TLDR
- A deployed fleet of edge AI boxes is a distributed system, so updates belong in a release process rather than a truck roll.
- Three things have to work: an update channel that tolerates a bad link, a rollback path that runs without a human on site, and telemetry that flags a sick node before the customer calls.
- A practical split is NRU-220 inference nodes at the sharp end, a Nuvo-11000 acting as site aggregator, and a dual-SIM router between them and the cloud.
- Telemetry is cheap. Roughly 5 to 15 MB per node per day. Model artifacts are the expensive part, so stage them at the aggregator.
Overview
Somewhere past twenty installed units, site visits stop being an annoyance and turn into the operating budget. A technician driving four hours to power-cycle a box that hung on a bad model push is not a maintenance strategy.
The fix is not exotic. It is the same pattern server teams settled on years ago, moved onto hardware that happens to sit in a substation or a haul truck. We covered the model side of this in our article on the AI model lifecycle at the edge, and the packaging side in edge orchestration and container deployment on industrial PCs. This article is about the layer above both: how you run a hundred of them at once. If you are still choosing the hardware underneath, start with our complete guide to choosing an industrial edge AI computer.
One warning up front. Remote management is a remote code execution path you build on purpose. Every recommendation below assumes you have read IEC 62443 for industrial computers and are signing your artifacts.
Reference architecture
| Layer | Component | Role | Behavior when the link drops |
|---|---|---|---|
| Inference node | NRU-220 | Runs the model, buffers results locally | Keeps inferring, queues telemetry to disk |
| Site aggregator | Nuvo-11000 | Caches artifacts, fans updates out to local nodes | Serves the last-known-good bundle it already holds |
| Transport | Dual-SIM LTE router | Carries telemetry up, artifacts down | Fails over to the second carrier |
The aggregator is the part people skip, and it is the part that pays for itself. Pushing a 2 GB container to forty nodes over one cellular link is forty transfers. Pushing it once to a Nuvo-11000 and letting the nodes pull over local Ethernet is one.
Component selection
Pick the inference node for the inference, not for the management story. NRU-220 suits camera-heavy work where Jetson Orin gives you the frames per watt. Nuvo-11000 has the Core Ultra headroom and the storage to hold two or three artifact versions at once, which is what makes it a reasonable aggregator rather than just a bigger node.
For transport, dual SIM is not paranoia. A single carrier in a rural substation will drop you for hours. A Teltonika RUT956 carries two carriers and gives you RS232 and RS485 back into whatever legacy gear is already on site.
One more thing on storage. Telemetry buffering writes constantly, and consumer NVMe will not survive it. Size endurance for the write rate, not the capacity. This is the single most common corner we see cut, and it surfaces about eighteen months in, which is exactly when the warranty conversation gets awkward.
Implementation steps
Start by giving every node an identity, a certificate rather than a hostname, because hostnames get cloned when a technician images a spare. Then split your artifacts: the OS layer changes twice a year, the container layer monthly, the model weights weekly. Version them separately or you will ship a kernel to push a model.
Stage everything at the aggregator before any node touches it. Roll out to one node, watch it for a day, then to ten percent, then the rest. Keep the previous version on disk and make the bootloader fall back on its own if the new image fails to check in within a set window. A rollback that needs a human to trigger it is not a rollback.
Validation
| Check | How to test it | Pass condition |
|---|---|---|
| Link loss | Pull both SIMs mid-update | Node resumes, no partial artifact applied |
| Power loss | Cut DC during a write | Node boots, filesystem intact |
| Telemetry backlog | Block the uplink 48 hours | Queue drains without data loss on reconnect |
Run these before the fleet exists, on the bench, with two units. Every one of them is cheap in a lab and expensive in a quarry.
The rollback test is the one teams skip because it feels like testing the safety net instead of the trapeze. Skip it and you will find out how it behaves during your first bad push, across forty sites, at once.
Conclusion
The fleet you can update at 2 a.m. from a laptop is worth more than the fleet with slightly better benchmarks. Build the aggregator layer early, sign your artifacts, and test rollback on real hardware before you scale past a handful of sites.
Follow Neteon on LinkedIn for more of these breakdowns, or reach us at [email protected] or www.neteon.net to talk through a fleet management architecture.
Related Products
FAQs
How many edge AI units before remote management is worth building?
Around twenty. Below that, site visits are annoying but affordable. Past it, a single bad model push that hangs a node costs more in technician hours than the management layer costs to build.
Why put a site aggregator between the cloud and the inference nodes?
Bandwidth. Pushing a 2 GB container to forty nodes over one cellular link is forty transfers. Pushing it once to a Nuvo-11000 and letting nodes pull it over local Ethernet is one transfer, and the aggregator keeps serving the last known good bundle when the uplink drops.
How much telemetry data should I budget per node?
Roughly 5 to 15 MB per node per day for health and status telemetry. Model artifacts and container images are what actually consume your data plan, which is why they should be staged rather than pushed to every node individually.
What makes a rollback path trustworthy?
It has to run without a human. Keep the previous version on disk and let the bootloader fall back on its own if the new image fails to check in within a set window. A rollback that needs someone to trigger it is not a rollback.
Is remote management a security risk?
It is a remote code execution path you build on purpose, so it has to be treated that way. Sign every artifact, give each node a certificate rather than a hostname for identity, and have nodes refuse unsigned images. IEC 62443 is the reference to work from.
