.
- Model package
- Model, version, runtime, input schema and evaluation results.
- Update
- Target group, artefact, signature, stages and result.
- Diagnostic bundle
- Logs, metrics, configuration snapshot and the request that produced it.
When custom development is the right call.
Controls designed in, not added later.
Hardware-rooted trust
Secure boot and keys held in a TPM or secure element, so a gateway can prove what it is running.Signed, atomic updates
Only signed images are installed, in a way that always leaves a bootable system, with rollback on failure.Minimal attack surface
Stripped system image, no default credentials, closed inbound ports and unprivileged containers.Secure remote access
Outbound-initiated, time-limited and audited sessions instead of open management ports.Vulnerability handling
A process to track components, assess advisories and ship fixes, following IEC 62443-4-1 practice.
From discovery to a system you run.
- 01
Requirements and device survey
We list the devices, protocols, data rates, environment and constraints on the gateway hardware, with your hardware and operations teams. - 02
Architecture and security design
The image, runtime, adapter model, update approach and identity design are agreed. - 03
Build on a reference gateway
Adapters, buffering and the update agent are built and tested on the target hardware with real devices. - 04
Field pilot
A small number of gateways run on site, with remote management and monitoring exercised. - 05
Production release and fleet rollout
The image and applications are released through a controlled pipeline and rolled out to the fleet in stages.
Relevant work
Where to see our work.
Common questions.
- Do you design the gateway hardware or write low-level firmware?
- No. Our scope is the software on Linux-based gateways and edge computers, and the integration with devices and the cloud. Electronics design and microcontroller firmware stay with your hardware supplier, and we agree the interfaces with them.
- Can the gateway keep working if the cloud is unreachable?
- Yes. Local rules and applications continue, data is stored in durable queues and forwarded in order when the link returns.
- Can you run machine learning at the edge?
- Yes, for models such as anomaly detection or vision that fit the gateway's resources. Models are packaged, versioned, monitored and updated like any other application.
- How are updates made safe on remote gateways?
- Updates are signed and atomic with two system partitions, health checks after boot and automatic rollback to the previous version if the new one fails.
- Who owns the code?
- You do. The code, the images and the configuration stay yours.