The problem
The software on the machine is installed at commissioning. After that, either a technician travels to the site or it stays as it is. A few years later every device runs a slightly different version, and nobody knows exactly which.
Then there is the network. Your customers lock down their production networks, connections drop, ports are blocked. A solution that needs a permanent cloud connection fails there.
Embedded Linux, device identity and OTA updates
The edge device runs a lean embedded Linux, the application runs in containers. The device reads data from the controller, processes it on site and does its job without a connection. Data is buffered and sent once the network is back.
Every device gets its own identity at commissioning: keys, serial number, assignment to the plant. You know which device is talking and can update or block it individually.
Updates for operating system and application arrive over the air. The build pipeline produces multi-arch images, including ARM, versions every release and takes it from commit to device. Rollouts are staged: a test device first, then a small group, then the fleet.
An inventory shows which version runs on which device and how it is configured. That is the basis for closing vulnerabilities in a targeted way later.
What you get
- a device image with documented provisioning for commissioning
- a build and update pipeline in your GitLab instance or your CI
- a rollout strategy that fits your customers and service hours
- an overview of the fleet: versions, configuration, state
- ongoing operation if you want it, otherwise a handover to your team
Limits
We handle everything above the controller. The PLC program, electrics and sensors stay with you or our automation partner. You choose the hardware, we advise. We do not offer IEC 62443 certification.