Cloud and security · Remote operations
Edge-to-cloud architecture for remote and offshore sites
We design edge-to-cloud architecture for remote and offshore sites: local processing that keeps operations running when the link drops, store-and-forward delivery over satellite, cellular and radio links, bandwidth management so the important data goes first, secure connectivity and fleet operations for dozens or hundreds of sites. Remote assets become part of the enterprise data platform without depending on perfect connectivity, and you own the architecture and the code.
Checklist · IoT and devices
Industrial IoT and device integration checklist
A checklist for projects that connect devices, machines and sensors to software: use case, device inventory, protocols, gateways, data model, security, lifecycle and enterprise integration.- 01Eight areas to settle before you connect a fleet of devices or a plant.
- 02The device and signal facts that integration teams always need.
- 03Security and update items that are hard to add later.
- 04Seven questions to put to any vendor or development partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Site architecture
A reference design for each site type, covering power, local network, edge compute, local storage and the boundary with control systems. - 02
Connectivity strategy
Selection and combination of links such as low-earth-orbit and geostationary satellite, cellular, microwave and fibre, with failover between them. - 03
Local processing and autonomy
Applications at the edge that keep running without a link: local dashboards, rules, alarms, forms and data capture. - 04
Store-and-forward delivery
Durable local queues that send data when links are available, in order, with original timestamps, compression and resumable transfers. - 05
Bandwidth and priority management
Classification of traffic so alarms and operational data go first and bulk data, such as video and large files, goes when capacity allows. - 06
Secure connectivity
Encrypted tunnels, device identity, segmentation from control systems and outbound-initiated connections with no open inbound ports. - 07
Edge application and configuration management
Remote deployment, versioning and rollback of applications and configuration to many sites, with staged rollouts and health checks. - 08
Cloud ingestion and data model
Ingestion of site data into the cloud platform with a consistent asset model, handling of late and out-of-order data and replay after outages. - 09
Fleet monitoring and support
Visibility of site health, link quality, queue depth and data latency, with alerts, remote diagnostics and a support model that accounts for distance.
Reference architecture.
Standards and interfaces
What we design against.
- MQTT and Sparkplug B
- Messaging with session state and last-will handling that suits intermittent links, with defined topics for industrial data.
- OPC UA
- Read-only access to control systems and historians at the site.
- IEC 62443
- Zones and conduits between control systems, the edge platform and the wide-area link.
- TLS, mutual authentication and certificates
- Secure transport and device identity, with automatic certificate rotation.
- Container and lightweight orchestration standards
- OCI images and lightweight orchestration for deploying edge applications.
- Offshore and remote site regulation
- Hazardous-area equipment rules, radio licensing and data export restrictions that apply to the sites.
Data model
The core entities.
- Site and asset
- Site, type, location, equipment, links available and the edge nodes installed.
- Link and quality
- Link type, availability, bandwidth, latency, cost and failover order.
- Message and queue entry
- Payload, source timestamp, priority, size, state and retry count.
- Edge application release
- Version, sites targeted, stage, health result and rollback.
- Telemetry point
- Signal, value, quality, source time and arrival time.
- Site health snapshot
- Queue depth, last contact, resource use, alarms and software versions.
- Support case
- Site, issue, remote actions, on-site visit needed and resolution.
When custom development is the right call.
Controls designed in, not added later.
No inbound exposure
Sites initiate all connections outward, with no open inbound ports to the plant network.Strong device and site identity
Unique certificates per edge node, rotated automatically and revoked if a device is lost.Separation from control
The edge platform reads from control systems through a controlled gateway and has no write path.Safe remote changes
Configuration and software changes are staged, signed and reversible, with health checks before wide rollout.Physical and local protection
Encrypted local storage and hardened devices for sites that are not staffed.
From discovery to a system you run.
- 01
Site and link survey
We survey representative sites, links, power and users, and agree what must work locally and what can wait for the link. - 02
Reference design
A site reference architecture, data priorities, security model and fleet operations approach are designed and reviewed. - 03
Build and pilot at one site
The edge platform and cloud ingestion are built and run at one site, including link failure tests. - 04
Roll out in waves
More sites follow in waves, with a repeatable installation and acceptance process. - 05
Operate the fleet
Monitoring, support and updates run as a service, and the design is refined from fleet data.
Relevant work
Where to see our work.
Common questions.
- What happens when the satellite link is down?
- The site keeps running. Local applications and alarms work, and data waits in durable queues. When the link returns, queues drain in priority order with original timestamps, so nothing is lost and the cloud sees the right history.
- How do you cope with very limited bandwidth?
- By classifying traffic, compressing and aggregating data at the edge, sending alarms and key measures first and deferring bulk data. Edge analytics can send results instead of raw data.
- Can we manage hundreds of sites?
- Yes, with a standard site design, remote deployment with staged rollouts and health checks, and a fleet dashboard that shows which sites need attention before they report a problem.
- Does the edge platform connect to our control systems?
- It reads from control systems and historians through a controlled gateway, and has no write path. Any exception is designed explicitly and agreed with the automation owner.
- Who owns the architecture and code?
- You do. The designs, the code and the data stay yours.