Modern predictive maintenance is evolving from theoretical models to real-world engineering implementation. Industrial enterprises are striving to predict equipment failures before they impact production. However, in practice, this transition is complicated by a significant hurdle: how to securely and continuously transmit massive volumes of raw data from closed operational technology (OT) networks to machine learning (ML) analytics platforms.
The primary task for an IoT architect is to build a standardized, secure data pipeline that does not require replacing existing SCADA systems. This is achieved by utilizing the OPC UA standard for telemetry normalization and clearly distributing computation between the network edge (Edge) and the cloud (Cloud).
Why SCADA is not designed for ML: the architectural gap between automation and analytics
Traditional SCADA (Supervisory Control and Data Acquisition) systems and programmable logic controllers (PLC) are optimized for continuous monitoring and real-time process control. Their priority is maximum availability and low latency in command processing.
In contrast, machine learning requires different conditions: large volumes of structured time-series data, high sampling frequencies, and powerful computational resources to run complex algorithms. According to the NIST SP 800-82 Guide to OT Security, process availability is the highest priority in industrial environments, and legacy equipment often cannot be updated quickly. Attempting to burden existing industrial databases with analytical queries can cause control system degradation, which is unacceptable.
Furthermore, data in SCADA is typically isolated. Different manufacturers use proprietary protocols, which complicates direct integration with external analytical platforms and creates technological data silos.
Standardization via OPC UA: overcoming the chaos of proprietary protocols
The solution to compatibility issues lies in using the OPC UA (OPC Unified Architecture) standard. According to the OPC Foundation, this is a platform-independent architecture designed for secure and reliable interoperability between industrial equipment, SCADA/MES, and corporate IT systems.
The main advantage of OPC UA is its ability to transmit not only raw values but also extended metadata (units of measurement, critical thresholds, sensor status). This allows for the normalization of heterogeneous data streams from legacy PLCs into a unified format ready for processing by ML models.
However, it is important to understand that using OPC UA does not automatically eliminate all cyber threats. Although the protocol supports authentication and encryption, without additional security measures such as physical network segmentation, connecting external systems creates risks for the OT circuit.
Distributing computation: when to filter telemetry at the Edge versus sending it to the Cloud
One of the key mistakes is attempting to transmit all raw telemetry to the cloud. According to the AWS Well-Architected IoT Lens, when designing a system, it is necessary to make clear decisions regarding which data is processed locally (Edge) and which is processed in the cloud (Cloud).
For predictive maintenance, a hybrid approach is most effective:
- At the Edge level: Edge Gateways collect high-frequency data (e.g., from vibration sensors), perform initial filtering, reduce noise, and calculate aggregated metrics. Lightweight Edge AI models can run here to detect critical anomalies instantly. This significantly reduces the volume of information sent over the network.
- At the Cloud/On-premises level: Only filtered metrics and events are sent to a centralized repository. Here, heavy ML models are deployed, which learn from historical trends, calculate remaining equipment life, and optimize long-term maintenance schedules.
OT security under ISA/IEC 62443: data transmission architecture
Because industrial systems contain legacy equipment that cannot be easily updated, any external connection poses a risk. Protecting such environments requires a strict network architecture based on the ISA/IEC 62443 series of standards—a regulatory framework applied in over 20 industrial sectors.
Secure telemetry output is built through a demilitarized zone (DMZ): data is transmitted using a "push" principle, where the connection is initiated exclusively from within the secure OT segment outward. This prevents direct access from the IT network to industrial controllers, maintaining the priority of process continuity.
Practical stack: from sensor to ERP
In practice, the end-to-end process works as follows: a vibration sensor sends a high-frequency signal to a controller. An Edge gateway normalizes this data via OPC UA, filters it locally, and transmits aggregated metrics through a message broker into the industrial DMZ. From the DMZ, the telemetry is retrieved by an ML platform that analyzes degradation trends. If the algorithm detects signs of a malfunction, it generates a predictive event.
To implement such complex architectures, industrial enterprises engage specialized experts. Specifically, within the Intecracy Group—an alliance of independent companies linked by partner agreements and share exchanges—the company Softengi (which holds certification for AI management systems under the international standard ISO/IEC 42001:2023) ensures the secure development and implementation of ML models. Meanwhile, to transform analytical insights into real business actions (e.g., automatically creating a maintenance work order in an ERP), the corporate low-code platform UnityBase (a joint development of Intecracy Group companies) is used. Thanks to the use of a unified domain metadata model, automatic REST API generation, built-in access control mechanisms (RLS/ACL), and a detailed audit trail, solutions based on UnityBase allow for the reliable integration of digital forecasts with enterprise operational processes.
It is worth noting that no ML model guarantees значна частина prediction accuracy or completely eliminates the need for planned maintenance. However, a standardized pipeline based on OPC UA, Edge computing, and ISA/IEC 62443 standards minimizes unexpected production downtime and significantly reduces operational costs.
Architectural decision matrix: Edge vs Cloud for industrial ML
| Comparison criteria | Edge Processing | Cloud/On-premises ML Platform |
|---|---|---|
| Data and analysis type | High-frequency raw signals, fast anomaly filtering. | Historical trends, training heavy ML models. |
| Latency requirements | Milliseconds (instant response to critical deviation). | Minutes/hours (long-term planning). |
| Data transmission volume | Minimal (only aggregated metrics and anomalies). | Maximum (requires significant network bandwidth). |
| Impact on OT security | Minimal (local processing within a secure segment). | Requires segmentation and gateways via DMZ per ISA/IEC 62443. |
FAQ
How to integrate legacy PLCs without OPC UA support into a predictive maintenance system?
Use Edge Gateways that locally read data from legacy controllers via proprietary protocols, then normalize and convert it into a standardized OPC UA format for transmission.
What ISA/IEC 62443 requirements must be considered when transmitting telemetry from SCADA to the cloud?
The primary requirement is network segmentation using a demilitarized zone (DMZ) to prevent direct communication between IT and OT networks. Data transmission must be initiated exclusively from within the secure OT segment (a "push" model).
How to reduce cloud traffic costs when collecting high-frequency data from vibration sensors?
Implement edge computing. Instead of sending raw high-frequency signals to the cloud, an Edge gateway processes data locally and transmits only aggregated metrics or anomaly alerts, significantly reducing network load.