Edge gateway · v3.10.2
CSA STAR RegistryOne connection to each controller — PLCs, robots, drives, meters. Out the other side: OPC-UA, Modbus, Sparkplug B, SQL and REST — all at once, from one in-memory tag store, without disturbing polling. Unlimited tags, perpetual licence, ₹22,000 one-time per device.
One controller, one robot, or one PLC — same price for each, at any quantity. The incumbents meter you by tag or by driver suite, then bill 16–20% of the licence again every year. This does the connectivity job they do, priced by how many devices you actually read.
Windows and Ubuntu are the supported deployment targets, on x86-64. Docker Desktop is never required: the Windows installer provisions free Docker Engine inside WSL2, and the Debian package takes it from Docker's own apt repository. An arm64 build exists and runs, but has not been validated on a plant device.
| tag | type | value |
|---|---|---|
| Clock_Byte | uint8 | 151 |
| Clock_1Hz | bool | true |
| Clock_2Hz | bool | false |
| AlwaysTRUE | bool | true |
| System_Byte | uint8 | 4 |
| Tag_1 | int32 | 25,941 |
Replay of readings captured from the gateway in testing — S7 clock-memory tags from a simulated source, so the bits genuinely toggle. Not a connection to a plant.
The whole picture, not a list: every controller, robot and system on the intake side, the gateway's one in-memory tag store in the middle, every channel it serves out on the other — all live at the same time. Hover anything to trace its route; the legend colour-codes exactly what is released, what is early access, and what is still only written.
Those channels already reach the tools your teams run on — mostly config, no new gateway code. It streams continuously into your BI and historians, and fires alerts to your chat and on-call tools the moment a tag crosses a line or a PLC drops.
Southbound device intake — sources the gateway reads:
Early access · read-only by default · none hardware-signed-off. UR & Doosan verified against vendor simulators; the rest against protocol-accurate test doubles.
Released and quotable — in the shipped image and loopback-tested. None has yet answered that vendor's hardware, so they carry the same caveat as the robots: proven over the real wire, not yet against real steel.
Written into the build, loopback-tested, NOT released.
Gateway core: one in-memory tag store, unlimited tags, polling never disturbed, perpetual licence. Every northbound share is served at once from the same tags, with no per-tag or per-driver metering.
What has been run, and against what
Mitsubishi MELSEC over MC protocol 3E: D0 read live, then written by the gateway and confirmed by an independent read of the registers
Set on the Q03UDV in GX Works, seen by the gateway in one unbroken take
Exercised over the S7comm wire against a snap7 software server — not yet against a physical S7-1500
The gateway's own address space, served from a simulated tag source — not a plant
The bridge speaks Eclipse Tahu Sparkplug B, sequence numbered and correctly refusing to retain DDATA
Each cycle sends only what moved, by alias rather than by name
One controller family has met real steel. The Mitsubishi MELSEC driver was exercised on a physical Q03UDV over MC protocol 3E frame with the simulator switched off — reads and gateway-initiated writes, each write confirmed by an independent read of the CPU's own registers. That is Q series: iQ-R and iQ-F share the driver but were not the CPU on the bench. Everything else on this strip was measured over the real wire protocol against a software server or the gateway's own tag store: the Siemens S7comm driver against a snap7 server rather than a physical S7-1500, and the OPC-UA, Sparkplug B and report-by-exception behaviour against the gateway's own tag store, which on that run was filled by a simulated device rather than by any controller. The Rockwell and Modbus drivers are implemented and unit-tested and have not been run against that vendor's hardware either — we will say so until they have been.
The same gateway, six different jobs. Every one of them is somebody replacing a licence, a middleware box, or a week of integration work.
Every customer wants the data in a different place: this one runs Ignition, that one wants it in SQL Server, a third has an MQTT broker and a data team.
One gateway in the panel. It reads the PLC once and serves OPC-UA, Modbus, Sparkplug B, SQL and REST at the same time. You stop writing a bespoke integration per customer, and the licence ships with the machine.
A brownfield line is a Siemens cell next to a Mitsubishi cell next to a decade-old Modbus meter, and your SCADA speaks one of them well.
Point the gateway at all of them, then point your SCADA at the gateway's OPC-UA server. Tags arrive with ISA-95 paths, engineering units and quality already attached.
