DataPulse Gateway User Manual

1.1 System overview

The DataPulse gateway bridges two networks: a Machine plane for cameras and the operator HMI, and a Connect plane for the encrypted HTTPS API (DataPulse Connect). Inspection results and optional images are stored on the gateway. Operators use a standard browser (Chrome, Edge, or Brave) - no other client software is required.

Ethernet switches on each plane are customer supplied (not included with the gateway). Cameras and the operator HMI must reach Ethernet 1. Do not point cameras at the Connect address.

Core functions:

• Collect inspection results and optional images/overlays
• Aggregate multiple cameras into one interface
• Host the web HMI (Machine) and DataPulse Connect HTTPS API (Connect)
• Retain audit logs from compatible camera models

DataPulse operates alongside existing vision systems; it does not replace the camera or its programming environment.

2.1 Factory HMI accounts

Only eng opens Setup. All accounts can use Home, Browse, Record, Info, Device Description, Audits, and Resources.

The Quick Start Guide on the Resources tab covers first-time commissioning in one page.

2.2 Session behavior

Sessions remain active for the duration of the browser session. Closing the browser, restarting the gateway, or losing network connectivity requires logging in again.

3.1 Rollup band

• Filter bar - Camera and Job dropdowns. Default view is all cameras, all jobs. Select a camera to narrow; select a job to drill down. All Jobs returns to the camera-wide view.
• Inspections (current hour) and pass rate (current hour) (gauge).
• Inspections (last 24 h) and pass / fail split (stacked bar).
• Gateway health - disk usage, memory usage, and disk headroom before the image-deletion threshold.

Tiles refresh about every 30 seconds. With no inspections yet, counters show 0 and pass rate shows --.

3.2 Common screen elements

4.1 Screen areas

4.2 Configure Reports

Configure Reports (callout I) opens a dialog to download packaged inspection reports (.zip).

Click Download and follow on-screen instructions to save the .zip file.

8.1 Audit retention policy

Engineering users (eng) can open Edit Retention Policy on the Audits page.

1. Choose a retention duration (3 months through 10 years).
2. Optionally enter a comment.
3. Click Update.

Changing retention may permanently delete audit logs older than the selected duration.

9.1 DataPulse Connect Access

Manage the X-DP-Token used by DataPulse Connect clients and review per-endpoint rate limits. Rotate keys through a secure channel when required.

9.2 DataPulse Server Settings

View server status, active port, and start/stop controls. If the service port changes, update the matching port in the camera snippet TCP/IP settings and open that port on the Machine plane firewall (see Network ports).

9.3 Network Configuration

The Setup page has separate tiles for each plane:

Set static IP, subnet, optional gateway, and optional Preferred/Alternate DNS on each plane. After a Machine IP change, browse to http://<new-machine-ip>:8080/dwview/. Cameras must reach the new Machine address. After a Connect IP change, DataPulse Connect clients use https://<connect-ip>:8443/dw/.

For Wi‑Fi, TLS SAN DNS names, NTP sources, or scripted dual-plane changes, use the DataPulseConfiguration FTPS account (section 14).

9.4 Manage Cameras

Add, edit, or remove cameras. The gateway matches inbound inspection records by camera source IP.

Deleting a camera removes its configuration; historical records already stored remain unless purged by storage policy.

9.5 Storage Management

Monitor disk usage and set the image-deletion threshold. When usage crosses the threshold, the gateway deletes oldest images first. Changing the limit may delete data immediately; enter change notes and confirm carefully.

The same disk metrics appear on the Home health strip and in the DataPulse Connect health endpoint.

9.6 TLS Mode

Controls factory Adams-issued certificates vs customer-supplied certificates for HTTPS (8443) and FTPS maintenance upload (2122).

Customer-signed (bring your own certificate)

• For sites requiring enterprise PKI on HTTPS and FTPS.
• Select Customer-signed, click Apply. The mode flag changes; certificates do not change until you upload a valid bundle (section 13).
• Upload via the DataPulseCert FTPS account (section 12). Do not upload PEM files through the HMI.
• Watch the TLS audit grid on this page for promotion success or failure.

Toggle DataPulse HTTPS vs FTPS in the certificate details panel. Compare the SHA-256 fingerprint with your FTPS client on first connect.

9.7 Time Zone

Sets display time zone only. Stored timestamps and the gateway clock remain UTC.

12.1 Camera FTP (plain FTP)

Cognex snippets and camera jobs use a single gateway FTP account for image transfer:

Configure this in the Cognex snippet/job, not on the HMI. Data channels use TCP 50000–51000. See the Cognex Camera Integration guide and Network ports.

12.2 Maintenance FTPS accounts

Each account writes only to its own staging folder. Use either the Machine IP or the Connect IP on port 2122 (plain FTP 2121 is Machine IP only).

