Audience: This document is intended for stakeholders without a technical background. It explains what edge nodes are, why they are used in a manufacturing environment, how they contribute to cybersecurity, and where they are typically installed.

Edge nodes are the secure bridge between the machines on the shop floor (OT) and software platforms such as the Mantsu MES (IT). They collect, translate, and forward machine data without exposing the OT network.

Modern manufacturing operates in two distinct worlds that have very different characteristics and priorities.

The OT world (Operational Technology) is the world of machines, controllers, sensors, and production lines. Its priority is reliability and continuity. A machine controller that hesitates for even a fraction of a second can disrupt production or create a safety issue. OT equipment is often decades old, runs specialised software, and was never designed to be connected to a broader network.

The IT world (Information Technology) is the world of business applications, databases, enterprise software, and cloud services. It is designed for flexibility, updates, and connectivity. IT systems expect to communicate over modern protocols and are regularly updated and patched.

Connecting these two worlds directly is risky. OT equipment is often too fragile to be exposed to IT-level network traffic, and IT networks are too open to be trusted from a production safety perspective. The edge node sits between the two and manages this boundary.

An edge node is a small, dedicated computing device placed close to machines and production equipment. It acts as an intelligent intermediary between the OT world and the IT world: it collects data from machines, processes it locally, and forwards selected results to enterprise systems.

Think of it as a local translator and gatekeeper. Machines speak their own language over their own protocols. Enterprise systems speak a different language over different protocols. The edge node translates between the two, decides what information is worth forwarding, and ensures that communication flows in a controlled way.

Machines produce enormous volumes of raw data. A single production line may generate thousands of readings per second. Sending all of that raw data to an enterprise system would overwhelm the network and make the receiving system responsible for making sense of it all.

The edge node processes data locally, close to the source. It calculates averages, detects anomalies, and filters out noise before anything leaves the shop floor. Only meaningful, structured information is forwarded upward. This keeps network traffic manageable and ensures that enterprise systems receive clean, relevant data.

Enterprise networks can experience outages. A direct connection between a machine and a cloud platform means that any network interruption immediately breaks the data flow. In some architectures it could even affect machine operation.

The edge node operates independently. It has its own local storage and continues collecting and processing data even when connectivity to the enterprise is lost. Once the connection is restored, it synchronises the data that accumulated during the outage. Production is never dependent on an enterprise network being available.

Some decisions need to happen in milliseconds. If a machine temperature exceeds a safety threshold, waiting for a signal to travel to the cloud and back before triggering an alert is not acceptable. The edge node can apply local rules and trigger local responses instantly, without any round trip to the enterprise.

OT equipment communicates using industrial protocols such as OPC-UA, Modbus, or PROFINET. Enterprise systems use modern IT protocols such as MQTT or Kafka. The edge node handles this translation, allowing old and new systems to coexist without requiring costly modifications to the machines themselves.

The edge node is one of the most important elements in a secure IT-OT architecture. Its position at the boundary between the two worlds means that it can enforce strict rules about what is allowed to cross that boundary, in which direction, and under what conditions.

The most fundamental security rule is that data flows from OT to IT, not the other way around. Machine controllers and sensors send data outward to the edge node. Enterprise applications receive data from the enterprise side of the architecture. No enterprise application ever sends commands or data directly into the OT network through the edge node.

This is sometimes called a unidirectional gateway. Just as a one-way valve in a pipe allows fluid to flow in only one direction, the edge node allows data to flow outward from the machines but blocks anything attempting to flow inward from the IT network.

OT equipment was never designed to be reachable from the internet or from a broad corporate network. Connecting a machine controller directly to an enterprise network exposes it to threats it has no way to defend against: network scans, login attempts, software exploits. Many OT devices run software that is years or decades old and cannot be patched.

The edge node absorbs this risk. It is the only device that communicates with both sides. The machines behind it are invisible to the IT network. An attacker who gains access to the enterprise network cannot reach the machines directly, because the edge node does not provide that path.

All communication between the edge node and enterprise systems is encrypted. This means that even if someone intercepts the data in transit, they cannot read or modify it. The edge node and the enterprise broker authenticate each other using digital certificates before any data is exchanged, ensuring that only authorised devices can participate in the communication.

The software running on the edge node is managed centrally and updated in a controlled way. Unlike OT equipment, which may run the same firmware for years, the edge node can receive security patches and configuration updates without touching the machines behind it. This keeps the boundary between OT and IT up to date with current security standards.

The edge node reinforces the separation of responsibilities between the plant team and the corporate IT team. The plant team manages everything on the OT side: the machines, the local network, and the edge node's connection to those machines. The corporate IT team manages everything on the enterprise side: the broker, the applications, and the network the edge node connects to. Neither team has unrestricted access to the other's domain, and the edge node enforces this boundary in both directions.

Edge nodes are placed at the points in the architecture where OT and IT systems need to exchange data. The right placement depends on the scale of the plant, the number of machines, and how data needs to flow.

In environments where individual machines or small groups of machines (cells) need to be connected, an edge node is placed directly beside the equipment it serves. It collects data from one machine or a handful of machines on a single production cell and forwards it to the plant network or directly to a plant-level broker.

This level of placement gives the finest control: each machine group has its own isolated edge node, and a problem with one does not affect others.

In larger environments, a single edge node may serve an entire production line or a defined area of the plant. It aggregates data from all the machines on that line, applies local processing and filtering, and forwards a unified stream to the plant broker.

This is the most common deployment pattern. It balances granularity with manageability: enough isolation to contain issues, but few enough devices to be practical to maintain.

A plant-level edge node sits at the boundary between the plant network and the enterprise network, typically in a DMZ (a neutral network zone that sits between the two). This node is the single exit point for all data leaving the plant toward the enterprise. It enforces the unidirectional communication rule and is the point at which plant-level data is consolidated before being promoted to the enterprise broker.

In a multi-plant architecture, each plant has its own plant-level edge node. The enterprise broker collects from all of them.

What do edge nodes do in a Mantsu architecture? They sit in the OT network, translate machine protocols into MQTT topics, and push that data outward into the Mantsu UNS.

Which edge technologies does Mantsu use? Node-RED as the edge connector for smaller plants, or FlowFuse where many edge instances need centralized management, both publishing to the MQTT broker.

Where are edge nodes installed in a Mantsu plant? In the OT network close to the machines and controllers, at machine/cell, line/area, or plant-DMZ level depending on the scale of the plant.

Summary: Edge nodes sit in the OT network, translate machine protocols into MQTT, and push data outward without ever accepting inbound connections. They are the secure, scalable bridge between the shop floor and Mantsu.