Notes from the plant floor.
SCADA, MQTT, OPC, OT security, and the open-source IIoT stack — from sixteen years inside industrial control systems.
52 essays · RSS
September 2026
10 Sept 2026 · 6 min
One firewall is not segmentation
When a plant says its network is segmented, it usually means one firewall between the office and the plant, with one open room behind it. Here is what segmentation and micro-segmentation actually mean, how the work differs between an isolated plant and a connected one, and what IEC 62443 asks for as the stakes rise.
securityscadapractice
7 Sept 2026 · 5 min
Nothing was wrong with the configuration
If your historian stopped writing rows tonight, how would you find out? Every surface a plant has answers whether something is up. None of them answers when a row last landed, and those are different questions. Then, when it does break, the configuration turns out to be the wrong place to look — three confident wrong conclusions from reading config, settled in seconds by one query against the data.
historianpracticescada
4 Sept 2026 · 7 min
They didn't turn anything off. They edited the logic and the screen.
A seven-agency advisory on Iranian-affiliated actors in US controllers got read as a story about exposed PLCs and weak passwords. The exposure is the boring half. What the advisory actually describes is somebody using the manufacturer's own programming software to steal the project file, edit reusable logic blocks, disable shutdown and alarm logic, and change the numbers on the operator's screen — none of which any plant is set up to notice.
securityscadapractice
3 Sept 2026 · 8 min
The tunnel was never the hard part
Ask who could open a connection to a controller in your plant tonight and almost nobody can answer. That is not an encryption problem. Encryption got solved quietly, in about four thousand lines of code, and it is now free. What never got solved is the list of who may reach what — and the list is what the newer overlay networks are actually selling. What changes in a plant when access becomes a file you can test, plus the two places it falls over.
securityscadapracticeAugust 2026
31 Aug 2026 · 5 min
Two settings decide what your plant remembers
How often you read a value, and how much it has to change before you write it down. Both get set at installation and both get treated as storage settings, which is why people trade the wrong one. I measured them against each other on eighteen signals: at equal storage, reading less often was forty times worse at the only moment that mattered.
historianpractice
30 Aug 2026 · 4 min
A restore is not a rehearsal
Everyone says to test your backups by restoring one. I did that this week on a working gateway, and the copy I made to check the file quietly connected to the live historian and started writing to it. Nothing was misconfigured. The password and the estate's trust were inside the backup, because that is what a backup is for.
practicesecurity
29 Aug 2026 · 4 min
Back online is not the same as recording
Ransomware cases rose 22% in a month, so I ran the drill properly: killed a control system outright and timed not how long it took to restart, but how long until the plant was actually keeping records again. Twenty-four seconds to running. Thirty-three to the first real reading. And twenty-seven seconds of history that no recovery brings back.
practicehistorian
28 Aug 2026 · 5 min
Nobody knows what software is inside your plant
A new European rule starting on 11 September gives suppliers 24 hours to report a security hole that is being used against them. To find out whether that is even answerable, I counted the software inside a small plant: seven products, 2,735 separate pieces, 342 known weaknesses — and not one of them being used by anybody. The counting took four and a half minutes.
securitypractice
25 Aug 2026 · 5 min
Only what somebody wrote down gets checked
Every plant has the same quiet question: does it still match the drawing? A family of tools now promises to answer that automatically, and they do work — but I measured one on a small estate and found three kinds of change, of which only one gets noticed reliably. The third kind is invisible for ever, and no better tool fixes it.
practicescada
24 Aug 2026 · 4 min
Your historian is throwing readings away on purpose
Every plant that records data has a setting deciding which readings are worth keeping. Somebody picked it at installation and nobody has looked since. I measured what it costs across eighteen signals: on average it discards 41% of everything, but the range runs from nothing at all to two thirds — so one number is quietly making eighteen different decisions, badly.
historianpractice
23 Aug 2026 · 4 min
There is more on the plant network than anyone thinks
Water utilities across seven US states were broken into this summer through equipment that was reachable from the internet. The detail that stuck with me was not how it was done, but that nobody knew the equipment was reachable at all. So I counted my own network three separate ways. The three answers did not match, and the most official one was the worst.
securitypractice
22 Aug 2026 · 5 min
Your air gap has a vendor login
Air gaps rarely get attacked. They get renovated away — one reasonable decision at a time, by people doing their jobs properly. A vendor needs to support the machine. Finance needs the numbers. The contractor needs to load the new logic. By the time anyone checks, the gap is a diagram nobody has revisited, and the industry's own figures say most sites cannot list their own doors.