Getting PLC values into SQL usually means a historian licence, a connector licence, and a middleware box that someone has to own.
The SQL share writes straight into PostgreSQL, MySQL, SQL Server or SQLite — insert for history, upsert for a live mirror. The table is yours; the gateway never issues DDL against it.
Sparkplug is what makes an MQTT host discover your tags instead of an integrator mapping them by hand — and it is usually a paid module.
Birth and death certificates, self-describing metrics, aliases and sequence numbers. Included, not an add-on. Ignition, HiveMQ and Cirrus Link consume it directly.
A robot needs one bit from the press, and getting it there means a PLC programmer, a spare I/O card and a shutdown — or a script on a laptop under somebody's desk.
Pick the tag in the gateway UI, pick the device to hand it to, and the gateway keeps the two the same — one way, or both ways. It opens only the tags you approve on that screen, refuses a pairing the controller would reject, and shows the delay it actually measured.
An edge box that stops publishing looks exactly like a line that stopped running, and you find out from the person who needed the report.
Every gateway heartbeats to the control plane with device health, tag quality, disk and buffer state. Pull logs, restart, or free space remotely from a closed list of commands.
Kepware sits between your PLCs and your SCADA doing protocol translation, and renews every year whether or not anything changed.
This does that job — same OPC-UA interface out, same drivers in — for a one-time per-device fee. Your SCADA does not know the difference; it just connects to a different endpoint.
Not one of those six? We also write industrial software to order — protocol bridges, PLC-to-MES plumbing, operator tooling. The software layer, never the control logic.
Custom buildsShort takes from the build. Watch a few seconds here — each card says what it is showing — and the full cut is on the channel.
6,007 tags off a Mitsubishi Q03UDV, laid out as a car-body pretreatment line. A full read of every tag takes about a second; nothing bad, nothing dropped.
Real terminal output on the bench · rendered stat frame
See fullA Q03UDV on the bench: a value written in GX Works2 lands in the gateway about three-quarters of a second later, in one uncut take.
Real hardware · uncut · localhost gateway
See fullOne captured OPC-UA value driving a gauge that reads like modern software, not a 1998 HMI.
Concept UI over OPC-UA · captured replay
See fullFour plants, MELSEC next to S7, on a single fleet view — read without a site visit.
Concept fleet UI · no latency measured
See fullRead a controller once, serve it as OPC-UA, Sparkplug B, SQL and REST at the same time.
Two of the four proven on hardware · concept UI
See fullVerdict grading a part against twelve tags and returning a single pass/fail.
Verdict v0.1.0 · illustrative demo feed
See fullFive-year total cost for eight controllers — PandaLogix against Kepware and Ignition, on the live calculator.
Real screen recording · pandalogix.net
See fullHow a single 32-bit float is really two Modbus registers — and what reading them wrong looks like.
IEEE-754 of the captured value · concept UI
See fullAn honest table, including the rows where we lose. Cost is shown as a multiple of one PandaLogix licence.
Four products, four renewals, four vendors when data stops.
Reading one brand of PLC
Kepware IoT Gateway, or Cirrus Link on Ignition
Getting tags into a database
Knowing an edge box died
Same interfaces out. One licence, no renewal.
All four jobs, one service
Not a SCADA. If you need operator screens, keep the one you have and point it at this over OPC-UA.
| PandaLogix | PTC Kepware | Ignition | AVEVA InTouch | Siemens WinCC | |
|---|---|---|---|---|---|
| Licensed by | Device count. Unlimited tags | Driver suite, per server | Server + modules | Tag count | PowerTag count |
| Entry price, relative | 1× — one-time, the baseline | ≈ 7× ours + 20%/yr | ≈ 4.5× ours per server, unlimited tags | ≈ 7× ours (1k tags) | Quoted by reseller |
| Perpetual licence | Yes | Perpetual or subscription | Yes | Moving to Flex subscription | Yes |
| Runs headless on a plant PC | Yes — Docker or native | Yes | Yes | Windows only | Windows only |
| Linux support | Yes | Kepware Edge, yes. Kepware Server, no | Yes | No | No |
| OPC-UA server out | Included | Included | Module | Add-on | Included |
| Sparkplug B | Included | Add-on | Cirrus Link module, priced separately | Add-on | Limited |
| SQL historian logging | Included — Postgres, MySQL, MSSQL | DataLogger add-on | Historian suite, priced separately | Historian, separate | Separate |
| Cloud fleet management | Included | ThingWorx, separate | Separate | AVEVA Connect, separate | Insights Hub, separate |
| Full SCADA / HMI screens | No — that is not what this is | No | Yes, excellent | Yes, excellent | Yes |
| Installed base and ecosystem | New | Very large | Large | Very large | Very large |
“× ours” is a multiple of one PandaLogix device licence — ₹22,000, perpetual, unlimited tags. Multiples are rounded down to the nearest half, so rounding never flatters us. The published prices behind them are linked under the assumptions of the five-year estimator below.
