From the intervention to signed evidence.
What the agent collects, how it becomes a chain that cannot be edited afterwards, and what the machine builder finds in the report.
1. Where it runs
The Ormatrace agent is a lightweight Linux program. It runs on the machine's gateway, if it has a suitable system, or on a small industrial Edge unit mounted on a DIN rail next to the service router.
If you use Box4AI's ConnectBox OEM, the agent is already prepared on the gateway: no extra hardware needed.
It talks to the platform over MQTT with TLS and a certificate per device (mTLS). Each device can only write its own data; a revoked certificate can no longer connect.
2. What it collects
- Device state: firmware version and hash, integrity of configuration files.
- Interventions: changes to the PLC program, parameters, mode and configuration, firmware updates.
- Physical behaviour: vibration, temperatures, cycle times, currents, pressures, every 1–5 minutes.
- Software components: an SBOM in CycloneDX format, checked daily against known vulnerabilities.
3. Attributed remote sessions
When a technician opens the service VPN, Ormatrace opens a session with the user and source address. Everything that happens while the session is open is attributed to it. Access outside agreed hours raises an alert.
For each intervention you can record the machine, technician ID, method (remote, local programmer, HMI, OTA update), state before and after, whether it is safety-relevant and whether it was authorised.
4. Cyber-physical correlation
Every intervention triggers a comparison: the machine's behaviour in the 60 minutes before is compared with the minutes after. If vibration, temperatures or cycle times change beyond normal variability, the alert is linked to the intervention and the session.
5. The evidence chain
Each device message has a sequence number and the SHA-256 hash of the previous message. If a message disappears or is altered, the chain breaks and the system flags it.
On the server, every accepted message goes into an append-only log, itself hash-chained. Every day the latest hash of the log, the daily root, is signed with an Ed25519 key. The signed root can be sent automatically to the machine builder: a copy outside the server makes even tampering with the server itself evident.
| What happens | What the machine builder sees |
|---|---|
| Messages missing for more than 60 minutes | Evidence chain broken |
| A message does not match the previous one | Inconsistent evidence |
| The firmware is not the expected one | Unexpected firmware |
| A configuration file has changed | File modified |
| The device stops transmitting | Silent device |
6. Retention and reports
Interventions, version history, correlation telemetry windows, SBOMs and signed roots are kept for five years. The per-machine, per-period report, in PDF and JSON, brings together interventions, versions, integrity alerts, chain status and the signed roots for independent verification.
7. An open protocol
The protocol devices use to talk to Ormatrace is public, under the Apache-2.0 licence: a machine builder or integrator can write its own compatible agent. Signed roots can be verified with an independent script, without trusting our platform.
Want to see Ormatrace on one of your machines?
A 20-minute demo: a remote session, a PLC change, how the machine behaved, and the signed report that comes out of it.