securityscada
20 Aug 2026 · 4 min
Your timestamps came from two different clocks
After a trip, the first question is the order things happened in, and the answer comes from timestamps. On the estate I run, readings reach the historian by two routes that record two different kinds of time under the same column name — one the moment the instrument had the value, the other the moment software got round to asking, drifting about a minute and a half every hour.
historianscadapractice
19 Aug 2026 · 4 min
Your historian believes whatever it is told
Plant data gets used to settle arguments — billing disputes, warranty claims, why the batch failed. So it is worth asking how a number in your historian proves where it came from. On the estate I run, the answer turned out to be that it does not. The reading arrives carrying a label it wrote for itself, and nothing between the sensor and the database ever checks it.
securityscadahistorian
18 Aug 2026 · 5 min
The plant needs to agree what time it is
Time synchronisation is the cheapest thing in a plant that nobody owns. It has no vendor pushing it, no line in the capital plan, and it only becomes visible on the day you are reconstructing an incident from timestamps that came from different clocks. Here is how much accuracy you actually need, where the time should come from, where the server belongs, and why two time sources is the worst number you can choose.
scadahistorianpractice
17 Aug 2026 · 6 min
A conduit is not a cable
If someone has handed you IEC 62443 and asked you to comply, the first thing you probably did was print the network diagram and draw boxes on it. That is the wrong drawing, and the reason is one badly chosen word. Here is what the standard actually asks for, and four groupings it expects you to have that almost no plant does — including one for the laptop your maintenance contractor plugs in.
securityscada
16 Aug 2026 · 6 min
Why nobody actually segments the plant network
Everyone agrees the plant network should be split into zones. Almost nobody does it, and the reason is not budget or laziness — it is that whoever applies the rule owns whatever stops working. There is a cheap way to remove that fear, and when I tried it on my own plant it told me the standard diagram had one important thing backwards.
securityscadaedge
13 Aug 2026 · 3 min
My resilience test passed perfectly. It had not tested anything.
I cut a network link, watched a system buffer and recover without losing a reading, and nearly wrote it up. The link had never gone down. The rule I took from it is short: a fault-injection test has to prove the fault was injected, and the evidence for that is never the thing you were measuring.
practice
12 Aug 2026 · 4 min
A site lost its link for two minutes. Those readings are never coming back.
Pulling remote sites into a central system with live tag subscriptions is the standard pattern and it works beautifully until the link drops. Then it turns out a subscription has no memory: nothing queues, nothing replays, and the outage is a permanent hole in your history. The fix is one decision about where the first durable write happens.
edgehistorianscada
11 Aug 2026 · 4 min
Half your sites have nobody looking at a screen. They still have a SCADA licence.
Standardising on one edge product is a reasonable instinct that quietly puts a full SCADA system at sites which only collect data. I built the alternative and cut the link on both: a site with no licence buffered through the outage and backfilled every reading, exactly like the licensed one. The interesting part is not the saving, it is what the licence is actually for.
edgeopen-sourcescada
10 Aug 2026 · 5 min
I killed the master gateway. The screens came back in eight seconds and the data never did.
A redundant SCADA pair is supposed to make a server failure a non-event. Mine did exactly that for the operators and quietly stopped recording the plant. Nothing was broken and nothing was missing — the failure was in which end had opened a connection, a detail that looks like a preference and behaves like a single point of failure.
scadaedgeignition
7 Aug 2026 · 5 min
I switched off every part of a streaming plant pipeline. The data only died once.
Last week I showed that Ignition 8.3 can publish straight to a Kafka-style broker with nothing in between. This week the data actually flows: live tag changes through a three-broker cluster into a TimescaleDB historian. Then I switched off a broker, the database, and the gateway in turn, and counted what each outage cost. Two of the three cost nothing at all, and the one that hurt is the one no architecture can protect.
historianunsignition
7 Aug 2026 · 7 min
You don't buy a broker for the first consumer
Every talk about modern plant data has a Kafka box in the middle of the slide, and nobody on stage explains what it does in terms a plant can use. Here is the whole argument in plain language: what the log actually is, the two questions that decide whether you need one, and an honest account of why a single station is better off without it.
