What's New

This manual documents QUBIQ 1.0.8. Capabilities that arrived during the 1.0 series carry a badge like this one New in 1.0.8 on the page that describes them, so you can tell at a glance whether something is available on the version you are running.

1.0.8

1.0.8 is a large release. The historian was rebuilt around quality and event time, the symbol library became something you can author in, a message bus now joins pipelines, screens and scripts, and store-and-forward gained the controls an operator needs during a long outage. Read Before you upgrade first: more than the usual number of things behave differently the morning after.

Before you upgrade

QuestDB 9.4.0 or later is required

The historian now depends on QuestDB 9.4 features. Designating an older store is refused, and the refusal names the version it found. A store that is already the historian keeps ingesting, so no data is lost, but every start logs a critical error and its charts are not guaranteed to work. Upgrade QuestDB first. → QuestDB version

Fields, buttons, menus, tabs and text draw smaller

Every field widget, the Button, both menus, the Tab Container, Form fields and Text now take their height from one scale, and the project default is SM. In 1.0.7 they drew at what is now MD. After the upgrade, inputs, dropdowns and buttons are 36 px tall instead of 44, and a Text paragraph is 14 px instead of 16. No view is rewritten. To keep the old look, and on any touch panel, set Project settings → Theme → Control size to MD. → Control size

Saved menus, maps and 3D Viewers are not converted

Three widgets regrouped their properties, and saved views are not migrated for them:

• Horizontal and Vertical Menu. An item's path, linkType and openIn moved into link, and its colours into normal, hover and active. The Vertical Menu's collapse settings moved under rail. A 1.0.7 menu opens with items that no longer navigate.
• Map. Legend, clustering, GeoJSON style, controls and marker icon settings became groups. A 1.0.7 map opens with those at their defaults, and a query bound to markers needs its columns re-aliased.
• 3D Viewer. The per-node bindings and labels lists were removed. The model still shows, but nothing on it follows a tag until it is rebuilt as a 3D symbol.

Each page has an old → new table. → Vertical Menu · Map · 3D Viewer

Messaging scripts need reviewing

Views are migrated when first opened. A Send message's type becomes a subject (Motor Start → Motor_Start), its handlers are renamed to match, and the old session and page scopes become This browser tab only. Script code is not rewritten. A script message with no scope now goes to every project; scope: "session" and "page" are no longer delivered; a subject with a space, : or / is refused; and system.message.send(..., {scope: "user"}) now fails. → Upgrading messaging

A Link no longer crosses projects

The project is now part of a Link's address. An ingress Link listening to an egress Link in another project stops receiving after the upgrade, without an error. Replace such a pair with Message Out (Send to: All projects) and Message In. → Cross-pipeline communication

Existing gateway variables became global

Variables now belong to a project. Every variable that existed before the upgrade was made global, so whatever read it keeps working. Review the Scope column and make project-scoped whatever only one project uses. → Variables

Playbook checks became draft compute specialists

The Calculate a check step is gone. On the first start, every saved check is converted into a draft compute specialist carrying the original expression as a comment, and its step becomes Hand to a specialist. A draft is never offered to an assistant, so those steps return no figure until someone writes the calculation in Python and ticks Available to assistants. → Playbook checks were retired

History is recorded differently

• A lost connection is Bad in history. Unknown used to be stored as Uncertain, so a frozen last value kept counting in averages for the whole outage. It is now Bad and left out of every value, so averages over periods that include outages will differ from 1.0.7.
• Retained MQTT messages are not stored as fresh readings. A retained message without a device timestamp is shown live as Uncertain and is not historised.
• QuestDB node rows move to event time. Rows are filed at the payload's timestamp or the message time, not QuestDB's arrival time.
• The historian's buffer keeps its backlog. When full it refuses new samples instead of dropping the oldest, sizes to 25 % of the data volume and has no age limit.

→ Quality and time · Retained messages · QuestDB node · Buffer limits

Writes to QuestDB may switch to HTTP

New QuestDB connections write over HTTP on port 9000, where a rejected row is set aside instead of lost. A historian connection saved before 1.0.8 keeps TCP on 9009 and logs a warning until you switch its ILP Transport. The QuestDB pipeline node now follows the same rule, so a connection with an empty or custom ILP port writes over HTTP. If that port is a TCP listener, set it to 9009. → ILP transport

Retention no longer destroys the rollup's history

Up to 1.0.7, retention dropped whole partitions daily, and the 1-minute rollup lost its older history each time. Retention is now QuestDB's table TTL. History lost before the upgrade does not come back. The QuestDB form's Data Retention (days) field was never saved before 1.0.8, so check its value. → Retention

The message bus store moves into the data directory

The store holding every store-and-forward buffer and the quarantine used to sit beside the program, where a reinstall to another folder lost unsent history. On its first start 1.0.8 moves it to nats_data/ in the data directory, and it now syncs to disk every 5 seconds instead of every two minutes. → Where the buffers live

The access-token default is 1 hour, not 24

An installation that never saved Access Token TTL moves to the new default; a saved value is kept. The browser renews the token before it expires, so nobody is signed out early. → Sessions

A 1.0.8 backup may not restore into an older build

A 1.0.8 archive carrying a tag with a percent storage deadband, or an imported symbol, is refused by 1.0.7 and earlier, with the reason. Other 1.0.8 archives restore into 1.0.7, but views saved in 1.0.8 are quarantined there rather than drawn. → Which builds can read an archive