Ignition and AVEVA build SCADA screens; this does not, and will not. Kepware has driver coverage two decades deep, including protocols we have never touched. All four have an installed base, a partner network and a support organisation that a new product does not. If you need operator graphics, buy one of them — and point it at this over OPC-UA, which is the combination most plants actually want.
Move the slider to your plant. Every figure is a multiple of what PandaLogix costs at that size, built from published list prices and sourced public estimates with each vendor’s own maintenance rate applied — the sources are linked in the assumptions.
Controllers, robots, PLCs — one licence each. Five-year cost of ownership as a multiple of ours, licence plus published maintenance.
Adjusting the device count updates a five-year cost comparison against PTC Kepware and Ignition below, shown as multiples of the PandaLogix cost.
1× once + nothing a year · 8 perpetual licences at ₹22,000, and nothing after it
≈ 3× once + ≈ 60% a year × 4 · licence at 8 machines, then PSP 20%/yr
≈ 3.5× once + nothing a year · one central server, unlimited tags · MQTT priced separately, not included
Over five years the cheaper of the two costs ≈ 3.5× what ours does — and you still own the licence at the end of it. Kepware’s renewal alone is ≈ 60% of our entire licence, again every year, for as long as you run it. Ours is nothing.
₹22,000 one-time per device — one controller, one robot, or one PLC — perpetual, at any quantity. No tag metering, no renewal, no module unbundling.
The shape of it is settled: a one-time perpetual licence at ₹22,000 per device — one controller, one robot, or one PLC — flat at any quantity, with no per-tag metering and no annual maintenance attached to a machine you have already shipped. The estimator above puts a number on that at your device count.
What it cannot price is your deployment — which devices, what you are replacing, and whether you are embedding this in a machine you ship by the hundred. That comes from us, in writing, and usually the same working day.
Everything downstream of the drivers reads from one in-memory TagStore, never from a driver. A tag has exactly one name — its ISA-95 FQID — across the MQTT topic, the OPC-UA BrowseName, the Modbus register map and the REST path. Adding a northbound protocol therefore cannot destabilise PLC polling.
Southbound drivers connect, poll, decode and scale. One connection per device, shared by everything that consumes it.
Siemens S7
S7-300 / 400 / 1200 / 1500, LOGO
ISO-TCP · 102
Mitsubishi MELSEC
Q / L / iQ-R / iQ-F
SLMP · 1025
Modbus/TCP
PLCs, drives, meters, RTU gateways
Modbus · 502
Rockwell Logix
ControlLogix, CompactLogix
EtherNet/IP · 44818
OPC-UA client
Any third-party OPC-UA server
OPC-UA · 4840
Northbound shares publish the same poll to the plant's own systems. Writes are default-deny, permitted per tag and per share.
OPC-UA server
SCADA, MES, historians
opc.tcp · 4840
Modbus/TCP slave
Legacy HMIs, panel meters, older SCADA
5020
SQL / ODBC logger
Writes readings into a plant database
ODBC
MQTT bridge
A customer's own MQTT or UNS broker
outbound
REST
Custom applications, dashboards, scripts
on port 8000
A gateway that only ships data to a cloud still leaves the site needing an OPC server for its local systems. This one serves both from the same poll, so for the common SCADA/MES integration cases it takes the place of a separate Kepware (or equivalent) installation: one connection to the PLC, one tag namespace, one thing to license and patch.
