The Haltless edge agent now reads Mitsubishi, Omron, Beckhoff, BACnet and PI

Q: What does the agent read on a serial line?

Modbus RTU. Plenty of meters, drives and older controllers never got an Ethernet port. The agent now reads them over RS-485 or RS-232, usually through a USB adapter, with the same registers and the same decoding as Modbus TCP. One serial port is one bus, so every device on it sits under one source and is addressed by its unit ID. Port settings default to the serial-line spec’s 19200 baud, 8 data bits, even parity and 1 stop bit. A setting that can’t work stops the agent at startup instead of failing quietly at 2am.

Q: Which PLCs does it read natively now?

Mitsubishi MELSEC. Q, L, iQ-R and iQ-F (FX5) CPUs, over the MC protocol’s 3E binary frame on TCP. There’s no maintained Python driver for it, so we wrote our own client, and it sends one kind of request: a batch read. Word devices (D, W, R, ZR, SD, and timer and counter current values) read as 16-bit integers by default, or as 32-bit integers or floats across two devices, low word first, the way MELSEC stores them. Bit devices read as 1 or 0. Addresses follow the CPU’s own numbering, which matters more than it sounds: X and Y are hexadecimal on Q, L and iQ-R and octal on iQ-F.

Q: Why read a building controller?

BACnet/IP. Air handlers, chillers and boilers keep a lot of production running, and a chiller trip can stop a line as surely as a spindle failure. They usually live on the building management system, not on the PLC network. The agent now reads their objects’ properties (present-value unless you pick another) with ReadPropertyMultiple, and falls back to one ReadProperty at a time for small controllers that can’t handle it. Binary objects read as 1 or 0, multi-state objects as their state number. A device that doesn’t answer fails the cycle within four seconds.

Q: What about data that’s already on a broker or in a historian?

Sparkplug B. If your edge nodes already publish Sparkplug B, the agent subscribes to one group’s births, data and deaths, optionally narrowed to one node or one device, and names each metric by node, device and metric. It remembers births, so data that carries only an alias still gets its name, type and unit. When a node or device dies, its values stop being reported at once instead of lingering as stale numbers. It sends no rebirth requests and no commands, and it skips historical store-and-forward metrics, since it only holds each tag’s latest value.

Modbus RTU, Mitsubishi MELSEC, Omron FINS, Beckhoff ADS, BACnet/IP, Sparkplug B and the AVEVA PI Web API join the edge agent's inputs. What each one reads, what it never sends, and where the limits are today.

Attila Peter SzucsFounder, CEO & CTONovember 6, 20266 min read

protocols
edge-agent
integrations

Rows of blue network patch cables fanning out from a rack of switches with small green status lights

Until this week, if your plant ran on Mitsubishi or Omron PLCs, Beckhoff TwinCAT, a BACnet building system or an AVEVA PI historian, our answer was “put an OPC UA server in front of it”. That’s one more box to buy, license and keep patched, and it’s usually the box nobody on the floor wants to own.

Version 0.8.0 of the edge agent reads all of them directly. Seven new inputs, fourteen in total, one agent:

Modbus RTU on an RS-485 or RS-232 line
Mitsubishi MELSEC Q, L, iQ-R and iQ-F over SLMP
Omron FINS for CJ, CS, CP, NJ and NX
Beckhoff TwinCAT variables by name over ADS
BACnet/IP building controllers
Sparkplug B edge nodes and devices
Current values from the AVEVA PI Web API

They sit next to OPC UA, Modbus TCP, Siemens S7, EtherNet/IP, MQTT and the CSV and JSON file watchers. And they follow the same rule as everything else the agent does: it reads, and only reads. Nothing is written to a PLC, no command goes to a Sparkplug node, and PI only ever gets GET requests.

Here’s what each one does, and where it stops.

What does the agent read on a serial line?

Modbus RTU. Plenty of meters, drives and older controllers never got an Ethernet port. The agent now reads them over RS-485 or RS-232, usually through a USB adapter, with the same registers and the same decoding as Modbus TCP. One serial port is one bus, so every device on it sits under one source and is addressed by its unit ID. Port settings default to the serial-line spec’s 19200 baud, 8 data bits, even parity and 1 stop bit. A setting that can’t work stops the agent at startup instead of failing quietly at 2am.

The agent also refuses to put two sources on the same port. Two clients on one line answer each other’s frames, and that’s a fault you’d rather not debug from the readings.

Modbus TCP picked up a unit ID too, for gateways that front several serial devices.

