Guide
How CNC machine monitoring works: from controller to dashboard
Every monitoring vendor shows you the same dashboard screenshot. What separates them is everything before the dashboard: where the data comes from, how machines connect, and how much of the truth survives the journey. This guide explains the whole pipeline.
Updated July 2026 · ThingConnect team
What machine monitoring actually is
Machine monitoring is the automatic collection of what your machines are doing — running, idle, in alarm — turned into numbers a human can act on: OEE, downtime by reason, parts produced against plan. The key word is automatic. If an operator has to write it down or click a button for the basic record to exist, it is a logbook with a screen, and it inherits every failure mode of a logbook.
What it is not: monitoring does not run your machines, does not change programs, and does not need to touch the control loop at all. Every serious system reads; none write. That distinction matters when IT and maintenance teams evaluate risk — see what your IT team will ask.
Where the data comes from
Everything on a monitoring dashboard traces back to one of three sources, and knowing which is which tells you how much to trust each number:
| Source | What it provides | Trust level |
|---|---|---|
| The CNC controller | Machine state, part counts, cycle times, alarms, active program, overrides, spindle load — the machine's own account of itself. | Highest. The controller already knows; nothing is inferred. |
| Added sensors / I/O | Power draw, stack-light state, vibration, digital signals wired to relays — proxies from which state is inferred. | Medium. A proxy can say "drawing power," not "cutting good parts at proven cycle." |
| People | Downtime reasons, scrap causes, quality judgments — the why behind what machines report. | Essential but minimal. People should classify, never transcribe. |
The best systems combine the first and third: the machine reports what happened automatically, and the operator adds why with two taps. The second source is a fallback for machines whose controllers cannot speak — useful, but a fallback.
Connection methods, compared
| Method | How it works | Depth | Where it fits |
|---|---|---|---|
| Controller-native | Software speaks the controller's own protocol over the plant network — reading its internal registers directly. | Full: states, counts, cycles, alarms, overrides, load. | The benchmark. Needs per-brand engineering by the vendor, which is exactly why few do it deeply. |
| MTConnect | An open, read-only standard; the machine (or an adapter) publishes data in a common format. | Good where implemented — but coverage varies widely by builder and vintage. | Newer machines from builders who ship it enabled. |
| OPC UA | General industrial interoperability standard; the controller exposes a server, monitoring reads from it. | Depends entirely on what the builder chose to expose. | Mixed automation environments; newer controls. |
| Sensor / I/O retrofit | Current clamps, stack-light taps, or relay signals wired to a small box that infers machine state. | Shallow: on/off and inferred cycles. No alarms, programs, or counts from the source. | Legacy machines with no network-capable controller. |
The honest summary: retrofit boxes get any machine onto a dashboard; controller-native connection gets the truth onto the dashboard. A real fleet usually needs mostly the latter with a little of the former for the oldest machines — be suspicious of any vendor whose answer is 100% one or the other.
How ThingConnect applies each method — including native FANUC/FOCAS integration, MTConnect, OPC UA, and digital I/O — is detailed in the connectivity hub.
From plant floor to dashboard
The pipeline in a modern cloud-first system has four stages:
- Machines → gateway. A compact industrial gateway sits on the plant network and polls each controller in its own protocol. Machines never talk to the internet — only to this box, inside your firewall.
- Gateway → cloud. The gateway makes a single outbound, encrypted connection and streams events up. Outbound-only means no inbound firewall ports, which is the difference between a five-minute IT conversation and a five-week one.
- Buffering. When the internet drops — and in industrial areas it does — the gateway keeps collecting and stores locally, then syncs the backlog when the connection returns. No gaps in the record.
- Cloud → screens. Dashboards, andon boards, reports, and alerts are served from the cloud to any browser — the plant, the office, a phone. No server to maintain in the plant, and improvements arrive continuously instead of as annual upgrade projects.
For plants whose contracts or IT policy prohibit production data leaving the site, the same pipeline can terminate in an on-premise deployment instead of the cloud — typically an enterprise arrangement for larger fleets.
