Edge Gateway or Direct PLC to Cloud: Which Architecture Fits

A remote pump station on a metered cellular plan polls 1,000 tags every second and ships raw JSON straight to the cloud. Nobody notices until the carrier bill arrives at over 300 gigabytes for one machine. Somewhere else, a PLC's native cloud connector loses its WAN link for four hours and simply drops every reading generated during the outage, because the controller has nowhere to put them.

Both failures trace back to the same decision: whether an edge gateway sits between the controller and the cloud, or the PLC talks to the cloud directly. That single architectural choice determines your bandwidth bill, your exposure during an outage, and how exposed your control network is to the internet.

TL;DR: An edge gateway filters, buffers, and secures data between PLCs and the cloud; a direct connection skips all three. Report-by-exception filtering plus binary compression can cut a machine's monthly cellular data from 311 GB to under 5.18 GB (NotebookLM, Edge Gateway notebook, 2026). Direct connections make sense on IPC-based controllers with spare CPU, or for a single machine with no fleet to manage - everything else favors a gateway.

Sparkplug B and MQTT do the heavy lifting on both sides of this decision. If you need the transport fundamentals first, see what Sparkplug B actually structures and how OPC UA compares to MQTT for the semantic layer riding on top of either architecture.

What Does Each Architecture Actually Do?

A direct PLC-to-cloud connection runs a cloud client, usually MQTT or HTTPS, inside the controller's own firmware, publishing telemetry straight to a broker with no intermediate hardware (NotebookLM, Edge Gateway notebook, 2026). An edge gateway sits between the PLC and the cloud, polling the controller over its native protocol and republishing a translated, filtered version northbound.

The gateway earns its place by acting as what the research calls a universal translator. Southbound, it speaks the plant floor's protocols: Modbus TCP and RTU, PROFINET, EtherNet/IP, Siemens S7comm, BACnet, HART. Northbound, it republishes over MQTT with Sparkplug B, OPC UA, or a REST API, in a format the cloud actually expects (NotebookLM, Edge Gateway notebook, 2026).

That translation does more than change wire formats. A raw Modbus register like 40001 carries no meaning outside a lookup spreadsheet. The gateway attaches engineering units, asset hierarchy, and a timestamp before the value ever leaves the building, converting an opaque number into a self-describing tag (NotebookLM, Edge Gateway notebook, 2026).

Direct connections skip that layer entirely. Vendors increasingly build MQTT and OPC UA clients into controller firmware, but the PLC still has to do the translation work itself, competing for CPU cycles against the deterministic control loop it was built to run.

Citation capsule: An edge gateway polls PLCs over native OT protocols like Modbus and PROFINET, then republishes normalized, structured data over MQTT, Sparkplug B, or OPC UA northbound. A direct connection runs that same client inside the PLC's own firmware instead, with no translation layer between the controller and the cloud (NotebookLM, Edge Gateway notebook, 2026).

Not every direct connection is a bad one. Controllers like Beckhoff TwinCAT 3 run on multi-core industrial PCs rather than constrained microcontrollers, with spare CPU to handle JSON serialization and secure MQTT publishing inside the real-time loop without degrading scan time (NotebookLM, Edge Gateway notebook, 2026). That changes the calculus for the next section, but it does not change the outage problem.

What Happens When the Network Drops?

A PLC has no onboard SSD, no local database, and no RAM to spare for buffering telemetry during an outage - so a dropped WAN connection on a direct architecture means permanent data loss, not a delayed delivery (NotebookLM, Edge Gateway notebook, 2026). An edge gateway solves this with disk-backed store-and-forward buffering that PLCs structurally cannot provide.

The mechanism is straightforward. The gateway constantly monitors the health of its connection to the cloud broker. The instant it detects a disconnect, it reroutes incoming PLC tags, alarm transitions, and historical records to a local SQLite database or onboard SSD instead of trying to push them out (NotebookLM, Edge Gateway notebook, 2026).

