CNC

What is CNC?

CNC (Computer Numerical Control) is the computer-based control of machine tools, in which a program of coordinates and commands precisely drives the movements of the cutting tool and the workpiece. A CNC machine mills, turns, drills or cuts parts automatically and repeatably, to tolerances of a hundredth of a millimetre or better. CNC is the backbone of discrete manufacturing, from metalworking and mould making to aerospace, which makes it a key part of Industry 4.0 and of IT/OT convergence.

🕰️ Where did CNC come from?

CNC grew out of numerical control (NC). In the late 1940s John T. Parsons devised a way to move a milling machine along calculated coordinates in order to produce helicopter rotor blades. From 1949 he worked with the Servomechanisms Laboratory at MIT, funded by the US Air Force.

The difference between NC and CNC lies in the controller. With NC, the logic was hard-wired and the program was read block by block from tape. With CNC, a computer stores the program, calculates the paths and lets operators edit the program at the machine.

🔧 How does a CNC machine work?

The route from design to finished part takes five steps:

1. CAD — the designer models the part in 3D.
2. CAM — software calculates toolpaths, spindle speeds and feed rates from the model.
3. Post-processor — converts those paths into G-code in the dialect of the specific controller. G-code is defined internationally in ISO 6983-1:2009, but every vendor adds its own extensions.
4. CNC controller — reads the program, interpolates the path and sends a setpoint per axis to the drives. This is specialised motion control with cycle times of a few milliseconds or less.
5. Servo axes — each axis is driven by a servomotor and ball screw. An encoder on the motor, often supplemented by a linear scale on the axis itself, reports the actual position. The result is a closed control loop that corrects deviations continuously.

Alongside the axes, an integrated PLC handles the machine functions: tool changer, coolant, doors, clamping and safety circuits. At Siemens this is a SIMATIC PLC integrated into the SINUMERIK; at Fanuc it is the PMC (Programmable Machine Controller).

🏭 What types of CNC machine are there?

The number of axes determines which shapes are possible. A 3-axis machine moves in X, Y and Z. A 5-axis machine adds two rotary axes, so the tool can approach the workpiece from almost any angle and complex shapes such as turbine blades can be machined in a single set-up. Modern mill-turn centres combine both processes in one machine.

🧭 Which CNC controllers are most widely used?

A handful of vendors dominate the market. The machine builder, the OEM, chooses the controller, and the end user inherits that choice for the entire life of the machine.

Machine builders such as Haas, Okuma and Mazak also develop their own controllers.

🔄 How do you connect CNC machines to IT systems?

Three layers matter for IT/OT integration:

• Program management (DNC) — Direct or Distributed Numerical Control sends NC programs from a central server to the machines. Older machines still use a serial RS-232 link, sometimes with drip feeding, where the program is sent block by block because the controller memory is too small to hold it.
• MTConnect — an open standard from the US trade association AMT, first released in 2008 and published as ANSI/MTC1.4-2018. An adapter on the machine feeds an agent that exposes the data as XML over HTTP. MTConnect is read-only by design.
• OPC UA for Machine Tools — companion specification OPC 40501-1, published in September 2020 by the German machine tool builders’ association VDW and the OPC Foundation. Under the umati banner it provides a uniform information model for machine state, jobs, tools and messages. At EMO 2019, 110 machines from 70 companies were already connected through umati.

Manufacturers use this data to feed their MES and to calculate OEE: availability × performance × quality. Shops that measure OEE honestly for the first time typically land between 40 and 60 per cent on CNC machining; 85 per cent is considered world class. An Industrial DataOps layer helps harmonise data from machines with different controllers.

🔐 What security risks do CNC machines face?

CNC machines were long treated as standalone equipment. Now that they are networked, they have become a fully fledged OT target:

• Outdated controllers — many operator panels run Windows versions that no longer receive updates. Machine tools often stay in service for twenty years or more, so legacy systems are the norm in brownfield plants.
• No authentication — 2022 research by Trend Micro into controllers from Haas, Okuma, Heidenhain and Fanuc found that machines often executed commands without checking who sent them. On Fanuc, authentication is an option the user must enable; Heidenhain ships a default six-digit OEM password. The researchers found around a dozen types of attack per vendor, allowing attackers to hijack machines, damage them or steal NC programs.
• USB sticks — programs are still frequently moved on USB sticks, a well-known malware route. USB control is therefore essential.
• OEM access — machine builders provide remote maintenance through their own routers or VPN boxes, often out of sight of the IT department.
• Intellectual property — NC programs contain valuable product know-how and are a target for theft.

🛠️ How do you secure CNC machines step by step?

1. Build an inventory of every machine, controller type, software version and connection, including modems and VPN boxes installed by the OEM.
2. Segment the network in line with IEC 62443: put the machines in their own zone and let DNC and data flows pass only through defined conduits. Network segmentation stops an infected office PC from reaching the shop floor.
3. Centralise program management on a DNC server with version control, so USB sticks become unnecessary.
4. Control remote access through a jump server with MFA and logging, and enable OEM sessions only on request.
5. Protect the controller with application allowlisting on Windows-based panels where patching is not possible.
6. Set requirements at purchase — ask about IEC 62443-4-2 and take the Machinery Regulation into account, which from 20 January 2027 requires safety-relevant hardware and software in new machinery to be protected against corruption and tampering.

❓ Frequently asked questions

What is the difference between NC and CNC?

NC (Numerical Control) used hard-wired electronics and read programs block by block from punched tape. CNC (Computer Numerical Control) uses a computer that stores the program, calculates the toolpaths and allows the machining to be edited. Virtually all modern machine tools are CNC machines.

What is G-code in CNC?

G-code is the programming language used to instruct a CNC controller, with commands such as G01 for a linear move and M03 to start the spindle. Its basis is defined in ISO 6983-1 and the US standard RS-274, but every CNC vendor uses its own dialect. CAM software therefore generates G-code through a post-processor for each machine.

What does 5-axis mean on a CNC machine?

A 5-axis CNC machine moves the tool along three linear axes (X, Y and Z) and two rotary axes. This allows the tool to approach the workpiece from almost any angle. Complex parts such as blades and moulds can therefore be machined in a single set-up.

What is the difference between a CNC controller and a PLC?

A CNC controller specialises in interpolating toolpaths and driving several servo axes in synchronisation. A PLC handles logic control such as doors, pumps and tool changers. Inside a CNC machine both work together: the CNC core drives the axes and the built-in PLC handles the machine functions.

How do you read data from a CNC machine?

You read data from a CNC machine through MTConnect, through OPC UA for Machine Tools (umati) or through the vendor’s own interface, such as Fanuc FOCAS. Older machines often need an extra adapter or edge gateway. You can then use that data for vendor-independent OEE monitoring and integration with your MES.

Are CNC machines vulnerable to hackers?

Yes, CNC machines are vulnerable because they often run outdated Windows versions, expose open network services and use controllers on which authentication is missing or disabled by default. An attacker can steal programs, halt production or make the machine damage itself. Segmentation, controlled remote access and central program management reduce that risk considerably.

📌 In summary

CNC is the computer-based control of machine tools: from CAD model via G-code to servo axes that position to within a hundredth of a millimetre thanks to encoder feedback. MTConnect and OPC UA for Machine Tools turn CNC machines into valuable data sources for OEE and MES, but that connectivity calls for segmentation, controlled OEM access and security in line with IEC 62443.