unshistorian
6 Aug 2026 · 6 min
Certified is not secure
A vendor certificate tells you what a box can do. It does not tell you what your plant does. Three devices from three vendors, all capable of defending themselves, all captured with none of it switched on.
securityscada
6 Aug 2026 · 4 min
Ignition 8.3 can now do the job of the box in the middle of your drawing
I set out to write about running a SCADA gateway and a streaming platform on the same cluster, and whether they survive things being switched off. They did, easily, and that turned out to be the least interesting part. The interesting part was already sitting in the gateway, unused: a feature that removes a whole box from the architecture most people are still drawing.
ignitionunsscada
6 Aug 2026 · 6 min
Your namespace is a floor plan
A stranger on your network writes nothing, sends nothing back, and walks away with the floor plan of the plant. The better your naming discipline, the better the map you handed over. And the fix is not to make the names cryptic.
securityuns
5 Aug 2026 · 5 min
I built a Unified Namespace myself. A third of the plant was invisible.
A message broker, a naming convention, an agreement about what a reading must contain, and a small program to enforce it — the whole thing in an afternoon, running in under two and a half megabytes. Then I tried to find out what was actually on it, and forty-eight of a hundred and forty-four tags never showed up. They were the ones that only speak when something has gone wrong.
unsopen-source
4 Aug 2026 · 5 min
Node-RED didn't break at 20,000 messages a second. It broke when the database did.
Somebody will eventually tell you the little program moving your plant data is a toy, and offer you a serious replacement. I ran both side by side for a day. The speed argument turned out to be empty. The one that mattered only showed up when I switched the database off, and it cost one of them a third of an hour's production.
unsopen-source
3 Aug 2026 · 4 min
One hundred remote sites, one small server, and the wrong answer I nearly published
Can one server in the middle carry a hundred remote sites, and what happens to the other ninety-nine when one of them goes haywire? The capacity answer was dull, which is the good kind of dull. The first isolation answer said one bad site slows everyone down by three and a half times, and it was wrong, because what I had actually measured was my own equipment rather than the server.
edgeunsscada
3 Aug 2026 · 4 min
United Manufacturing Hub, explained for the person who has to maintain it
UMH is an open-source Unified Namespace platform that ships as one Docker container. That is the second version. The first needed a Kubernetes cluster, and the story of why they tore it out is the most useful thing about the project — it is a list of everything that goes wrong when you take a data centre pattern onto a plant floor.
unsopen-source
2 Aug 2026 · 6 min
Industrial AI doesn't need better models. It needs DevOps and DataOps.
Two IT disciplines the plant floor skipped for twenty years, and the reason every AI pilot dies between the demo and the rollout. Not because the model was weak — because nothing around it could be rebuilt, and nothing arriving at it carried its own meaning. Both problems now have plant-floor answers, and I have measured them.
practiceunsscada
1 Aug 2026 · 4 min
Two databases for a plant historian, and why neither one wins
Sooner or later someone suggests replacing the historian, and the room splits into two camps. I ran ten million plant readings through both databases on the same machine. One is far quicker to fill and far quicker at questions covering the whole site. The other is quicker at the thing operators actually do all day. And one setting nobody mentions is costing people about seven times more disk than they need.
historianopen-sourceJuly 2026
31 Jul 2026 · 5 min
Test your historian with made-up numbers and it will lie to you about disk
Before anyone buys storage for a plant historian, someone usually runs a trial. If the trial data is random numbers, the answer comes back about five times too pessimistic, because the squeezing a historian does depends entirely on the data behaving like a plant. Here is the difference, measured.
historianpractice
30 Jul 2026 · 6 min
Every tag needs one owner
A tag producer should have exactly one system that consumes it. I learned that by breaking it, having once built a side channel onto controllers that already had an owner. Here is what extra owners cost in tag uniformity, controller headroom and authority, why the local HMI is not an exception, and how to get disaster recovery without standing up a second truth.
scadauns
29 Jul 2026 · 5 min
The plant should still let you in when the link is down
Every plant is being asked to put its logins behind one central identity system, and the ask is reasonable. Two things nobody mentions in the design review: Ignition has no identity-provider failover, and Microsoft's on-premises MFA server stopped answering in 2024. Here is the two-tier shape that survives a dropped link, what each layer can actually speak, and why a six-digit offline code is the only second factor that fits.
securityscadaignition
28 Jul 2026 · 9 min
You don't have a backup problem. You have a reproducibility problem.
