Is It Safe to Connect Cloud AI to Your PLC?

Example: A vendor demo goes well. The AI tool explains faults on a PLC-controlled machine and answers questions in plain language. Then the maintenance manager asks the question that matters: to do all that, where does our machine data go, and what has to connect to our PLC to get it there?

When people ask "is it safe to connect cloud AI to my PLC," the risk they're really asking about runs outbound: machine data and control-system connections leaving the plant. In this post we'll cover three things: what actually leaves the plant when cloud AI connects to a PLC, why an outbound path from a control system matters, and what to ask before you connect anything.

What Leaves the Plant

For a cloud AI service to answer questions about a machine, the machine's data has to reach the cloud. That usually means something on the plant side collects data from the PLC and sends it over the internet to servers someone else runs. Depending on the tool, that can include tag values, alarm and fault history, cycle counts, production rates, recipes and setpoints, and sometimes the PLC program itself.

Some of that is more sensitive than it looks. Cycle times and production rates say a lot about your capacity. Recipes and setpoints can be process know-how that took years to get right. Once machine data is in the cloud, how it's stored, who can see it, how long it's kept, and whether it's used to train a model are set by someone else's policies, not yours.

And it isn't only data. To send data out, there has to be a path out. That path is a live connection between your control system and the outside world.

Why an Outbound Path Matters

Plants have spent years keeping control systems apart from the internet for good reason. A PLC was built to run a machine reliably, not to defend itself on an open network. Public guidance from CISA, the U.S. Cybersecurity and Infrastructure Security Agency, has long urged operators to keep control-system devices off the public internet and to limit and secure remote connections. The ISA/IEC 62443 series of standards for industrial automation and control systems takes a similar approach: group systems into zones and tightly control the conduits between them.

Connecting a PLC to cloud AI adds a new conduit, from the control system out to the internet. With it come a gateway, firewall rules, accounts and credentials, and software updates that someone has to manage. Each piece is one more thing to patch and watch, and one more way in if it's set up wrong.

Questions to Ask Before You Connect

If you're looking at cloud AI for a PLC-controlled machine, put these on the list:

• Exactly which machine data leaves the plant, and can we see the list of tags?
• Where is that data stored, who can access it, and is it used to train anything?
• What device connects to the PLC, and does it also connect to our plant network or the internet?
• Can that connection write to the PLC, or only read from it?
• Who patches the gateway, and who hears about it if something looks wrong?
• What happens to the tool when the internet connection goes down?

If the answers are vague, that tells you something.

How We Answered It

We had to answer the same question when we designed AetherMIP, our on-prem AI for PLC-controlled machines. Our answer was to leave out the outbound path entirely. AetherMIP has two physical connections: a 110V wall plug and an Ethernet cable directly to the PLC. It does not join the plant network, the AI model runs locally, and no machine data leaves the plant. Our security page covers how it's isolated from the PLC.

Today AetherMIP is set up for Allen-Bradley Logix PLCs, with Siemens S71500/1200 and Mitsubishi Q series coming in the near term.

Back to That Demo

So, is it safe to connect cloud AI to your PLC? It depends on what you're willing to send out and what you're willing to open up. Cloud AI needs machine data to leave the plant and a connection from the control system to the outside world. Both are risks you manage for as long as the tool runs, so ask the hard questions first.

Marando Industries is a custom machine builder and automation integrator in Reading, PA, serving plants across the Mid-Atlantic. You can learn more about AetherMIP and our intelligent machines work on our site. If you're weighing AI for your PLC-controlled machines and want your machine data to stay in the plant, let's set up a short call, a plant visit, or a demo at your plant or ours.