Scaling and deadband set at creation were never saved

Until 1.0.8, creating a tag dropped its scaling ranges and deadband, so a tag created with scaling published raw values until somebody edited it. Both are saved now. Check tags created with scaling on an earlier version: a blank engineering range means the tag has never been scaled. → Scaling

Historian

History records quality, and shows it. New in 1.0.8 Every stored row now carries its quality, the device's reason when it was not Good, whose clock stamped it and when it arrived. Bad rows are left out of every value, average, rollup and statistic. Charts shade the stretches that were not Good and name the reason under the crosshair. A quality change is always stored, whatever the deadband, so an outage cannot vanish inside the band. → Quality and time

Device time is event time. Changed in 1.0.8 Rows are stored at the device's timestamp when it sends a plausible one, otherwise at the server's receive time, so a backlog lands when the values were read, not when it drained. The future limit drops from one hour to 10 minutes, and a Device clock skew alarm fires when a connection's clock drifts. → Event time

Outages are marked instead of drawn over. New in 1.0.8 A Shutdown marker records when the whole platform was down, and a Collector down marker when a collecting service died while the rest ran. The chart stops the line there and shades the gap with the reason, instead of drawing a confident flat line across a period nobody recorded. → Outage markers

Charts keep every spike, and stop drawing stairs. Changed in 1.0.8 Trends and sparklines draw M4 by default: each slot's first, lowest, highest and last value at the samples' own times, so a one-sample spike survives every zoom level. Slot sizes snap to a fixed ladder in the project's time zone, and a trend opens on the value held at its left edge instead of a blank. → Retrieval modes

Year-long trends from hourly and daily rollups. New in 1.0.8 Two new rollup tiers, 1 hour and 1 day, each built from raw with its own retention, serve trends of weeks to years. A chart reads the coarsest tier that answers it exactly. → Rollup tiers

New statistics. New in 1.0.8 Time-weighted average, % Good, total (the integral of a rate), counter increase with rollover detection, time on and off, and starts, in the Historian chart's statistics table and from system.hist.getStats. system.hist.valueAt reads a tag's value at one instant, such as the tank level at shift change. Both work in Python, where every system.hist call used to return None. → Statistics · system.hist

Annotations on tag history. New in 1.0.8 Signed-in operators and engineers can write a note on a moment or a period by clicking or dragging on the Historian chart. Every chart showing those tags draws it, and every revision is kept. → Annotations

Alarms on the trend. New in 1.0.8 The Historian chart draws each pen's alarm limits and marks the window's alarm events; hover a marker for the alarm and tag. Range mode adds Ctrl/⌘ + wheel zoom and Shift + drag pan, and the chart is readable by a screen reader. → Historian component

Storage rules. New in 1.0.8 A deadband can be a percent of the tag's engineering range, and a minimum time between stored samples throttles a chattering tag. The reading before a deadband exception is now kept, so a hold-then-step no longer draws as a slow ramp. Each tag sets its Interpolation on its History tab; integers draw linear by default. The store interval writes heartbeat rows only while the tag is Good and its producer is running. → Storage rules

Export every stored sample. New in 1.0.8 Export → CSV — every stored sample streams the window's rows from the server at full resolution, with quality, status and origin. → Exporting history

Built for 50,000 tags. Changed in 1.0.8 Historised values are buffered and drained in batches; on a 4-core test machine a backlog drained at 13,000–19,000 rows a second where 1.0.7 fell minutes behind at 10,000 tags. Reads fail at once while a store is unreachable instead of freezing the page, and zooming away cancels the abandoned query in QuestDB. → Throughput · What keeps reads fast

The historian never skips WAL transactions on its own. Changed in 1.0.8 When QuestDB suspends the historian table, 1.0.8 raises a critical alarm and leaves skipping (which loses history) to an operator in Settings → Historian, where 1.0.7 skipped automatically. An invalid rollup is rebuilt automatically only when that loses nothing. → Suspended tables

Designer

Your own symbols, with behaviour. New in 1.0.8 A global symbol library sits beside the built-in P&ID and electrical symbols, on the palette's Imported tab. Import an SVG from Inkscape, Illustrator or CAD, or draw one in the new Symbol Editor: pen, shapes, layers, align, boolean operations, gradients, shaded pipes and undo. Give its parts parameters and rules (spin, fill level, flow, blink, colour maps), multi-state looks, and named ports that line ends pin to. Symbols travel in .qbqsym files, view packs and project backups. Writing to the library needs the new Manage Symbol Library permission. → Symbol Editor

Ask AI draws a symbol. New in 1.0.8 Describe a symbol, or a change to the open one, and pick flat, front, 3D or perspective. Every shape arrives as its own part with parameters, rules and ports set up, drawn in the background with a notification when done. The AI Assistant can propose a symbol from a chat too. Needs the Create symbols capability, off by default. → Ask AI

Flow arrows, and lines drawn as pipes. New in 1.0.8 A Flow arrows line style draws short arrows that move only while the line flows, so a stopped line still shows its direction. A Line or Arrow can also be a shaded pipe, in a colour or a material, with flow arrows inside, mitred tees and Bézier curves. Drawing-tool properties are now grouped (stroke.width, flow.source); views convert on open, but a script that names an old flat property needs updating. → Flow arrows · Grouped properties