Two details make that buffer trustworthy once the network comes back. Every reading gets a source-level timestamp marking the exact millisecond it was polled from the PLC, so a four-hour outage doesn't compress into a single misleading timestamp when the backlog finally drains. And the gateway replays that backlog in strict chronological order, first in first out, before resuming live data (NotebookLM, Edge Gateway notebook, 2026).

Buffer capacity isn't unlimited. Typical onboard storage runs 4 to 32 GB, and gateways raise a high-water mark alarm around 80 percent full, warning operators before the drive actually overflows (NotebookLM, Edge Gateway notebook, 2026). That alarm is the difference between a planned response and silent data loss on a long outage.

Citation capsule: PLCs lack the onboard storage to buffer telemetry through a network outage, guaranteeing data loss on a direct connection. Edge gateways resolve this with disk-backed store-and-forward buffering, source-level timestamping, and chronological FIFO replay once the connection returns (NotebookLM, Edge Gateway notebook, 2026).

What Does the Bandwidth and Cost Math Actually Look Like?

Uncompressed JSON polling 1,000 tags every second can consume more than 311 GB per machine per month on a direct connection, while an edge gateway running report-by-exception filtering with Sparkplug B compression drops that same load below 5.18 GB (NotebookLM, Edge Gateway notebook, 2026). That's a 90 to 99 percent cut in WAN traffic, and it changes which cellular plan even makes sense.

The two mechanisms behind that cut work together. Report-by-exception publishes a value only when it crosses a deadband threshold, so a motor holding steady at one temperature generates no traffic at all. Sparkplug B's Protobuf encoding then shrinks whatever does get sent to about 20 bytes per tag, against roughly 120 bytes plus 500 bytes of headers for a JSON payload (NotebookLM, Edge Gateway notebook, 2026).

Cellular carriers price by the megabyte, and the gap between plan tiers is steep. NB-IoT runs $1 to $5 a year for payloads under 1 KB; LTE-M costs $1 to $3 a month; standard LTE or 5G for high-bandwidth traffic runs $5 to $10 or more a month (NotebookLM, Edge Gateway notebook, 2026). Pay-as-you-go data sits at $0.05 to $0.10 per MB, while pooled enterprise plans push that below $0.01 per MB at fleet scale.

Overage fees are where a direct connection turns into a real liability. Carrier overage rates commonly run $1.50 per megabyte, so a firmware bug that pushes 1 GB of diagnostic data in a single day can generate an unexpected $1,500 bill that month, a 150-fold jump over the plan's normal rate (NotebookLM, Edge Gateway notebook, 2026).

Citation capsule: A direct PLC connection sending uncompressed JSON at 1,000 tags per second can consume over 311 GB a month per machine, while an edge gateway with report-by-exception filtering and Sparkplug B compression cuts that below 5.18 GB, a 90 to 99 percent reduction in WAN traffic (NotebookLM, Edge Gateway notebook, 2026).

Where Should the Security Boundary Sit?

The security boundary between the plant floor and the cloud belongs at an Industrial Demilitarized Zone, positioned at the junction of Level 3 site operations and Level 4 enterprise IT under the IEC 62443 zones-and-conduits model (NotebookLM, Edge Gateway notebook, 2026). An edge gateway is what physically enforces that conduit; a direct PLC connection routes straight through it, or around it.

Three mechanisms make the gateway's placement work. It runs dual network interfaces, one on the isolated OT network and one facing the DMZ or cellular link, bridging the two without ever routing IP packets between them (NotebookLM, Edge Gateway notebook, 2026). That stops an attacker who compromises the IT side from pivoting straight into the controller backplane.

The gateway also initiates outbound-only connections, typically over port 443 or 8883, which lets the local firewall block all inbound traffic and keeps the OT network invisible to external scanners (NotebookLM, Edge Gateway notebook, 2026). And it absorbs the cryptographic burden - TLS 1.3, mutual authentication, X.509 certificate verification - so legacy PLC protocols with no built-in authentication never touch an encrypted channel directly.