The signals that matter
| Signal | What it unlocks |
|---|---|
| Machine state (run / idle / alarm) | The timeline everything else hangs on: utilization, availability, downtime events. |
| Part count | Production vs plan, performance calculation, count-based tool-life tracking. |
| Cycle time | Actual vs ideal cycle — the raw material of the performance component of OEE. |
| Alarm codes | Downtime that classifies itself: the controller names the fault, no operator typing. |
| Active program | Automatic job/part attribution — which order was running when the stop happened. |
| Feed / speed override | The quiet performance killer: overrides turned down and forgotten show up here first. |
| Spindle load | Early signal for tool wear and abnormal cutting conditions. |
Notice how many of these exist only inside the controller. A power clamp can approximate the first row; nothing retrofit can produce the last four. That is the practical meaning of "depth of integration."
Why retrofit-only monitoring undercounts
A stack-light tap or current clamp answers one question: is the machine drawing power? Everything else is inference, and the inference fails in familiar ways:
- Idle-in-cycle looks like running. A machine paused mid-program with the spindle warm draws power and shows a green light. Controller state says feed hold.
- Micro-stops vanish. The 30–90 second stops that add up to an invisible lost hour per shift are shorter than most power-inference smoothing windows.
- Slow running is invisible. A program running at 80% feed override is indistinguishable from one at 100% to a current clamp. The controller reports the override position directly.
- No part counts. Performance and quality — two-thirds of OEE — cannot be computed from an on/off signal, so they get estimated, and estimates drift toward optimism.
None of this makes retrofits useless — for a 25-year-old machine they are the only option, and knowing on/off beats knowing nothing. The mistake is building a whole plant's numbers on inference when most of the fleet could report the truth directly.
What your IT team will ask
| Question | The answer to look for |
|---|---|
| Does anything write to the machines? | No. Monitoring is read-only; it cannot change programs, parameters, or state. |
| What ports open in the firewall? | None inbound. The gateway makes a single outbound encrypted connection. |
| Are machines exposed to the internet? | Never. Machines talk only to the gateway on the local network. |
| Who owns the data? | You do — in writing, with export available. Walk away from anything else. |
| What happens when the internet fails? | Collection continues; the gateway buffers locally and syncs on reconnect. |
| What if policy forbids data leaving the site? | An on-premise deployment exists for that case — ask how it is licensed and updated. |
What deployment actually looks like
The technology part of a controller-native rollout is short: confirm each machine's controller model and network access, place the gateway on the plant network, map machines to it, and dashboards go live — days, not months, with no PC bolted to each machine and no wiring into cabinets for network-capable controllers.
The part that deserves the real attention is human: agreeing the downtime reason list (8–12 reasons, in the operators' own words), the shift and break policy (what counts as planned time — decide once, write it down, apply it everywhere), and ideal cycle times per part (from proven program times, not quotes). A vendor who deploys with you settles these in a working session; a courier-a-box vendor leaves them to become arguments later.
Questions to ask any vendor
- "Show me live data from a controller like mine" — a demo on your controller generation, not a stock video.
- "Which of my signals do you read natively vs infer?" — ask per machine on your actual fleet list.
- "What happens during an internet outage?" — the answer should involve buffering, with a stated capacity.
- "Who does the connection work?" — you want engineers who deploy with you, not a shipped box and a wiki.
- "What does month 13 cost?" — subscription, per-machine, and what happens to your data if you leave.
- "Can operators use it in their first hour?" — if training takes a week, the floor will not use it in week two.
Frequently asked questions
Does machine monitoring work with older CNC machines?
Usually, yes. Most CNC controllers made in the last 15–20 years can expose machine state, part counts, and alarms over the plant network. Genuinely legacy machines without a network-capable controller can still be brought in through digital I/O signals, so a mixed-age fleet ends up on one dashboard. What varies is depth: newer controllers expose more signals.
Do my machines need to be connected to the internet?
No. Machines talk only to a gateway on your local plant network. The gateway makes a single outbound connection to the cloud — no machine is ever exposed to the internet, and no inbound ports are opened in your firewall. If the internet drops, the gateway buffers data locally and syncs when the connection returns.
What data can be collected from a CNC controller?
Typically: run/idle/alarm state, part counts, cycle times, active program, alarm codes, feed and speed override positions, and spindle load. Exactly which signals are available depends on the controller make and generation — which is why depth of controller integration matters more than the length of a vendor's supported-brands list.
How long does it take to deploy machine monitoring?
With controller-native connection it is measured in days, not months: a gateway goes on the plant network, machines are mapped to it, and dashboards go live. The slow part of any rollout is not the technology — it is agreeing on downtime reason codes and shift definitions, which is a one-time workshop, not an engineering project.
