The connected factory: the Industry 4.0 network

Three flows, one network foundation

Industry 4.0 projects often stack three infrastructures: an IoT gateway for the data, remote-maintenance boxes for the machine builders, and nothing planned for AI. Yet all three needs rest on the same question — who is allowed to reach which machine.

The foundation: a private network by software agent

The foundation of the connected factory is neither a cloud platform nor a box: it is a software agent installed on the machines and gateways, putting them on a shared private network.

• The agent installs on what is already there: HMI PC, supervision workstation, industrial PC, Linux gateway, NVIDIA Jetson, Android terminal — and the browser can become a node (WASM).
• Zero inbound ports: each agent only makes outbound connections and traverses the plant firewall, CGNAT and 4G/5G links with no rule to request.
• End-to-end encryption: QUIC/TLS 1.3, Ed25519 keys, hybrid post-quantum key establishment — any relays only see opaque packets.
• MagicDNS and ACLs: every machine carries a stable name, every flow is explicitly authorised — see policies and ACLs.
• Multicast crosses: mDNS, SSDP, DDS — device discovery works between sites just like on the floor, see the broadcast domain.

Collecting machine data, line by line

Collection is not decreed factory-wide: it is built line by line, with flows scoped one-way whenever possible.

1. 1
   Enroll the machine or the line gatewayA single-use key generated from the console, one command on site: the line joins the network with its own identity. A device without an OS is reached through the gateway, host by host.
2. 2
   Let the existing protocols speakThe OPC UA server is reachable at its overlay address, the MQTT broker receives the measurements, Modbus TCP flows up — see Modbus, SCADA and PLCs.
3. 3
   Cover the serial legacyRS-485 meters and instruments can be read remotely over serial-over-IP (beta) — see remote Modbus RTU.
4. 4
   Scope the flow with ACLsCollection goes up from the line to the historian — and that is all: no rule authorises the reverse path, the office workstation does not reach the PLC.

Vendor remote access, without a DMZ

A connected factory hosts machines from several builders, each with its own maintenance contract. Multiplying boxes and exception VPNs does not scale — and every exception weakens the policy.

• One access per machine and per contract: the builder reaches their machine, on the intended services — the rest of the factory does not exist for them.
• Every session is logged: who, which machine, when — the evidence file builds itself.
• Revocation is immediate at the end of the contract, without touching the other builders' access.

The AI layer: the fleet exposed to assistants

The last stage of the connected factory is being written now: plugging AI assistants into the fleet. The local MCP bridge lets every on-board software — robot controller, supervision, business application — publish its capabilities to the machine's VIGIL client; the assistant connects to a single place and discovers a living inventory of the fleet.

• Query the health of a site's equipment in one tool call, with no bespoke integration.
• Correlate one controller's errors with the rest of the fleet, then document the incident automatically.
• Act — recalibration, service restart — within the exact limits of the console policy, with every call logged.

Frequently asked questions