One control size for every field and menu. New in 1.0.8 Project settings → Theme → Control size sets the height of every field, button, menu, tab, Form field and Text, from XS (28 px) to XL (64 px), and each of those widgets has a size property to override it. → Control size · One size scale

Editing on the canvas. Changed in 1.0.8 Selections have square handles and a rotate knob and turn with a rotated widget. Double-click a Text widget to type into it in place. Double-click enters a Map, 3D Viewer or File Manager in Flex and Grid views too. Flex items take a width and height, a grid view scrolls, and a drop lands in the cell you aimed at. → Editing on the canvas

Undo survives a save. Changed in 1.0.8 Saving no longer clears the undo history; undo past a save and the view is unsaved again. → Undo and saving

A Binding Manager you can read, and a validator that catches typos. Changed in 1.0.8 A misspelled name in a script transform fails validation with a squiggle, instead of throwing in LiveView. Right-click a property row to copy or paste that property as JSON, bindings included, copy its script path, or revert it. Date-time properties get a calendar that keeps relative values like now-2h. → Property bindings

Events say what they hand a script. Changed in 1.0.8 The Event Manager shows under each event the name a script uses for its payload: row, event, context.point. A Scheduler script reaches its payload as a bare event or slot, and the Add action menu is grouped into four. → Events · Event payloads

Components

QR Code, Barcode and a QR / Barcode Scanner. New in 1.0.8 Two new Display widgets draw a styled QR code or a barcode (Code 128, GS1-128, EAN/UPC, Code 39/93, ITF, Data Matrix, PDF417, Aztec) from a fixed or bound value, with SVG and PNG download. The new Input widget reads codes from the camera, a USB or Bluetooth handheld scanner, or a photo, and fires scan. → QR Code · Barcode · QR / Barcode Scanner

A digital-twin 3D Viewer. New in 1.0.8 The viewer shows a 3D symbol or a whole plant of them, whose rules colour, move, fill and label parts. It is now a container: widgets placed in it can be pinned to a model part and follow it as the camera moves. camera.focus flies to a part, and viewers out of sight stop drawing. → 3D Viewer

Button: size, shape, fit and five new variants. New in 1.0.8 shape, fit, and the variants soft, link, success, warning and destructive. → Button

Map: motion, shaped markers, map tone and a real legend. New in 1.0.8 Markers slide to new positions and can bounce on alarm; they take a shape, icon, size, spin and heading. mapTone greys or darkens the base map so colour means state, and the legend filters on click. → Map

Menus: per-item visible, position, disabled and separators. New in 1.0.8 An item can be hidden without leaving a gap, sorted by a bindable position, or disabled with its children. → Vertical Menu

Scheduler: read-only boards. New in 1.0.8 readOnly turns a board into a report, loading blocks edits while a write runs, and bars can drop their labels for an OEE or state timeline. → Scheduler

Toolbars fold on narrow widgets. Changed in 1.0.8 Historian, WYSIWYG, PDF Viewer, File Manager, Scheduler and the alarm lists fold controls into a More menu instead of wrapping. A query-bound Table honours Refresh binding, and a Tree keeps its rows through a refresh. → Table · Tree

Pipelines, scripting and messaging

A message bus for pipelines, views and scripts. New in 1.0.8 One subject-addressed bus carries messages between all three: a button can start a pipeline, a pipeline can update every screen listening, and a script can ask a pipeline a question and wait for the answer. Subjects are dotted (line1.motor.start) and receivers listen on * and > patterns. Three new nodes, Message In, Message Out and Message Reply, put pipelines on it, and the Designer's Send message action can send a request and keep the reply. → Message bus · Send message

Gateway variables belong to a project. New in 1.0.8 A variable is shared by its own project's pipelines, scripts and screens, backed up and deleted with it, unless it is declared global. vars.<name> bindings now work for LiveView operators and public visitors, and a LiveView reads only the variables its own project names. system.vars.decr joins incr. → Variables

QuestDB rows carry the time they happened. Changed in 1.0.8 The QuestDB node's ingress mode reads each row's time from a payload field, in a format and time zone you choose, so a backlog that store-and-forward held through an outage replays at the right times. → QuestDB node

A Python node can call a Gateway script. New in 1.0.8 system.script.runOnGateway is available in Python, with its options as keyword arguments. → Gateway scripts

Telegram and WhatsApp no longer send twice. Changed in 1.0.8 One failed recipient no longer stops the rest, and a retry goes only to those who received nothing. Failed sends are counted on the connection, and a healthy Telegram bot stops flickering between statuses. → When a send fails part-way

AI assistant

Ask for a dashboard, get a live one. New in 1.0.8 An AI Chat widget in dashboard mode puts a live dashboard beside the conversation. An operator asks in their own words and gets readouts, gauges, trends, tables, a map or a schedule board, bound to real tags and saved queries. Where no saved query exists, the server composes and runs a read-only SELECT, fenced by the screen's database list. Dashboards can be edited by asking or by hand, kept and reopened. Needs Build dashboards in AI settings, off by default. → AI live dashboards

The assistant can propose tags, types, publishers and symbols. New in 1.0.8 In the Designer it can draft a tag, define or apply a UDT, choose which tags go to which broker, or draw a symbol. Each is its own capability, off by default, and nothing exists until a person approves it. → Proposing tags, types and publishers