A direct PLC connection removes that protocol break. The controller's own IP now sits on a path toward the internet, and most PLCs lack the secure hardware, like a TPM chip, to protect credentials; static tokens and certificates often end up stored in plain-text flash memory instead (NotebookLM, Edge Gateway notebook, 2026). If you're evaluating the wider architecture that a UNS-style deployment plugs into, what a Unified Namespace actually centralizes covers the layer that typically sits on the cloud side of this same boundary.

Citation capsule: IEC 62443's zones-and-conduits model places the OT-to-IT security boundary at an Industrial Demilitarized Zone between Level 3 and Level 4. An edge gateway enforces that conduit with dual-homed interfaces, outbound-only connections, and a protocol break that absorbs TLS encryption on behalf of PLCs that have none built in (NotebookLM, Edge Gateway notebook, 2026).

Why Does Control Have to Stay Local?

PLC scan cycles run in single-digit milliseconds, while a round trip to the cloud over a WAN or cellular link takes 200 to 2,000 milliseconds - roughly three orders of magnitude too slow for deterministic control (NotebookLM, Edge Gateway notebook, 2026). That gap is why control logic never moves to the cloud, regardless of which architecture handles telemetry.

The risk isn't abstract. Robotic controllers hold sub-millisecond timing across a motion profile, and just 50 milliseconds of network jitter is enough to break a pick-and-place sequence (NotebookLM, Edge Gateway notebook, 2026). A PLC forced to also compile JSON payloads and manage TLS handshakes for a direct cloud connection can see its scan time spike from 5 milliseconds to 15-50 milliseconds under that added load.

Those spikes compound when multiple direct connections run in parallel. A controller feeding a local SCADA system, a cloud historian, and a diagnostic tool simultaneously can saturate its own communication processor, and that resource starvation degrades the scan cycle enough to trip a hardware watchdog and halt the machine (NotebookLM, Edge Gateway notebook, 2026).

An edge gateway removes that contention by taking over translation and encryption entirely, leaving the PLC free to run its control loop without competing for CPU. If you're choosing the controller class before you even reach this problem, PLC vs PAC vs RTU covers where each platform's real-time budget comes from in the first place.

Citation capsule: A cloud round trip runs 200 to 2,000 milliseconds against a PLC scan cycle measured in single-digit milliseconds, and even 50 milliseconds of jitter can break a robotic motion sequence. Direct cloud connections risk scan-time degradation from 5 milliseconds to 15-50 milliseconds under IT workload, which an edge gateway avoids by keeping that work off the controller (NotebookLM, Edge Gateway notebook, 2026).

Who Patches What, and How Often?

PLC firmware gets patched rarely, often across a five to twenty year hardware lifecycle, and only after the system integrator or manufacturer validates the update - a manual change cycle that consumes about 59.8 hours of skilled engineering time (NotebookLM, Edge Gateway notebook, 2026). Edge gateways patch far more often, and mostly without a person in the loop.

That gap exists because a gateway faces the outside network directly, so a critical vulnerability has to be fixed within hours or days, not weeks or months (NotebookLM, Edge Gateway notebook, 2026). Fleet management platforms like balenaCloud, Mender, and Siemens Industrial Edge push cryptographically signed over-the-air updates to hundreds of gateways at once, and roll a device back automatically if an update fails midway.

Skipping that discipline on the PLC side produces what the research calls baseline drift: undocumented changes accumulate, firmware versions diverge across sites, and nobody can say with confidence what's actually running where (NotebookLM, Edge Gateway notebook, 2026). A gateway sitting in front of that PLC absorbs the patching burden instead, treating the controller underneath as a sealed, untouched black box.

The stakes are not theoretical. Manufacturing downtime has cost an estimated $17 billion across 858 documented incidents since 2018, and unmanaged, poorly tested changes to industrial systems are a recurring cause (NotebookLM, Edge Gateway notebook, 2026). A gateway's automated rollback exists specifically to keep a failed update from becoming one of those incidents.

Citation capsule: PLC firmware patches happen rarely, requiring manufacturer validation and roughly 59.8 hours of manual engineering time per cycle. Edge gateways patch within hours or days via automated, signed over-the-air updates with automatic rollback, isolating the PLC from that burden entirely (NotebookLM, Edge Gateway notebook, 2026).