Terminal blocks in a control panel, with numbered wire markers on red, black and grey conductors

Which PLCs does it read natively now?

Mitsubishi MELSEC. Q, L, iQ-R and iQ-F (FX5) CPUs, over the MC protocol’s 3E binary frame on TCP. There’s no maintained Python driver for it, so we wrote our own client, and it sends one kind of request: a batch read. Word devices (D, W, R, ZR, SD, and timer and counter current values) read as 16-bit integers by default, or as 32-bit integers or floats across two devices, low word first, the way MELSEC stores them. Bit devices read as 1 or 0. Addresses follow the CPU’s own numbering, which matters more than it sounds: X and Y are hexadecimal on Q, L and iQ-R and octal on iQ-F.

Omron FINS. CJ, CS and CP CPUs over FINS/UDP, plus NJ and NX variables placed in CJ-compatible memory. You write addresses the way Omron does (D100, CIO0, W10, H5, A100, E1_50) and bits as D100.05. The agent sends Memory Area Read and nothing else. A non-fatal CPU error, like a low battery, doesn’t stop the readings, and an address the CPU refuses is skipped while the rest are read.

Beckhoff ADS. TwinCAT 2 and 3 PLC variables, read by symbol name, with all of a source’s variables in one sum command per cycle. When a download or an online change moves the symbols, the agent sees the symbol version change and reconnects rather than read stale offsets. It never adds a route on the PLC. That stays your call.

Siemens S7 and EtherNet/IP were already native. So a mixed line with a Siemens press, a Mitsubishi conveyor and a Beckhoff test stand now needs no gateway at all.

Why read a building controller?

BACnet/IP. Air handlers, chillers and boilers keep a lot of production running, and a chiller trip can stop a line as surely as a spindle failure. They usually live on the building management system, not on the PLC network. The agent now reads their objects’ properties (present-value unless you pick another) with ReadPropertyMultiple, and falls back to one ReadProperty at a time for small controllers that can’t handle it. Binary objects read as 1 or 0, multi-state objects as their state number. A device that doesn’t answer fails the cycle within four seconds.

One limit: devices are addressed by IPv4 address, so MS/TP devices behind a BACnet router aren’t reached yet.

A row of rooftop chiller units in soft focus against a grey sky

What about data that’s already on a broker or in a historian?

Sparkplug B. If your edge nodes already publish Sparkplug B, the agent subscribes to one group’s births, data and deaths, optionally narrowed to one node or one device, and names each metric by node, device and metric. It remembers births, so data that carries only an alias still gets its name, type and unit. When a node or device dies, its values stop being reported at once instead of lingering as stale numbers. It sends no rebirth requests and no commands, and it skips historical store-and-forward metrics, since it only holds each tag’s latest value.

AVEVA PI Web API. If PI is your system of record, the agent reads the current values of PI points and AF attributes over HTTPS, in one batched request per cycle, and keeps PI’s own timestamps and units. Bad-quality values and system states like Shutdown or I/O Timeout are skipped. It only sends GET requests, it refuses plain http except to the machine it runs on, and it doesn’t backfill history. PI stays the historian. Haltless scores what’s happening now.

Why does read-only matter here?

Most of these protocols can write. FINS has a memory write command, the MC protocol has batch writes, ADS can write a variable, BACnet can write a property, and Sparkplug B has commands. The agent sends none of them, and there’s no setting that turns them on.

It’s the same reason we gave for Siemens and Rockwell. A monitoring tool with no path back into the process stays outside the machine’s control-system validation and outside IEC 61511 safety scope. Your controls engineer doesn’t have to trust us to leave the PLC alone, because there’s no write path in the code to trust.

How was it tested?

Against protocol-accurate stand-ins, not plant hardware. The MELSEC and FINS requests are pinned byte for byte to the frames in the vendors’ manuals, and the readers were checked against an MC 3E server, a FINS server on UDP, a real BACnet stack on the loopback interface, a PI Web API that answers the way PI does, and Sparkplug B payloads written out from the schema. That’s thorough, and it’s still not the same as a twenty-year-old CJ1M with a flat battery.

So if one of these runs on your floor, you’re exactly who we want as a design partner. The first real Mitsubishi, Omron, Beckhoff, BACnet or PI site will shape these readers more than any test server.

Where do I set them up?

Each source has its own config block, with its connection keys and how values map, in the edge agent protocol docs. The integrations page lists all fourteen inputs, and the roadmap shows them under Shipped.

If you’d rather start with a number, pick your machines’ protocol on the quote form and we’ll come back with a per-machine figure, usually in about four hours.