Every remote site has a backup. Almost none of them can be rebuilt — only approximated. I built eleven real Ignition gateways from a single definition, destroyed one on purpose, and had it back in sixty seconds with no backup involved. Drift, three-day changes and anxious handovers all turn out to be the same disease.
scadaignitionpractice
27 Jul 2026 · 10 min
Infrastructure as code for SCADA: one repo, twenty sites, zero drift
A change that used to mean three weeks of site visits — and still missed a site — should be one review and one merge. Here's what infrastructure as code means on the plant floor, a real edge-and-central case study in Ignition, and the contrarian reason it hasn't happened yet.
scadaignitionpractice
26 Jul 2026 · 9 min
In industrial automation, reliability beats innovation every time
Everyone calls the plant floor stuck. But it isn't behind — it's optimising for something the tech press never measures: a downtime meter that ticks in the thousands of dollars per minute. Seen that way, 'stuck' starts to look like the correct answer.
practicescada
25 Jul 2026 · 9 min
Your SCADA server doesn't need Windows anymore
The always-on half of the plant — gateways, historians, data layers — now runs better on Linux: fewer reboots, smaller footprint, config in files, and vendors that ship for it first. The numbers, the real reasons plants haven't moved, and a migration ladder that doesn't bet the plant.
scadaignitionopen-source
24 Jul 2026 · 6 min
Modbus isn't insecure. Your network is.
Modbus has no password and no encryption — and the industry has spent a decade blaming the 1979 protocol for a wound that was self-inflicted the day someone gave it a public IP.
securityedge
23 Jul 2026 · 5 min
Why Ignition became the Linux of industrial automation
Ignition didn't win by being a better SCADA. It won by refusing to behave like SCADA software at all — and the industry is still catching up to what that means.
ignitionscadaopen-source
22 Jul 2026 · 4 min
Unified Namespace isn't the future of automation. Data architecture is.
UNS is the most talked-about and least understood idea in Industry 4.0. It deserves better than the hype — because the pattern underneath it is the actual revolution.
unsscada
21 Jul 2026 · 4 min
Why the automation industry is moving beyond vendor lock-in
For thirty years the safest architecture was one vendor, everywhere. The economics behind that are unwinding — here's what's replacing it, and why it isn't the vendors' fault.
open-sourceunsscada
20 Jul 2026 · 5 min
There is no cloud SCADA. Only hybrid — done well or done badly.
A 5-layer reference architecture for the next decade of plant operations — what runs where, why, and what breaks if you put the wrong layer in the wrong place.
scadaedgeJune 2026
26 Jun 2026 · 4 min
I put a man on the wire of four OT protocols. Here is what leaked.
Modbus, EtherNet/IP, S7comm, MQTT, OPC UA. I built a lab for each, captured the traffic, and read a plant off the wire. Three of the four protocols let a stranger read every value and write the ones that matter, with no credential. The fourth could refuse, and was configured not to. Here is the whole series in one place, and the single rule underneath all of it.
securityscada
21 Jun 2026 · 3 min
OPC UA can refuse. Almost nobody asks it to.
After three protocols that hand a plant to anyone on the wire, here is the exception: one that was built to say no. I read the same value through its open door and its locked door. Through one, the value was right there. Through the other, the wire saw nothing. Then I checked which door people actually use.
securityscada
15 Jun 2026 · 3 min
Your MQTT broker probably trusts everyone
The Unified Namespace is the modern, grown-up answer to the messy plant network. Then you look at how the broker underneath it is usually configured, and it turns out the grown-up stack shipped with the front door propped open.
securityuns
9 Jun 2026 · 3 min
Your expensive PLC is just as naked as the cheap one
The comfortable answer to a Modbus scare is: buy a real controller from a real vendor. So I put a Rockwell and a Siemens controller on the bench and read them off the wire. The brand on the cabinet bought a lot of things. A lock was not one of them.
securityedge
4 Jun 2026 · 3 min
A stranger can change your pump's speed, and it takes twelve bytes
No password, no exploit, no zero-day. If a laptop can reach the network your pump is on, it can read every reading and rewrite the setpoint, and the protocol will never ask who is doing it. Here is why, in plain terms, and why the fix is cheaper than the fear.
securityedgeApril 2026
March 2026
Newsletter
New essays, by email.
SCADA, cloud, AI, and the plant floor — a short email when something new is published. No noise, unsubscribe anytime.