Skip to main content
Version: 3.0 (next)

One hub, many sites

One central MaestroHub holds every site as configuration: the site's connections, its branch of the namespace and its users. Sites keep the SCADA systems or OPC UA servers they already have and send their data to it. Nothing is installed at a site.

Scenario
3 of 5
Shape
Tier 2 or 3, central · nothing at the sites
Applies to
3.0

Choose it when you have many small sites that already run SCADA or an OPC UA server, a central IT team and a reliable WAN, and you want new sites live without a site visit.

One hub, many sitesTier 2 or 3, central · nothing installed at sites
  • MaestroHub
  • Reads machines
  • Data
  • Buffered on disk
  • Management
  • Your tooling
L5EnterpriseL4BusinessL3.5Plant DMZL3OperationsL2SupervisoryL1ControlSite Ano MaestroHub installSite Bno MaestroHub installStore-and-forward: queued on the sender's disk while the far side is downStore-and-forward: queued on the sender's disk while the far side is downGroup ERPSAP S/4HANAData lakeDatabricks · SnowflakeMaestroHub · Tier 3Central: every site in one deploymentSites · connections · a UNS per siteKubernetes · data centre or cloudFirewalloutbound 8883 onlyVPN gatewaysite-to-site tunnelIgnition SCADASparkplug B · buffers itselfOPC UA serverno local bufferS7 PLCSite AOmron PLCSite AAllen-BradleySite BMetersModbus · Site BSparkplug BOPC UA · hub dials in ⚠

What you install

LevelComponentHow it runsRecommended hardware
L4 or L5MaestroHub centralTier 2 for about 1 to 10 sites; Tier 3 for more sites or for high availability. In your data centre, a cloud, or one of your factories.Tier 2: 16 vCPU, 24 GB RAM, 500 GB SSD. Tier 3: three such nodes.
SitesNothingThe sites' existing SCADA or OPC UA serversNone

There are two ways in. A site that publishes, such as Ignition with Sparkplug B, connects out through its firewall to the hub's MQTT listener. A site that only serves data, such as an OPC UA server, is reached over a site-to-site VPN with the hub's connection dialling in. Prefer the outbound pattern: it needs no inbound rule at the site.

When something fails

What failsWhat happens
The WAN to a siteThat site's data stops arriving. Sources that buffer, such as Sparkplug publishers, resend when the link returns. Sources that do not, such as a plain OPC UA server, leave a gap.
The central hubWith Tier 3, a surviving node takes over. With Tier 2, every site waits for the one node to return.

Limits. No MaestroHub runs at the site, so there is no buffer there unless the source has one. Site data leaves the site, which data residency rules may forbid. Inbound paths such as VPN polling need your security team's review.

Previous: Edge plus DMZ hub · Next: Independent plants · How to read the drawings: Deployment scenarios