The edge box for condition monitoring: design, tasks and behaviour during network outages

Every condition monitoring system needs a computer close to the machine. In our case that is the edge box. It is the only part of our system that sits in the network of your shop floor. That is why we have defined particularly precisely what it does, how it behaves when things go wrong and what it never does. This article describes the design of the edge box for condition monitoring as it is implemented in our software. We deliberately do not name a specific hardware model: the software is fixed, but the choice of hardware and data acquisition card is still open.

The six tasks of the edge box

The edge box software runs as one program with several parallel tasks. Each task has one job, and an error in one task does not bring the others to a halt.

There is also a seventh task that reports the health of the edge box itself. More on this further down.

The CNC control: read-only, secured four times over

The edge box connects to the CNC control via OPC UA. Which signals it reads is defined in its configuration, not in the program code. The paths of the signals are determined on site with a tool that browses the address space of the control and creates a table of all nodes. This tool, too, only reads.

Read-only access is secured at four levels. The driver interface contains no write functions. Every OPC UA request passes through a single point with an allowlist that only lets through reading, browsing, subscribing and session management. Writing, method calls, creating and deleting are blocked before anything is sent. Automated tests prove this. And a dedicated read-only user is set up on the control. By default, the control is polled once per second, never more often than every 0.1 seconds.

With an encrypted connection, the edge box requires the control's certificate. Without that certificate it would trust any remote party claiming to be the control. Details are given in the articles Read-only: write protection on the CNC control and Connecting SINUMERIK and HEIDENHAIN via OPC UA.

Why the calculation happens on site

Bearing diagnosis needs vibration signals in the kilohertz range. Such a raw signal is large, and it is produced continuously. Sending it to the cloud would mean every machine needs a permanently wide connection, and a network outage would build up large volumes of data. The edge box therefore performs the computationally intensive steps itself: spectrum, envelope, order analysis, search for the bearing frequencies. Only the features are transmitted, together with the bearing finding and its distance from the noise floor, if there is one.

This has three consequences. First, the data volume stays small and predictable. Second, less data leaves your network, which makes the review by your IT team easier. Third, the edge box can continue measuring even during a longer network outage, because it only has to store features.

A measurement window is only evaluated if the speed reported by the control before and after the window differs by no more than 2 % and is above 300 rpm. The analysis runs in a separate thread, so that the edge box keeps responding to the control and the network while it calculates. What happens to the features on the platform is explained in the article From vibration to alert.

Behaviour during network outages: a buffer without gaps or duplicates

Network disruptions happen on every shop floor. The edge box is built so that data is neither lost nor delivered twice. The mechanism has four parts:

1. Sequential numbers: every record is given an ascending number when it is stored, and that number is never reused.
2. Safe storage: the buffer is an SQLite database that commits every write completely to disk. A power cut does not lose any records that have already been stored.
3. Delete only after confirmation: the edge box sends a batch, waits for confirmation from the platform and only then deletes the confirmed records. If no confirmation arrives, it sends the same batch again.
4. Duplicate detection: for each edge box, the platform remembers which numbers it has already stored. A record that is sent again is recognised and not stored a second time.

It follows from these rules that after a disruption the edge box sends everything in the original order. If a confirmation is lost, the worst case is a duplicate, which the platform discards. No gap arises.

The connections themselves are also designed for outages. If the connection to the control or to the platform drops, the edge box tries again, with increasing pauses up to an upper limit. The edge box does not crash and does not need a manual restart.

Configuration, identity and transmission

One file, no secrets

Everything the edge box needs to know about its machine is in a single configuration file: device and machine ID, address of the control, the signals read, measuring point, measurement window and interval, envelope frequency band, the bearing geometry from the datasheet, buffer period and connection to the platform. The file is fully validated at start-up. Unknown entries, missing mandatory fields or contradictory settings lead to a clear error message instead of silent malfunction.

Some rules are firmly built into the validation:

• Passwords are never in the file. They come from environment variables. Certificates and keys are only specified by their file path.
• Unencrypted transmission to the platform is only allowed to the local computer, i.e. for testing. TLS is mandatory for every real address.
• Encrypted OPC UA connections need the edge box's certificate and key and the control's certificate.
• The bearing geometry is taken from the datasheet, never estimated.
• Updates are only fetched via https.

Its own identity, outbound only

Every edge box has its own identity. Its private key is generated on the edge box itself and never leaves it. To the outside world, it only provides a certificate signing request with its device ID. We issue the device certificate from this request. An existing key is never overwritten.

Transmission uses MQTT over TLS version 1.2 or later, outbound on port 8883, or via port 443 if that port is blocked. The edge box does not open any port for inbound connections. The broker only allows each edge box to publish messages under its own ID. Which edge box belongs to which customer is decided solely by the platform, based on its device registry. In addition, the platform checks whether the machine ID in the data matches the edge box's registered machine and discards records that do not match. More on this on the page Data security and in the article Signed updates and device certificates.

Updates and health reports

By default, the edge box checks for an update every six hours. An update is only accepted if its manifest is signed with one of our stored keys, is still valid and the version is newer than the highest ever accepted. A downgrade to an older version is therefore ruled out, even after a restart. The downloaded file must exactly match the size and checksum given in the signed manifest. If all of this is met, the edge box stages the update. It is installed by a separate service that checks everything once more before installation. The edge box reports a rejected update with the reason.

So that you and we can see whether the edge box itself is healthy, it sends a health report every minute by default. It contains:

• the installed software version,
• whether the connection to the control is up,
• how many records are waiting in the buffer to be sent and how old the oldest one is,
• how many days the device certificate remains valid.

If the certificate expires in less than 30 days, the edge box also reports this as an event. Lost connections to the control, discarded buffer data and updates also appear as events. A growing buffer while the control connection is up, for example, shows immediately that the outbound network connection is disrupted.

What the edge box never does

For approval by your IT team, what a device does not do is often more important. For our edge box:

• It never writes to the CNC control, starts no programmes, calls no methods and changes no parameters.
• It accepts no inbound connections.
• It does not transmit any raw vibration signal, only features.
• It does not install unsigned or older software versions.
• It does not give out its private key.
• It does not itself assess whether a machine is conspicuous. That decision is made by the platform using the learned baseline, i.e. the normal state of this spindle.

How the edge box is set up at your site is described on the page Process. Whether your CNC control can be connected is something we clarify in an introductory call.

Frequently asked questions