How Do You Choose?

Choose an edge gateway by default for any fleet larger than a handful of machines, anywhere a metered cellular link is involved, or wherever the PLC touches a network you don't fully trust. Choose a direct connection only where the controller has genuine spare CPU or the deployment is small enough that a gateway's overhead doesn't pay for itself.

Beckhoff TwinCAT 3 running on an industrial PC is the clearest case for direct: it has multi-core headroom and native MQTT support built into the real-time environment, so the translation work doesn't compete with control (NotebookLM, Edge Gateway notebook, 2026). Simple retrofits extracting a cycle count from an AutomationDirect or Click PLC fall into the same bucket - low frequency, low stakes, no fleet to manage.

Fleet scale flips the answer. Operating hundreds of PLCs without a gateway architecture reliably produces baseline configuration drift, and the manual labor to keep that fleet patched and compliant becomes its own ongoing cost center (NotebookLM, Edge Gateway notebook, 2026). At that scale, a gateway's automated OTA updates and store-and-forward buffering stop being a nice-to-have and start being the only practical way to operate.

Licensing costs push the same direction. The embedded OPC UA server on a Siemens S7-1500 needs a paid runtime license tiered by node count, and restricts you to 100 variables without one - a gateway like the Opto 22 groov EPIC ships with a free CODESYS runtime instead, sidestepping that constraint entirely (NotebookLM, Edge Gateway notebook, 2026).

Hardware selection follows from whichever path you pick. A gateway handling protocol translation and local analytics needs an x86 board with 4-8 GB of RAM if you're running containerized workloads, or a lighter ARM board for simple aggregation; either way it needs a fanless design rated -40C to +70C, DIN-rail mounting, 30g shock tolerance, and a 9-36 VDC wide input to survive a factory cabinet (NotebookLM, Edge Gateway notebook, 2026).

Frequently Asked Questions

What does an edge gateway do that a direct PLC connection cannot?

An edge gateway translates OT protocols like Modbus and PROFINET into MQTT or OPC UA, buffers data to local storage during outages, and terminates TLS so the PLC never touches the open network directly (NotebookLM, Edge Gateway notebook, 2026).

Can a PLC buffer data during a network outage without a gateway?

No. PLCs run on constrained RAM reserved for real-time control, with no onboard SSD or database, so a dropped connection means permanent data loss rather than a queued backlog (NotebookLM, Edge Gateway notebook, 2026).

How much does an edge gateway cut cellular data costs?

Report-by-exception filtering combined with Sparkplug B compression drops a machine sending 311 GB a month of raw JSON down to under 5.18 GB, a reduction of roughly 90 to 99 percent in WAN traffic (NotebookLM, Edge Gateway notebook, 2026).

Where should the security boundary sit between the plant floor and the cloud?

At an Industrial Demilitarized Zone between Level 3 site operations and Level 4 enterprise IT, per IEC 62443 zones and conduits, with the gateway enforcing outbound-only connections and dual-homed network interfaces (NotebookLM, Edge Gateway notebook, 2026).

Does control logic ever run in the cloud instead of on the PLC?

No. Round-trip latency to the cloud runs 200 to 2,000 milliseconds against a PLC scan cycle measured in single-digit milliseconds, so deterministic control stays on the controller regardless of which cloud architecture handles telemetry (NotebookLM, Edge Gateway notebook, 2026).

Conclusion

The bandwidth math settles most of this argument on its own: 311 GB against 5.18 GB is not a marginal difference, and neither is a 59.8-hour manual patch cycle against an automated rollback. Direct connections earn their place only when the controller has spare CPU or the deployment is too small to justify a gateway's overhead.

Everywhere else, the gateway wins on buffering, on the security boundary, and on who has to stay up at 2 a.m. patching firmware. Pair that decision with the transport layer running underneath it - Sparkplug B at the edge, OPC UA against MQTT for the semantic layer above it - and the rest of the stack falls into place.