What is an Edge Device?
An edge device is a device at the edge of a network, close to machines, sensors and processes, that collects data, processes it locally and forwards it in a controlled way to IT systems or the cloud. Instead of sending raw measurements unfiltered to a data centre, the edge device filters, aggregates and enriches the data on site. That makes it the physical building block of edge computing and the practical bridge between the OT shop floor and the IT world of MES, ERP and analytics.
An edge device reads, computes and publishes, but it does not control the process: that remains the job of the PLC.
🧠 What exactly does an edge device do?
An edge device combines five functions that you will find in almost every industrial application:
| Function | Explanation | Example |
|---|---|---|
| Data acquisition | Reads values from PLCs, O, sensors and meters | Counters and temperatures from an S7 PLC |
| Protocol conversion | Translates fieldbus protocols into IT-friendly protocols | Modbus RTU or Modbus TCP to MQTT or OPC UA |
| Preprocessing | Filters, compresses and aggregates raw data | Thousands of vibration samples per second reduced to one RMS value |
| Local analytics | Runs rules, scripts or machine learning models | Flagging an abnormal current draw for predictive maintenance |
| Publishing and buffering | Forwards results and holds data during an outage (store-and-forward) | Publishing to a Unified Namespace or historian |
What an edge device does not do matters just as much. Deterministic control with cycle times of a few milliseconds stays in the PLC, RTU or DCS. Safety functions such as an emergency stop belong in hard-wired safety circuits or a safety PLC, never on an edge device. An edge device usually works in soft real time: fast enough for monitoring and advice, not for hard control tasks.
🔄 What is the difference between an edge device, a gateway and a sensor?
In practice the terms overlap, but the roles can be told apart:
| Component | Primary role | Computing power | Typical location |
|---|---|---|---|
| Sensor | Measures a physical quantity (pressure, temperature, level) | Minimal, sometimes built-in diagnostics | In the process |
| Gateway | Connects networks and translates protocols | Limited, often fixed functions | Control cabinet, DIN rail |
| Edge device | Collects, processes and analyses data, runs apps | Moderate, often with containers | Control cabinet or next to the machine |
| Industrial PC (IPC) | Runs heavier software, HMI or analytics | High | Control cabinet or operator panel |
| Edge server | Several workloads per site, virtualisation or Kubernetes | High to very high | Local server room |
Many modern gateways can now run Docker containers too, and an IPC with edge software is functionally just an edge device. So look at the function: as soon as a device processes data itself and runs apps, it behaves as an edge device and deserves the same management and security attention.
Be aware of a second meaning. In IT security, governments also use the term edge device for equipment on the network perimeter, such as firewalls, routers and VPN gateways. On 5 February 2025 the Five Eyes agencies published a series of guidance documents on that category, which explicitly includes internet-facing OT systems and IoT devices. An industrial edge device that opens its own connection to the outside world in practice falls under both meanings.
🔧 What are the characteristics of industrial edge hardware?
| Feature | Typical design |
|---|---|
| Mounting | DIN rail or wall mounting in the control cabinet |
| Power supply | 24 V DC, often with a redundant power input |
| Temperature range | Fanless; industrial models often −25 to +60 °C, wide-temperature variants −40 to +70 °C |
| Field interfaces | RS-485, CAN, digital I/O, 4-20 mA, PROFINET or EtherNet/IP |
| Network | Two or more Ethernet ports (OT and IT separated), optionally 5G, Wi-Fi or LoRa/LoRaWAN |
| Software | Linux or a real-time OS, a container runtime, apps such as Node-RED |
| Security | Secure boot, a TPM for key storage, signed firmware |
Two separate network ports are more than a detail. They let the device read on the OT side and publish on the IT side without connecting the two networks directly. Do disable IP forwarding between those ports, otherwise the edge device silently becomes a router between OT and IT.
🏭 Where are edge devices used?
- Water management - an edge device at a pumping station reads levels and pump status from the local PLC and sends key values over a narrow mobile link to the central SCADA system; pump control itself stays in the PLC
- Discrete manufacturing - calculating OEE per machine from counters and fault signals, without changing the existing PLC software
- Process industry - reading diagnostic data from smart field devices, as in the second-channel approach of NAMUR Open Architecture
- Energy - measuring consumption and peaks per installation and flagging anomalies for energy management
- Quality inspection - a vision model assesses camera images on the line without images leaving the site
- Brownfield integration - connecting older machines that only offer Modbus or serial interfaces to modern data structures
🔐 How do you secure an edge device?
