Architecture
PLC to portal, with the OT/IT boundary in plain sight.
How data moves from a sensor on the line to the report on a plant manager's desk. Six components, one published path, no proprietary protocols.
DATA FLOW
From the sensor to the portal
Five stages, each one a documented component you can read in the open-source reference implementation. No black-box steps between the controller and the chart.
Field devices
PLCs, sensors, gateways, and historians. The protocols you already speak.
Edge agent
A Linux process running next to your machines. Reads OPC UA, Modbus TCP, CSV file watch, and JSON file watch.
Local buffer
SQLite-backed durability. Survives weeks of WAN outage and auto-flushes when connectivity returns.
Haltless cloud
PostgreSQL with row-level security per tenant. EU-hosted by default; US region available at provisioning.
Portal & API
Dashboards for humans, REST and webhooks for machines. The same data through two interfaces.
OT / IT BOUNDARY
Where data crosses the line
The edge agent sits on the IT network or in a DMZ. It pulls from the OT network through a one-way connection that you control. Outbound TCP to the controllers, no inbound to the agent, no reverse tunnels. Raw frames never leave your facility unless you choose to forward them.
- Outbound only, from the agent to the controllers
- No reverse tunnels, no remote shells, no Haltless ingress to OT
- TLS 1.3 to the cloud, mutual TLS optional
- Raw frames stay local; only normalised metrics ship
COMPONENTS
What runs where
Edge agent
Stateless Linux process. Four input protocols, JSON config, journald logs. Configuration via flat files or per-machine YAML with hot reload.
Ingest API
TLS endpoint that accepts the agent's normalised payloads and writes them to the per-tenant time-series table.
Deterministic detectors
Three detectors per metric: static baseline z-score, EWMA, and rate-of-change. No model training, no drift, no opaque scoring.
Health-score engine
Composes alert and anomaly scores into the published 0 to 100 health figure, with a documented deduction table per event type.
Audit chain
HMAC-SHA256 chained record of every score change, alert, work order, and signoff. Reproducible end to end.
Portal & integrations
Dashboards, role-based access, multi-tenancy, and ten outbound notification channels including email, SMS, Slack, Teams, and webhooks.
The full reference is on docs.haltless.io
Network diagrams, port lists, deployment templates, and the agent install guide. Read this before your pilot.
Open docs