13.1 Connect

On first connect, the client may show an unknown certificate prompt. Compare the SHA-256 fingerprint with Setup -> TLS Mode -> TLS Certificate (FTPS view), then trust the certificate for future sessions.

13.2 Required files (exact names)

Upload exactly these four files, then the trigger file:

Do not upload extra files. Keys must not be embedded inside cert files.

13.3 Verify and troubleshoot promotion

1. Watch the TLS audit grid on Setup -> TLS Mode for a successful promotion row.
2. Refresh TLS Certificate for both HTTPS and FTPS views.
3. If promotion fails, the gateway moves files to a rejected folder with a reason.txt explanation. Correct the bundle and upload again.

13.4 Roll back

• HMI available: switch TLS Mode to Self-signed and Apply, or use TLS rollback controls if exposed in your build.
• HMI unavailable: upload an empty rollback.trigger file via the same FTPS account (optional one-line timestamp to select a specific backup).

After promotion, clients must trust your CA. The gateway does not install your root in the Windows trust store.

14.1 Connect

On first connect, compare the FTPS leaf SHA-256 with Setup → TLS Mode → TLS Certificate (FTPS view), then trust the certificate for future sessions.

14.2 Required files

Do not leave extra *.trigger files in the staging root. A future license.trigger may use the same account; until then use network.trigger only.

14.3 JSON shape

All stanzas are optional top-level siblings. Include only what you intend to change. At least one stanza is required.

datapulse-config.json
├── schemaVersion   (required: 1)
├── network         ← ethernet1 / ethernet2 static IPv4
├── wifi            ← enable / disable / reconnect
├── tls             ← DNS names added to the leaf SAN
└── ntp             ← time sources (optional; factory Meinberg is fine for most sites)

{
  "schemaVersion": 1,
  "network": {
    "ethernet1": {
      "ip": "192.168.1.123",
      "subnetMask": "255.255.255.0",
      "gateway": "",
      "preferredDns": "",
      "alternateDns": ""
    },
    "ethernet2": {
      "ip": "10.50.0.10",
      "subnetMask": "255.255.255.0",
      "gateway": "10.50.0.1",
      "preferredDns": "10.50.0.1",
      "alternateDns": ""
    }
  }
}

{
  "schemaVersion": 1,
  "network": {
    "ethernet2": {
      "ip": "10.50.0.10",
      "subnetMask": "255.255.255.0",
      "gateway": "10.50.0.1",
      "preferredDns": "10.50.0.1",
      "alternateDns": ""
    }
  }
}

{
  "schemaVersion": 1,
  "wifi": {
    "enabled": true,
    "ssid": "PlantGuest",
    "psk": "replace-me"
  }
}

{
  "schemaVersion": 1,
  "wifi": { "enabled": false }
}

{
  "schemaVersion": 1,
  "tls": {
    "dnsNames": [ "dp-sn12345.plant.corp" ]
  }
}

{
  "schemaVersion": 1,
  "ntp": {
    "servers": [ "10.50.0.20" ],
    "usePool": false,
    "localFallback": true,
    "orphanFallback": true,
    "probeOnly": true
  }
}

14.4 Verify and troubleshoot

1. After network.trigger is uploaded, a network.inprogress marker appears while the gateway works. The trigger file is removed when processing finishes.
2. Download last-result.txt from the same FTPS folder - success or failure summary, including which stanzas ran, whether certificates rotated, and NTP peer detail when applicable.
3. On failure, the package is moved under rejected-network with a reason.txt. Correct the JSON and upload again (JSON first, then a new network.trigger).
4. On success, the package is archived under applied-network (last three kept; see also backup-catalog-network.txt). Confirm HMI and DataPulse Connect reachability on the new addresses before disconnecting from the old IP.

Changing Ethernet addresses can move the FTPS endpoint. Prefer changing one plane at a time, and keep a browser session on the other plane (or console/RDP) until you confirm connectivity.

Self-signed vs customer-signed: IP or SAN DNS changes rotate leaves only when TLS Mode is Self-signed. In customer-signed mode the NIC and firewall update, but your uploaded certificates stay in place until you promote a new bundle (section 13).

15.1 Product and camera ports (inbound)

Cameras should use the gateway Ethernet 1 IP for time sync, record ingestion, FTP, and audit traffic. If the gateway uses a second Ethernet port for plant/MES connectivity, do not point cameras at that address.

15.2 Support and remote-access ports

These ports are for Adams commissioning and support, not day-to-day operation. Scope them to your management subnet (never the camera LAN or the open internet), and open only what your support agreement requires.

TR50 is outbound only: it never opens an inbound port on your firewall. When enabled and internet-connected, it lets Adams tunnel to the HMI/API, RDP, and Workbench for remote support.

16.1 Verification checklist

• Gateway powered and reachable
• Camera on same subnet with unique IP
• Cognex snippet status Ready
• UTC time sync to gateway IP
• Correct DataPulse IP in snippet
• Free disk space available