Every AI limit and clock is a setting. New in 1.0.8 An AI time limits card sets the chat, AI node, tool call and compute limits that used to need environment variables and a restart. A model profile can set its Max output tokens, and an answer that hits the limit says so instead of stopping mid-sentence. → Time limits

Gateway variables for the assistant. New in 1.0.8 The Gateway Variables skill reads pipeline and script variables in one call; playbooks get a Read variables step and compute specialists a Gateway variable input. → Skills

Tags, connections and alarms

Every tag on a shared MQTT topic gets its data. Changed in 1.0.8 Of several tags reading different JSON fields of one payload, only the tag subscribed last received anything. Each tag now gets its own field from every message, exactly once. → Several tags on one topic

An MQTT device's own time, quality and status. New in 1.0.8 A classic MQTT binding can name where the device puts its timestamp and quality in the payload, and a Device status topic, usually its Last Will, turns its tags Bad the moment it reports offline. All of it works in UDT members. → Device time and quality · Device status topic

Stale after: a tag that goes quiet says so. New in 1.0.8 Past Stale after (ms) on the Binding tab, the last value is re-published as Uncertain with the reason, for every protocol. Earlier manuals listed this setting, but it could not be edited and nothing enforced it. → Stale after

No fabricated values on a reconnect. Changed in 1.0.8 A tag waiting for its first reading used to be published as a Good 0, written to history and handed to alarms. It is now Bad, waiting for initial data, and a polled connection that reconnects no longer writes a Bad row for every tag. → When a connection comes back

One engineering range, on the Scaling tab. Changed in 1.0.8 The engineering range belongs to the tag, scaled or not, and a percent deadband is a percentage of it. Interpolation moved to the tag's History tab. → One engineering range

UDTs carry everything their tabs show. Changed in 1.0.8 Historian storage rules, the engineering range, Stale after, MQTT settings and the publish mode, on a new Publishing tab, reach every instance and can be overridden per instance. A member with history on can now be instantiated at all, and type alarms reach instances as the type says. Instances survive export and import, with a preview. → What a member carries · UDT instances

OPC UA, S7 and MQTT at 50,000 tags. Changed in 1.0.8 OPC UA spreads a large rate group over several subscriptions and keeps the session of a server that is slow but still publishing. S7 packs scattered addresses into multi-variable reads: 59 data blocks in 3 round trips instead of 59. MQTT subscribes in batches at start-up and reconnect. A restarted polled-driver worker gets its configuration back at once. → Large and busy servers · Scattered addresses · Polled drivers

Browse SNMP and Sparkplug when binding a tag. New in 1.0.8 The Binding tab has a picker for SNMP and for Sparkplug, and the Allen-Bradley browser opens programs and UDTs. → Address formats

System alarms in one list. New in 1.0.8 Store-and-forward trouble, device clock skew, a suspended historian table and a rollup that needs rebuilding raise alarms in the ordinary active list, and clear themselves. → System alarms

Platform and administration

Store & Forward you can operate. New in 1.0.8 Settings → Store & Forward → Buffer limits sets each buffer family's size, age limit and full policy, applied to buffers that already exist. Each buffer's ⋯ menu can pause, cap the forwarding rate, or purge, and Live first lets new history overtake a draining backlog. The table shows fill, rates, time until full and refused values. When free disk space drops below a floor, every buffer freezes and a critical alarm is raised. → Buffer limits · Buffer actions

The quarantine can be read, exported and imported, and never expires. New in 1.0.8 A quarantined write opens in full, and the quarantine can be exported and imported for review elsewhere. 1.0.7 deleted a quarantined write after three days. → Quarantine

Backups and restores run as server jobs, and take effect without a restart. Changed in 1.0.8 A Backups & restores tray follows the job while you keep working, and finished archives stay on the server for 7 days. Restored projects are live the moment the restore finishes, and every restore shows one readable report. → Jobs · No restart

QUBIQ Setup and QUBIQ Uninstall. New in 1.0.8 One installer window on Windows, macOS and Linux, with a License Agreement. An update names both versions, blocks a downgrade, and says before you click when it will stop a running QUBIQ. Uninstall keeps your data unless you tick Also delete all QUBIQ data. → QUBIQ Setup · Uninstalling

Every service keeps a bounded log file. New in 1.0.8 Each service writes log/services/QBQ-<Service>.log in the data directory, rotated at 5 MiB and capped at 150 MiB and 14 days. On Windows each service shows under its own QBQ-… name in Task Manager, and the Windows service no longer fails a long start. → Per-service logs

Sessions are real, and you can sign everyone out. New in 1.0.8 Each sign-in is a session on the server: renewals rotate the token, a replayed old token ends the session, and a password change ends it. Sign out all ends every Studio and LiveView session at once, and Maximum Session Length caps a session. → Sessions

Public LiveView projects, and a project logo. Changed in 1.0.8 On a public project, read-only named queries run for visitors while one that writes is refused, and historian charts read the project's historian. The Branding card puts a project logo on the LiveView sign-in, and a missing User Database is named instead of reported as "user not found". → Public projects · Branding

Corrections to earlier manuals

These were wrong in the manual, not in the product, and are fixed in every version of the manual:

