How FlowFuse deploys in operational-technology environments, near the equipment.
OT architectures
How FlowFuse deploys in operational-technology environments, near the equipment. Read each diagram bottom-up: equipment on the floor, the platform above. The Remote Instance is the execution layer that lives down in OT.
Server in IT, execution in OT
IT infrastructure
FlowFuse server
in IT infrastructure
manages across the boundary
OT environment
Remote Instance
on OT equipment
Remote Instance
on OT equipment
Remote Instance
on OT equipment
reads
Equipment
PLCs
Line A
PLCs
Line B
PLCs
Line C
IT zone
OT zone
Authenticated
Local wire
The FlowFuse server lives up in the IT infrastructure; the Remote Instances live down in the OT environment on the equipment. The server deploys to and manages them across the IT/OT boundary, while each Remote Instance keeps running locally if the link drops.
Use it when
IT owns and hosts the platform, but execution must sit next to the machines in OT.
Platform inside the plant, exposed through a DMZ
IT · corporate network
Corporate systems
MES / ERP / dashboards
controlled uplink · firewall
DMZ · firewall-segregated
FlowFuse server
in the DMZ
firewall
OT network
Remote Instance
IPC · Area 1
Remote Instance
IPC · Area 2
Remote Instance
embedded · Area 3
reads
Equipment
PLCs
PLCs
PLCs
IT zone
DMZ
OT zone
Local wire
The FlowFuse server sits inside the plant, firewall-segregated in a DMZ, with a controlled uplink to corporate systems and Remote Instances on IPCs and embedded hardware in the OT network below. Nothing reaches OT except through the firewalls.
Use it when
Security policy keeps the platform inside the plant boundary, exposed only through a DMZ.
No internet, in or out
Internet
Internet
blocked
blocked
OT network · no internet
FlowFuse
self-managed · on-site
deploys
Site apps
Instances
site apps
reads
Equipment
PLCs
equipment
OT zone
Authenticated
Local wire
The DMZ pattern taken to its extreme: a self-managed FlowFuse runs on a server inside an isolated OT network with no internet at all. It manages that site's instances and devices entirely within the OT boundary — nothing goes in or out.
Use it when
Site security policy forbids any internet traffic in or out of the OT network.
One server near the line, several Hosted Instances on it
OT · on-site, close to the equipment
FlowFuse server
on-site · near the line
runs
Hosted Instances doing the edge work
Hosted Instance
does Line A's work
Hosted Instance
does Line B's work
Hosted Instance
does Line C's work
talks to equipment
Equipment
PLCs
Line A
PLCs
Line B
PLCs
Line C
OT zone
Local wire
Instead of a Remote Instance on every device, deploy one FlowFuse server close to the line and run several Hosted Instances on it — each doing the work an edge device would have done, talking to its equipment directly. Fewer physical boxes to buy and maintain, same separation of concerns.
Use it when
You want the edge workloads consolidated onto nearby server hardware to cut device count.
FlowFuse Application Guide