Kepware: what it actually does, who owns it now, and when you can skip it

About once a month somebody asks me whether they have to buy Kepware, and the question usually comes with a guess attached: "that's the Rockwell one, right?" It isn't Rockwell's. At heart it's a Windows server that talks to PLCs in their own protocols and hands the data to everything else over OPC UA, MQTT and a few older standards. PTC owned it for ten years. Since March 2026 it belongs to Velotic, a new company TPG put together from Kepware, ThingWorx and GE's old Proficy software. Here is what the server does, when you can do without it, and the licensing and connection problems I run into most.

What Kepware does between the PLC and everything else

Picture one line with an SLC 5/05, two ControlLogix racks, an S7-300 nobody wants to touch and a dozen Modbus power meters. The historian wants all of it. So does SCADA, and so does whoever builds the production dashboard. Without something in the middle, every one of those applications needs its own driver for every controller, and each one polls the PLCs on its own.

The server holds the connection to each controller and does the polling itself. A project has three levels. A channel is one driver and its network path, ControlLogix Ethernet for example. Each channel holds devices, one per controller with its address, and each device holds tags, the actual addresses you read and write. Clients never see the PLC protocol at all. They see the server, over OPC UA, classic OPC DA, DDE, SuiteLink, a native iFIX interface, or MQTT and REST through the IoT Gateway plug-in.

The vendor counts more than 150 drivers. On the Allen-Bradley side, the ControlLogix Ethernet driver alone reaches everything from a 5550 up to 5580 and 5380 processors, MicroLogix 1100 and 1400 through their Ethernet port, and SLC 500, PLC-5 and older MicroLogix through a 1761-NET-ENI or a gateway chassis.

What it doesn't do is show anything to an operator. No screens, nothing a person on the floor looks at. It's plumbing. Comparing it to a SCADA package is comparing a pipe to a faucet.

Channel, device, tag. Every project is built from these three levels, whatever the driver.

Do you need Kepware at all?

Often you don't, and I'd rather say it up front. I've seen it bought more than once for a handful of CompactLogix and one SCADA package that already had a Logix driver. It ran fine. It also did nothing the SCADA couldn't do on its own.

Since firmware V36, most ControlLogix 5580 and CompactLogix 5380 processors carry their own OPC UA server. A few catalog numbers, like the 1756-L81E and the 5069-L306ER, don't get it even at V36. If a couple of clients need tags straight from those controllers, that may be the whole answer. The limits are tight, though. The controller can serve ten external clients at most, and at V36.011 the 5380's server offers anonymous login and nothing else. Anything older, the 5570 and L6x family included, has no OPC UA server inside the controller.

 

A few questions settle it for most plants. The first one is about firmware, not about money.

Who owns Kepware now, and why people say Rockwell

Kepware Technologies started in 1995 in Portland, Maine, and KEPServerEX was the product everybody knew. PTC bought the company in early 2016 and folded it into its IoT business next to ThingWorx, and the server carried the ThingWorx name for a while.

On November 5, 2025 PTC agreed to sell the connectivity and ThingWorx businesses to TPG. That closed in March 2026, together with TPG's purchase of GE Vernova's Proficy business, and the three became one company: Velotic, based near Boston. The server stays its own product line inside it. Funny detail: after years of shipping a native iFIX interface, it now comes from the same company that makes iFIX.

 

The Rockwell idea has a real root. Rockwell sells the same server under its own label, KEPServer Enterprise, and it's what a PanelView Plus can use when it has to talk to a non-Rockwell controller. GE's Industrial Gateway Server and Software Toolbox's TOP Server turn up next to it, too. Easy to see: the critical CVEs from 2020, 2022 and late 2023 name all three alongside KEPServerEX (in 2020 as products that may have a vulnerable component).

KEPServerEX, Kepware Server, Edge: which one is in front of you

 

Edge gets taken for a lighter, cheaper copy of the Windows server. It's a different animal. It runs in Docker or any other OCI container runtime, on x86-64 only, and you configure it through a web page or a REST configuration API, while a command-line tool covers certificates and admin settings. The driver list is six long: ControlLogix Ethernet, Mitsubishi Ethernet, Modbus Ethernet, Siemens TCP/IP Ethernet, Siemens S7 Plus Ethernet and the OPC UA client. No DF1, and no Allen-Bradley Ethernet driver, the one that talks to an SLC 5/05 or a PLC-5 directly. On an old Allen-Bradley line, check that list twice before you pick Edge. Its UA endpoint defaults to port 49330, too, not the 49320 everybody types from memory.

Moving a 6.x project to 7.x

Only 6.17 and 6.18 upgrade directly. Anything older goes to one of those first. The old version has to come off the machine, since the two can't be installed side by side. Active licenses carry across. Invalid licenses and lapsed maintenance both have to be fixed before the upgrade goes through.

Then the part that bites on Monday morning. Version 7 generates new instance certificates with 2048-bit keys, and the lists of trusted clients and servers stay behind. Every OPC UA client has to trust the new server certificate and get trusted again. Clients that address tags by namespace URI instead of index may need an edit as well, because the URI changed from the old product names to Kepware Server. Export the User Manager before you uninstall. It doesn't move by itself.

The demo, the licenses, and the password nobody can reset

The Kepware demo is the full product. Two hours at a time, unlimited channels, devices and tags, and stopping and restarting the application buys another two hours. Plenty for proving a driver against a real controller on the bench. If commissioning needs longer, the vendor hands out time-limited trial licenses on request.

Licenses go per feature: one driver, one plug-in, or a suite. The Manufacturing Suite bundles 100 drivers with OPC DA and OPC UA. Step up to the Advanced Manufacturing Suite and you get every driver, plus tag linking and database logging.