• A tag has at most one binding. The manual said one tag could carry more than one. → One binding per tag
• Bindings have no polling mode. OPC UA is always subscribed, Modbus, SNMP, S7 and EtherNet/IP are polled, and MQTT and TCP are pushed; the deadband belongs to the tag. JSON paths are written data.rpm, not $.data.rpm. → Protocol bindings
• Binding transforms are Number Format, Map and Script. The manual listed threshold, scale and js transforms that never existed. → Property bindings
• REST routes live under /gateway/<project-slug>, without /api/v1/ or :id placeholders, and a new REST API node starts Public (No Auth). → REST endpoints
• A node with several inbound wires runs once with all its inputs, not once per message. → Message flow
• API keys are created from a REST API node (Project API Keys → Create Key) and can expire. → API keys
• Store-and-forward never buffered REST pushes, and on macOS QUBIQ installs to /usr/local/qubiq. → Store and forward · Installation

---

1.0.7

A tag that has no value yet says so, and says why. Changed in 1.0.7 A read used to answer NotFound for two different things: a name that matches no tag, and a real tag that simply has no value yet. That is the same word a typo produces, so people went looking for a misspelled path when the tag was right there. A tag that exists now reads Unknown, with the reason: bound but not reported yet, no enabled binding, or not evaluated yet. Scripts, the AI assistant and the Industrial I/O node all get the same answer. Those last two also stop reporting internal and expression tags as missing. Until now every such read from a pipeline or the assistant came back empty, whatever value the tag held. → A tag with no value yet

An initial value you can see, and one that fits its type. Changed in 1.0.7 Creating an internal tag now fills in Initial Value with its type's default. It used to be a blank box that the server quietly filled in later. The value must fit the type: 300 in a byte tag is refused rather than wrapped to 44, and invalid JSON is refused rather than stored as text. Before, a typo in a number box silently became 0. → Initial value

UDT members can be computed, and each one reads its own instance. New in 1.0.7 A member can now be an expression tag. {InstancePath} points it at its own instance, so tag["{InstancePath}/Sensors/Speed"] reads Ship1's speed in Ship1 and Ship2's in Ship2. A path typed literally would have every instance computing from the same tag. The Expression tab's This instance picker lists every tag an instance will hold, so you don't have to type the paths. → Computed members

Sync all. New in 1.0.7 Sync all (N) brings every out-of-date instance, of every type, back in line in one action. Before, a type edit that touched a dozen instances meant a dozen dialogs. It runs as a background job with visible progress. An instance that fails is left untouched and still flagged, so Try again finishes exactly the remaining work. Each run is written to the audit journal. Renaming a type, or saving one unchanged, no longer marks every instance out of date for a sync with nothing to do. → Sync all

A Sparkplug edge node can say which PLC died. New in 1.0.7 A Sparkplug publisher used to put every tag on the edge node, so the only death a host could see was NDEATH, meaning the whole gateway had gone. When one PLC behind QUBIQ dropped, its tags just stopped changing, which looks the same as a process standing still. Devices → One per source connection gives every connection that feeds the publisher its own Sparkplug device, with its own DBIRTH, DDATA and DDEATH. A device dies when its connection fails, not when it is merely quiet. The option previews the devices the publisher will produce, by the ids they will have on the broker. → Devices

Sparkplug publishers change on upgrade

A compliant Sparkplug host had to discard what QUBIQ published. NBIRTH and NDATA went out retained, at QoS 1, which the specification forbids, so the broker kept serving a dead session's birth to every new subscriber. A reconnect resumed data against an alias table the host had already thrown away, and an orderly stop sent no death at all. After upgrading, every Sparkplug publisher is not-retained at QoS 0, and Never miss a value is refused for Sparkplug. QUBIQ does not clear births already retained on the broker; clear them with your broker's tooling.

Four value shapes were also wrong on the wire, and the same tag now publishes something different. A Boolean fed by an integer source was always false, a DateTime given as text was dated 1970, and JSON and byte values were unreadable. → What a Sparkplug publisher does not let you choose · Values that went out wrong

One bit of a Modbus register, and Modbus strings. New in 1.0.7 HR:100.3 addresses bit 3 of a holding register. A write to it uses Mask Write Register (function code 22), so the device changes that one bit atomically and the other fifteen are untouched. Before, there was no way to name a bit, so a Boolean bound to a status word read true whenever any of its bits was set. That is still what a Boolean on a whole register means, so check any you have. A string tag can now bind to Modbus: ASCII, two characters per register. → One bit of a register · Strings

One dead device no longer stalls the rest of its protocol. Changed in 1.0.7 The Modbus, SNMP, TCP/UDP, S7 and EtherNet/IP workers handled most requests one at a time, across every connection. A read, or a 60-second SNMP walk, against one unreachable device held up every other device of that protocol, and callers were told worker unavailable about a healthy worker. Requests for different connections now run side by side. EtherNet/IP keepalives no longer queue behind a hung controller, which used to cost healthy controllers their sessions. → One dead device is one dead connection

Values that looked right and were not. Changed in 1.0.7

• TCP/UDP published the fragment of a message cut short as a Good reading. It now refuses it. One side effect: a device that sends its last message without the delimiter and then closes the connection now loses that message.
• Siemens S7: when the CPU refused a whole request, the badge stayed green while an entire scan group went permanently blank. Those tags now go Bad with the reason.
• Modbus: a reply that arrived just after its timeout forced a reconnect. It is now recognised and discarded, and the socket is kept.