By definition an edge device sits on a boundary: between OT and IT, and often also between the company and a cloud platform. That makes it an attractive target and a key point in your security architecture. A well-configured edge device can actually improve cybersecurity, because fewer systems talk directly to the PLC and connections are only opened outbound.
| Measure | How to apply it |
|---|---|
| Zoning | Place the device in its own zone in line with the Purdue Model and IEC 62443; cloud traffic passes through the IDMZ |
| Outbound connections only | MQTT over TLS (port 8883) initiated by the device, no open inbound ports |
| Hardening and security by design | Minimal operating system, unused services and ports disabled, no default passwords |
| Identity and access | A unique certificate per device, managed through certificate management; personal accounts and role-based rights for management and data interfaces |
| Updates | Patch management for OS, container runtime and apps, with rollback, as part of lifecycle management |
| Visibility | Included in the asset inventory, logging to syslog or security monitoring |
For component requirements, IEC 62443-4-2 is the reference framework. The standard distinguishes software applications, embedded devices, host devices and network devices. An edge device with a full Linux system and containers most closely resembles a host device in practice, while a compact gateway with fixed firmware is closer to an embedded device.
🧱 Which European rules apply to edge devices?
| Rule | Since | Consequence for edge devices |
|---|---|---|
| Radio Equipment Directive with EN 18031 | 1 August 2025 | Edge devices with Wi-Fi, Bluetooth or a cellular modem must meet cybersecurity requirements for CE marking |
| Cyber Resilience Act - reporting | 11 September 2026 | Manufacturers report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours |
| Cyber Resilience Act - full requirements | 11 December 2027 | Secure defaults, an SBOM, security updates for a support period of in principle at least five years |
| NIS2 (Dutch Cyberbeveiligingswet) | 15 August 2026 (NL) | Users include edge devices in their risk management, monitoring and supplier management |
Under the CRA a typical edge device is a default product with self-assessment. If the device has core functions listed in Annex III, such as router, switch or VPN, the stricter Class I applies. Firewalls and container runtimes sold as products fall into Class II.
🧭 How do you select and implement an edge device?
- Start from the use case - which data do you need, how often and for whom? An OEE dashboard asks for something different than vibration analysis with thousands of samples per second.
- Inventory the sources - which PLCs, protocols and tags are there, and may you only read or also write? Default to read-only.
- Choose hardware for its lifetime - machines often last ten to twenty years; ask for the support period of firmware and platform, not just the price.
- Design the data flow - define the zone, the direction of traffic and the data model, for example MQTT Sparkplug B (Sparkplug 3.0 has also been ISO/IEC 20237 since 2023) or the OPC UA information model.
- Set up central management - rollout, updates, backups and certificates from one management environment, with clear agreements between IT and OT on who does what.
- Test and monitor - check during a FAT that the device does not load the PLC, then monitor CPU, storage, buffer level and connection status.
❓ Frequently asked questions
Can an edge device replace a PLC?
As a rule, an edge device does not replace a PLC, because it is not designed to be deterministic and does not run certified safety functions. Soft PLCs that run on edge hardware do exist, but they need extra attention to real-time behaviour and availability. The common architecture is therefore a PLC for control and an edge device for data.
Which protocols does an edge device usually support?
On the field side an edge device usually supports protocols such as Modbus, S7, PROFINET and EtherNet/IP. On the IT side, MQTT, OPC UA and REST/HTTPS are common. Which combination you need depends on the existing installation and on the target platform.
What happens to the data when the connection drops?
A good edge device buffers data locally during an outage and resends it once the connection is restored, known as store-and-forward. How many hours or days the device can bridge depends on its storage capacity and the volume of data. Specify that buffer time as a requirement when you buy the device.
Does an edge device fall under the Cyber Resilience Act?
An edge device placed on the EU market is a product with digital elements and therefore falls under the Cyber Resilience Act. The reporting obligation for manufacturers has applied since 11 September 2026, and the full requirements apply from 11 December 2027. It is usually a default product, unless it also functions as a router, switch or VPN gateway.
Where does an edge device sit in the Purdue model?
An edge device usually sits at level 2 or 3 of the Purdue Model, in its own network zone next to the control system. Connections to the cloud or the office network pass through the IDMZ and are preferably initiated outbound by the device. That way no inbound ports to the OT network have to be opened.
Is a Raspberry Pi suitable as an industrial edge device?
A consumer board such as a Raspberry Pi is fine for proofs of concept, but usually not for production. It often lacks industrial temperature ranges, a 24 V supply, long-term availability and a guaranteed update period. Industrial derivatives with a housing, DIN rail mounting and longer support do exist.
📌 In summary
An edge device collects and processes OT data close to the source and publishes only what is needed to IT and the cloud, while control and safety stay in the PLC. Choose the device for its function, lifetime and manageability, place it in its own zone with outbound connections only, and treat it as a full system in your OT architecture: inventoried, patched and monitored.