Per-feature licensing comes with a trap. Say the plant bought the ControlLogix driver, and two years later someone adds a Modbus channel for a new meter. Nothing stops them. That channel runs on the demo clock, and two hours later it quits while the Logix data keeps flowing. Which looks exactly like a network fault. Three system tags show what's going on: _TimeLimitedFeatures lists everything on the clock with the seconds remaining, while _LicensedFeatures and _ExpiredFeatures cover the rest.

Then the Administrator password. It's set during installation, or skipped, and the vendor says it can't be reset. Without it the License Utility, OPC UA Configuration and Settings stay locked. That gets ugly when the server has to move to a new VM and the guy who installed it left two years ago: you can't even release the license. On every install I add a second account to the Administrator group, for exactly that day.

Before you wipe, reimage, swap hardware or move the server to a new VM, transfer the license off the machine (the vendor calls it banking) and redeploy afterwards. And if the server warns that activating a second license of the same product on one machine will cost you the license, take it literally.

Technical support needs an active Support & Maintenance agreement. So does the move to 7.x. Check it while the old box is still running.

Where the connection actually breaks

When a Kepware connection won't come up, I check the client side first, because that's where most of these end up, then the PLC.

 

What a first connection looks like when it works: refused once, trusted on both ends, then the session opens.

For Logix controllers, nearly everything that matters sits in the device properties of the ControlLogix Ethernet driver.

The device ID is the IP address, then 1 for the backplane port, then the CPU slot: 192.168.1.20,1,0 for a processor in slot 0. Move the processor to slot 2, forget the last digit, and the driver is knocking on whatever sits in slot 0. The port is 44818 and there's no reason to touch it.

Protocol mode defaults to Logical Non-Blocking. At startup the driver uploads the controller's project, works out the logical address of every tag, and reads by address from then on. Fast. Two things go wrong with it. On a big project the upload can fail with "CIP connection timed out while uploading project information," and the fix is raising the Inactivity Watchdog above its 32-second default. And if the driver can't read the controller's identity, it logs "Unable to retrieve the identity for device. All tags will use Symbolic Protocol" and drops to Symbolic mode on its own until the problem clears. Still works. Just slower. When update rates fall off a cliff for no obvious reason, that line in the event log is the first thing I look for.

Leave Synchronize After Online Edits and Synchronize After Offline Edits on Yes, which is how they ship. With them off, after a project change the driver can end up reading and writing the wrong native tag address, and that is far worse than a bad-quality tag. During a download every read and write in progress fails and the driver polls the controller every 2 seconds until it's finished, so expect bad quality on the HMI for as long as the download takes.

The last setting depends on hardware. CIP connection size starts at 500 bytes and goes up to 4000, so more data fits in each request. Anything above 500 needs controller firmware v20 or later and an EN2x, EN3x or EN5.x bridge, in the ControlLogix 5500 and CompactLogix 5300 device models. An ENBT stays at 500 no matter what you type into the box, because the driver falls back to the default on its own. With a few thousand tags you feel the difference.

1756-ENBT on the left, 1756-EN2T on the right. Both bridge a ControlLogix chassis to Ethernet, but of the two, only the EN2T lets the driver use a CIP connection bigger than 500 bytes.

Old versions have holes, so patch it

Kepware sits at the edge of the control network on purpose, so its security record matters more than most. Every version below 6.15 carries at least one published, remotely exploitable flaw rated 9.1 or higher, the kind where a crafted message crashes the server or leaks data. Below 6.12 there's a 9.8 that allows remote code execution (CVE-2022-2825). On Edge the fixes came in 1.5 for the 2022 flaw and in 1.8 for the 6.15-era one. KEPServer Enterprise, Industrial Gateway Server and TOP Server sit on the same lists. The first two have fix releases under their own version numbers, so ask whoever sold you yours.

Past patching, turn off the OPC DA interface if nothing uses it and keep anonymous UA access off. The None security policy has no place on a production endpoint.

Kepware FAQ

What is Kepware used for?

Pulling data out of PLCs, drives, meters and other field devices in their native protocols and serving it to SCADA, historians, MES and cloud applications over OPC UA, OPC DA or MQTT. The hardware gets polled once, by the server, however many applications read the data.

Who owns Kepware?

Velotic, a TPG-backed company that launched on March 17, 2026. PTC had it from 2016 until that sale closed. Not Rockwell. It only sells a version under the KEPServer Enterprise name.

Is Kepware a SCADA system?

No. There are no operator screens or HMI. It's the data layer a SCADA system, a historian or an MES reads from.

Is there a free version?

Not a free license. The Windows server runs as a full demo in two-hour sessions, restartable as often as you like. Edge has no self-serve trial. Trials go through sales as a proof of concept.

Does it run on Linux?

Edge does, in a container on x86-64 hardware, with six drivers. The full server with the complete driver list is Windows only, desktop or server editions, and Server Core isn't supported on Windows Server 2016, 2019 and 2025.

The hardware on the other end of the wire

Kepware usually shows up on lines where half the controllers predate OPC UA, and a fair bit of that hardware isn't made anymore. We keep that side of the wire on the shelf at IQElectro: ControlLogix processors from the 5570 1756-L73 to the 5580 1756-L83E, the CompactLogix 5380 5069-L320ER, 1756-EN2T and 1756-ENBT bridges, the SLC 5/05 1747-L552, the MicroLogix 1400 1766-L32BXB, and the 1761-NET-ENI for serial processors. All tested before they ship, with a 2-year warranty. Send over the controller list and we'll tell you what's here.