→ TCP/UDP · Siemens S7

A node says whether its connection is up. New in 1.0.7 Every node bound to a connection carries a status marker and a caption under the card, such as connected, receiving · 12 in · 5 out, retrying, no recent data or disabled. Before, a pipeline full of nodes bound to a dead device looked exactly like one that was working. It was worst for a trigger node, where "the connection is down" and "nobody has sent anything" both showed as a blank card. → The connection status under a node

Disable means disabled. Changed in 1.0.7 Switching a connection off now stops the pipeline nodes that use it: SQL Query, MongoDB, QuestDB, Send Email, Telegram and WhatsApp. Each fails with an error naming the connection. The toggle used to reach only the data path, so a disabled SMTP connection went on sending mail, and a disabled Telegram bot went on being polled. A connection can also now be created disabled; saving a new one with the toggle off used to store it enabled. → A node on a disabled connection fails

Telegram: the message that sometimes never arrived. Changed in 1.0.7 Telegram hands a bot's messages to exactly one poller per token, so two installations sharing a token each received some of them. Both still said connected, because the status only checked that the token was valid. It now reports what the gateway actually observes, including Another instance is polling this bot token. In that case the gateway waits five minutes instead of knocking the other installation off twelve times a minute. → One bot token, one installation

A colon in a string or a comment is no longer a parameter. Changed in 1.0.7 Saved queries read every : as the start of a named parameter. That caught 'HH24:MI:SS', -- shift starts 09:30 and ::text casts. It rarely failed loudly: the database received a different statement and returned the wrong number of rows with no error. The binder now follows each engine's own rules for strings and comments. → Colons in strings and comments

Every saved-query parameter is required, and Means does what it shows. Changed in 1.0.7 The Req tick box never did what it said. The statement contains :shift literally, so an "optional" parameter could only ever be passed empty. The column is gone. Means is checked when you save, and Point in time now resolves; before, it was never read. A missing parameter is now reported to the assistant, so it can fill the gap instead of retrying. → Declared parameters

The WYSIWYG component is a WYSIWYG editor. Changed in 1.0.7 It was a split-pane Markdown source editor, so the name promised something it could not do. It now edits formatted text directly, and the stored value is still plain Markdown, so every binding and form that reads it is unaffected. Selecting text brings up a formatting bubble, and table cells can be merged and split. The source and preview modes remain. They are the way to keep inline HTML as it is, because rich editing converts it to Markdown; the editor warns before doing so. → WYSIWYG

A Scheduler bound to a query works, and writes back. Changed in 1.0.7 A board whose events came from a named query sat on Loading data… indefinitely. Once it did render, the first drag replaced the binding with a frozen copy of the query's result, so the board silently stopped following the database. A bound board now renders, and a drag leaves the binding alone and fires eventChange for you to save. The Scheduler page now covers the whole round trip: the queries, the update script for a drag or resize, and an insert script for a click on empty timeline. → Driving the board from a database

A Scheduler that opens on today. New in 1.0.7 rangeStart and rangeEnd accept times relative to the clock, such as now-2h, today and today+5d, so a live board no longer has to be re-dated every morning. preventOverlap, off by default, stops a drag or resize from landing one block on another in the same row. Dependency arrows now follow a block while it is dragged. → A window relative to now

A theme-locked view stays readable. Changed in 1.0.7 Some components kept the surrounding theme's text and surface colours inside a view locked to a fixed palette. The result was dark text on a dark background on an operator screen, with nothing logged. Every component now follows the lock. → Locking a view's theme

The audit journal's filters search the whole journal. Changed in 1.0.7 Origin, category and search used to apply only to the page already loaded, so a record two pages back was simply not found. That is a dangerous answer from the place people go to establish what happened. Filtering is now done on the server. The pager gains a page size, a jump to the newest events and a clear end of journal. → Reading the journal

A backup says what it will cost, and a large one can be restored. Changed in 1.0.7 Include File Manager & uploaded files now shows its size before you download anything. A restore used to be capped at 512 MB and held in memory while an export had no limit, so an instance could produce a nightly backup it could not restore. An unencrypted archive now restores up to 4 GB, read from disk. An encrypted one keeps the 512 MB limit, because it has to be authenticated whole, and a larger one is refused with the reason. → How large an archive can be restored

A storage folder cannot be a database's. New in 1.0.7 An uploads or library folder that holds PostgreSQL, MongoDB, MySQL, QuestDB, Redis, InfluxDB or Elasticsearch data is refused. The refusal names the product and the file that gave it away. On one installation the uploads folder was the parent of its Docker database volumes: media backups archived live database files, and the File Manager offered to rename and delete them. → Storage folders

The assistant knows where a value comes from. New in 1.0.7 Reading a tag now tells it whether the tag is a device, internal or expression tag, and for an expression tag, the formula and the tags it reads. Before, it described a computed number as though a sensor had produced it. → AI assistant

Also in 1.0.7: the Reporting module and its licence entry were removed from the product. This manual had already stopped documenting it.

