Documentation
Remote CNC machine access: monitoring, DNC and serial port
Remote CNC access — monitoring a machine, transferring a program, running DNC — is the same need for the integrator who maintains machines at customer sites and for the multi-site shop. The real machine park, though, is mixed: recent Ethernet CNCs (FANUC FOCAS, MTConnect, OPC UA) sit next to older machines that only speak RS-232. VIGIL-MESH covers both — the shop-floor gateway joins the Ethernet CNCs to the mesh, and the remote serial port (Virtual-IO) presents the RS-232 link of a machine on the other side of the country as a local COM port.
The real shop floor: Ethernet and RS-232 side by side
A machine shop is never homogeneous. Recent machining centers ship with Ethernet and speak FANUC FOCAS, MTConnect or OPC UA; next to them, the twenty-five-year-old mill still cuts perfectly true and only knows its RS-232 socket. The remote need is the same for all of them: transfer programs from headquarters, track the machine park, assist the operator — whether the shop is twenty minutes or five hundred miles away.
Ethernet CNCs (FOCAS, MTConnect, OPC UA)
Reachable over the shop network: monitoring, status collection, program transfer through the vendor protocols — but only from the local LAN.
RS-232 CNCs (DNC, drip-feed)
Everything goes through the serial link: sending and receiving programs, drip-feeding programs larger than the machine’s memory. Until now: a dedicated DNC workstation, on site.
The remote need
The programmer at headquarters, the integrator maintaining machines at customer sites, the multi-site owner: all of them need to reach the shop without being there.
Remote access, generation by generation
The problem: the CNC sits on the shop VLAN, behind the site’s box or firewall. The monitoring software at headquarters cannot reach it, and nobody will expose a machine-tool controller to the internet — rightly so.
- 1Install the agent on the shop-floor gatewayAn industrial PC or an existing workstation, on the same LAN as the CNCs, runs the agent and joins the network — outbound only, without touching the site’s box.
- 2Publish each CNC, host by hostThe gateway publishes the selected controllers: each CNC becomes reachable by the authorized members of the network — and nothing else on the shop LAN.
- 3Write the ACLThe programmer’s workstation at headquarters reaches the published CNCs; the rest of the network does not even see them.
- 4Point your tools at the mesh addressThe FOCAS client, the MTConnect collector or the OPC UA client at headquarters addresses the CNC by its address or its name in the network — as if it were on the headquarters LAN.
The problem: the machine only knows its serial link. The DNC software has to be physically plugged into it — hence, until now, one dedicated workstation per shop, maintained on site. This is exactly where the remote serial port (Virtual-IO) shines.
- 1Plug the serial cable into a shop machineThe CNC is wired over RS-232 (or USB-serial) to the site machine that runs the agent — the existing DNC workstation does the job perfectly.
- 2Share the port on the networkThe physical port (COM3, /dev/ttyUSB0…) is shared with the authorized machines, along with its line settings (baud rate, parity).
- 3Mount the virtual port at headquartersOn the headquarters DNC workstation, the share appears as a real COM port (Windows, through the Virtual-IO driver) or a pseudo-terminal /dev/ttyVIGIL-… (Linux).
- 4Let the DNC software talkThe DNC software at headquarters opens the virtual COM port like a local one: sending and receiving programs, drip-feed — while the machine is on the other side of the country. Details and limits: Remote serial port.
Limits and precautions
For the broader OT picture — PLCs, Modbus, SCADA supervision — see Industrial VPN (OT/SCADA).
Supervising the shop from the console
The web console shows the machines of the network — shop-floor gateways included —, the real-time topology and the access audit trail. And if something goes wrong on the gateway, an SSH terminal opens on it right in the browser: no admin VPN, no bastion — see SSH terminal in the browser.
