IT wants line data from three S7-1500s, CPU 1516-3 PN/DP, TIA V17, in their cloud broker. TLS, client certificates, their CA. Two ways to do it as far as I can see.
One is the Siemens LMQTT library in the PLC, publishing straight out, no extra box. The other is an edge gateway reading each PLC over OPC UA and publishing from there.
I put LMQTT on the bench CPU and it works, 40 tags every second with TLS. The plant manager likes the sound of "no extra box". My gut says gateway, because the certificate expires in a year and I don't fancy opening TIA to rotate it in three running CPUs.
Anyone running MQTT straight out of a 1500 in production, and did you regret it? And is there any way to rotate that certificate on a running CPU without opening TIA, because that's the bit I keep coming back to?
When the broker's unreachable, what does the bench CPU's cycle time do while LMQTT is reconnecting?
Went and looked. Cycle time jumps from 4 ms to about 9 ms in bursts while it's reconnecting, every few seconds, for as long as the broker is down. And the data during the outage is gone, there's no buffer in the library that I could find.
9 ms in bursts on a bench CPU settles it for me. The controller runs the machine. A broker on the far side of a WAN isn't its problem. Switch the OPC UA server on in the CPU properties, expose the tags there, and let a gateway subscribe to it and publish. Certificates, retries, store and forward, topic renames, that all sits on the gateway and nothing gets downloaded to a running machine. When the broker's down the gateway buffers and the CPU never notices.
Sparkplug B on the gateway if IT's broker understands it, plain topics if not. A 1 s poll on the gateway is plenty for line data, I reckon. There's a writeup on the edge layer here: https://plctr.com/utilizing-iiot-industrial-internet-of-things-with-plc-systems/
One point I'd argue. I think LMQTT in the CPU is fine on a small standalone machine with nobody behind it and one broker on the same LAN, we've got one of those and it's never given trouble. Three line controllers, a cloud broker and yearly certificates isn't that case. Gateway.
Gateway it is. What decided it was the cycle time. 9 ms on a bench CPU with nothing else in it, and on a real line with a 2 ms OB30 that's a stopped machine every time the WAN hiccups.
So, OPC UA server on each 1516, one gateway per line reading over OPC UA, Sparkplug B out to the broker, store and forward on. Certificates live on the gateway and get rotated without anyone touching TIA.
Still stuck on one thing, IT's broker is a managed cloud thing and nobody can tell me yet whether it takes Sparkplug or only plain topics. Thanks scott_m, pnina.
If their broker only does plain topics, the gateway does that too.