Telemetry to PandaCloud runs over MQTT at QoS 1 with a disk-backed store-and-forward buffer that replays oldest-first when the link returns. It is separate from the northbound shares, which keep serving the plant either way.
New · second product in the family
Poka-yoke and quality checks, sold as software on a camera you choose. Pick the job from a library of twelve applications, connect a camera, draw the inspection area on your own live picture, show it good parts — it is judging within the hour.
And because it is built on this gateway, every verdict is twelve tags in the tag store: your SCADA, MES and historian read inspection results over OPC-UA, Modbus, Sparkplug B, SQL or REST exactly the way they read everything else on this page. No vision vendor's island, no second integration.
Presence and variant checks run on a USB webcam or a phone camera. Defects and gauging want a ₹5,000 global-shutter board camera. The feasibility calculator tells you which — before you buy anything.
Show it good parts; it calculates its own threshold and predicts its false-reject rate. You never have to supply a defective example to start, and it stays in shadow until it has earned the reject output.
The reject pulse leaves on a digital output before anything is stored or published. The data path — pictures, records, drift monitoring — never sits between the camera and the cylinder.
Each NG stores the frame with the suspect region marked, so an operator can hold the part next to the picture. Corrections feed back as labels. Drift monitoring says when the light has aged — before the false rejects start.
Verdict is in early access, running on pilot benches now. The full page lays out the three engines, what it checks, how to evaluate it today, and exactly what has and has not been validated.
Every build is published with its SHA-256. This gateway goes onto plant equipment, so check the digest before you run the file — the command for each platform is under its downloads.
Pick the machine you are installing on.
v3.10.2
Machine
Plant PC or server, 64-bit Windows 10 build 19041 or newer.
Build
PandaLogixEdgeGateway-3.10.2-Setup.exe
The normal Windows install. Runs the gateway as a container and pulls its image during setup.
Download258 KBSHA-256
63f45e9666befc07bce5fb2948e3057861862accbcc59bd9bd2481618f6a969e
Before you install on Windows PC
Verify what you downloaded
Run this in Command Prompt from the folder you downloaded into, then compare the digest it prints with the one on the card above. Comparison is case-insensitive. If they differ, delete the file — do not install it.
certutil -hashfile "PandaLogixEdgeGateway-3.10.2-Setup.exe" SHA256The gateway runs and serves the plant on its own. Activation is what connects it to this console.
1Run the installer
It provisions a container runtime if the machine has none, writes the configuration, starts the gateway and verifies that it answers before reporting success. Nothing mutable is written beside the code.
2Open the gateway's own UI
It serves its UI on port 8000 — browse to http://<gateway-host>:8000/. It answers without a password, the way a panel HMI does, so before the box goes onto a routed network turn on Settings → Local API access → Require the local API token. That screen mints the token for you.
3Issue an activation token here
Create an account on this console — it is free and takes a minute — add your organisation, then open its Activation tokens tab and issue one. A trial token costs nothing, runs for seven days and covers two controllers. The plaintext is shown exactly once; only its digest is stored.
4Paste it into the gateway
Settings → Activate. The gateway exchanges the token for a session token and broker credentials, adopts the ISA-95 hierarchy for the site, and starts heartbeating. It appears in the console within a minute.
The container is the right answer on most machines and the wrong one on some. A container cannot be placed on a physical Windows NIC — network_mode: host inside WSL2 means the host of the virtual machine, not the Windows box.
| The machine | Install path |
|---|---|
| Windows PC that polls PLCs over a routed network | Windows installer |
| Windows PC serving OPC-UA or Modbus to clients that route to its LAN address | Windows installer, with the advertised host set |
| Windows PC dual-homed onto an isolated OT VLAN, or a PLC that must reach the gateway at a fixed address on that VLAN | Native Windows serviceNot the container |
| Ubuntu or Debian server on the plant network | Debian package, on a machine that already has a container runtime |
| A laptop for development, a demo, or a proof of concept | macOS package — not a plant deployment target |
The native Windows service is not one of the installers on this page. It is the PyInstaller build plus NSSM, installed with deploy\windows\install-service.ps1 from the release archive. Ask us for it if that is the machine you have.
Activation tokens are issued from the operator console: create the organisation, lay out its ISA-95 hierarchy, then issue a token for the gateway. The plaintext is shown once and never stored.