Fixes worth knowing about:

• Copied tags: a copied tag keeps its write level. It used to reset to 0, which made a copy of an admin-only tag writable by anyone. A copied internal tag also stays internal.
• Publish mode: editing an existing tag's publish mode now saves.
• Deleted folders: deleting a folder removes the expressions of the computed tags under it. They used to keep running unseen in the engine.
• UDT connection parameters: a UDT connection parameter now lists connections, where it used to always say No connections available.
• Clearable fields: clearable works on number and password fields, where it saved but drew nothing.
• Scheduler zoom: Ctrl+wheel on the Scheduler zooms the board instead of the browser page.
• Sparkplug encoding: one Sparkplug tag that cannot be encoded is skipped and counted as untyped, instead of taking the whole node dark.
• TCP reconnects: a TCP client whose peer accepts and immediately hangs up is backed off, instead of being redialled thousands of times a second.

1.0.6

A licence you buy at 10am works at 10:01. Changed in 1.0.6 Every service re-reads and re-verifies the signed licence file the moment one is installed, across the whole fleet, within the same second. Before this, only two processes heard about it: a customer who added the Siemens S7 and Allen-Bradley modules to a running installation watched the supervisor start both workers — visible proof the purchase had landed — and then got MODULE_NOT_LICENSED when they created a connection, because every other service was still holding the entitlements it read at boot. The only cure was the restart the whole mechanism exists to avoid. → Licensing

Report by exception, for real. Changed in 1.0.6 Publish on change only has been on by default since 1.0.0 and did nothing for the ordinary tag: the gate was the tag's deadband, which defaults to 0 and is documented as a threshold for storage, so a tag with none — which is most of them — went to the broker at the full scan rate, and a boolean was never suppressed at all.

• A reading is now sent when it says something new: the value changed, or the quality did. Quality is part of the reading, not metadata about it — with Retain on, suppressing a Good→Bad transition at an unmoved value would leave the broker serving a Good-looking number to every late subscriber for as long as the process stood still.
• A heartbeat per publisher, off by default, re-sends the value already held after a chosen silence. RBE makes silence ambiguous — a process standing still and a dead gateway are both a topic that stopped — and a tag on a 250 ms poll with a 60-second heartbeat costs the broker one message a minute instead of 240.
• A tag can opt out on its own. Follow the broker / only when it changes / every reading, saved with the tag, because cadence is a property of the signal: a counter, a heartbeat or a batch step has to arrive at its scan rate wherever it is sent, and one tag can be in scope of several publishers at once.

This changes the message rate on upgrade

The first run after upgrading drops existing publishers from scan rate to change rate. That is the intent and a large reduction — but it is a real change for a subscriber that was using message arrival as a liveness signal, which is what the heartbeat is for. → Report by exception

Publishing a folder is a checkbox, not a verb. Changed in 1.0.6 The tree's Publishing menu now gives a folder and a multi-selection the same per-broker checkbox a tag already had, with the third state that was blocking it: ticked, unticked, and a dash for a folder the fence only reaches into. A dashed box hands off to the dialog rather than guessing — "publish the rest" and "stop the ones that are" are equally plausible readings of the same click, and that menu writes immediately. The dialog loses its Action radio, which was asking a second time for a decision already made. And the bug underneath: stopping a folder now stops the subtree, where before a publisher scoped to Line1/Pump and Line1/Valve made stopping Line1 report no change and leave both tags publishing. → MQTT publishing

A backup that is honest about media. New in 1.0.6 The File Manager's content and the uploads store now travel — under a new Include File Manager & uploaded files flag that is off by default, because those folders hold videos and 3D models and a nightly backup dragging 400 MB of them is one that stops being run. The file list always travels either way, so a view that points at a document still points at it after a restore, and row and file reunite by content the moment the folders are copied across.

The honest part: on any instance built since August, the File Manager's content was in no archive at all. It had stopped being an internal catalogue and become an ordinary folder, and the backup went on carrying the catalogue — which was empty, and "0 files" is indistinguishable from an installation that never used the feature. Every guard stayed green. → Media

A backup moves between Linux, Windows and macOS. New in 1.0.6 Names that one filesystem stores and another cannot are now reported: refused on import for a project, view, script or query name, warned about on export while you can still rename the thing, and refused at creation for the names that are keys. The three silent cases are the reason — a trailing dot, a case variant and two Unicode spellings of one word each collapse two files into one with no error at either end. Passphrases are normalised before the key is derived, so an accented one typed on a Mac and on Windows opens the same archive. → Moving between operating systems

Writes to a PLC stop queueing behind other people's problems. Changed in 1.0.6 An audit of the Siemens S7 and EtherNet/IP write path, which had had less attention than the read side. One dead panel used to stall writes to every other controller — and the caller was then told worker unavailable about a worker that was perfectly healthy. An operator's setpoint now goes in front of queued polling. A learned element size is discarded on reconnect, so a program download cannot leave a stale width behind and reopen the silent partial write the probe exists to close. A STRING write the CPU's PDU could only apply in halves is refused with the numbers and the remedy rather than torn. And a value whose meaning is not obvious — 2 or maybe written to a BOOL — is refused instead of quietly written as OFF. → Siemens S7 · Allen-Bradley

The script sandbox says what is actually installed. Changed in 1.0.6 The allow-list pre-approves around thirty third-party libraries — numpy, pandas, cv2 — and ships none of them installed. Allow-list membership is permission, not availability, and the two looked identical on the screen; the first sign of the difference was a ModuleNotFoundError at run time. Each entry now carries its own state, the list filters by it, and a missing one offers to install itself. → The allow-list

A Problems panel, and one font size across every code editor. New in 1.0.6 The Designer hosts six separate Monaco editors and their size was fixed, so anyone who turned it up to read a long script had to do it again in the next panel. There was also nowhere to see what the linter had found — the footer showed a bare count, which tells you there is a problem and then declines to say what. Both linters already produced the message and the location; now you can click it. → The editor

The 3D Viewer's camera. New in 1.0.6 Motion is eased by default, in both directions: an operator's rotate, pan and zoom glide to a stop instead of snapping, and a new pose — a target re-aimed by an event action, a bound tag or an edit — flies there rather than cutting, so nobody loses track of which way round the equipment is. enableRotate joins the gesture switches so a fixed overview cannot be tumbled into a useless view. The [x, y, z] properties now name their slots and fill the whole tuple in one click, where the grid used to show rows 0/1/2 and its + appended a bare 0 — producing a 1- or 4-element array the widget rejected, so the field appeared to do nothing. → 3D Viewer

AI: three more things a calculation can read. New in 1.0.6 Tag relationships, Manuals and Stored file join the input kinds for a specialist's compute body and a playbook's checks. A compute-only specialist runs no nested conversation and so holds no tools at all — its only data is that list — so until now a calculation over a commissioning record, a manual or a tag's stored links was not expressible, while a playbook could order the identical read in one step. A compute-only specialist is also now offered every kind: the dropdown followed the ticked skills, which that mode deliberately has none of, so Saved query never appeared and definitions the server accepts and runs could not be written in the editor. → Specialists

Also in the assistant: a compute body may be 40,000 bytes rather than 20,000 (a compute body is never sent to a model, so the old number was justified by a cost that does not exist); each turn is told which tools it actually holds, instead of inheriting a persona that describes every skill an installation might plug in; and Read files joins the other reads as a default, bounded by still needing Manage File Library, which an operator cannot hold.

The AI node's defaults fit the work. Changed in 1.0.6 maxToolIterations 3 → 8 and the node timeout 15s → 60s. Three cannot finish the sequence the Database Explorer skill documents — list the databases, introspect for tables, introspect for columns, then query — so a node was cut off one call short and answered "I don't have access to any data source", which reads as a permission problem and is not one. → AI node

A Python node's timeout reaches its system.* calls. Changed in 1.0.6 A node given 600 seconds used to die on the first system.* call that ran past a fixed internal limit, whatever the node was configured for.

Also in 1.0.6: a Windows arm64 build exists and is produced on request, deliberately out of the default release until somebody has run a gateway on one — an ARM64 laptop installs the x64 build today, and this manual's platform table had been listing arm64 as though it were a download.

Fixes worth knowing about: a tag bound over Siemens S7, Modbus, Allen-Bradley, SNMP or TCP/UDP showed the raw connection UUID where its name belonged; a purged project left phantom pipelines in the SuperAdmin statistics until a restart, and a project created after boot was never watched at all; a failed request to the MQTT Publishing page rendered as "the MQTT Driver module is not licensed" — the worst available mistranslation of "I could not reach the server", because it sends somebody to look at their licence instead of at the error; unticking Retain, the loop guard or publish on change only while creating a publisher was silently ignored; deleting a specialist in the Pipeline workspace left its row in the tree; and a licensed service could silently fail to hear about connection lookups, script file reads or the system.* worker API because the bus had never been told to grant those subjects.

1.0.5

Siemens and Allen-Bradley controllers, spoken natively. New in 1.0.5 Two drivers, and deliberately two — a plant standardised on Siemens should not be carrying an Allen-Bradley licence.

• Siemens S7 reaches S7-300/400 and non-optimized S7-1200/1500 over classic S7comm, by absolute address: data blocks, flags, the process image, timers and counters. The page carries a worked tag for every memory area, because the offset arithmetic (MW4 is the word at byte 4, so the next one is MW6) is where the mistakes live.
• Allen-Bradley (EtherNet/IP) reads Logix controllers by their own tag names. Browse pulls the symbol table and the UDT templates off the controller and fills in both the address and the data type, so you do not have to know either.

Both confirm an address before you bind it: a Read now button shows the decoded value and the raw bytes side by side, which is the difference between "this address is wrong" and "this type is wrong" — two problems that look identical in the number alone.

A refusal no longer costs you the connection. New in 1.0.5 Both drivers multiplex every tag onto a single link. A CPU refusing one address — a data block that does not exist, an offset past the end — is now reported against that tag alone. Every other tag on the controller keeps updating, and the link stays up.

Expression tags. New in 1.0.5 Derived values in CEL, compiled and cached, evaluated server-side. They are fail-closed: a missing input is an error on the tag, never a silent zero — which matters the moment somebody alarms on the result.

A backup you can actually restore from. New in 1.0.5 The archive now carries the whole schema and the File Manager's bytes, and a restore can run at first boot — before commissioning, rather than after it. See Backup & restore.

Licensing. New in 1.0.5 Per-module entitlement, enforced at the service boundary rather than in the UI.

1.0.4

Errors are something a pipeline can act on. New in 1.0.4 Until now a failed node was logged and its branch stopped. Two features change that, and they compose:

• The Catch node receives every failure in its pipeline — or a chosen few — and hands it to whatever should report it: a Telegram message, a dead-letter table, a Link into one central error-handling pipeline. The message it emits carries not only the error but the payload that caused it, so a failure can be replayed rather than only announced.
• A per-node error output puts a second, red socket on any node. Wire it and that node's failure carries on down a branch of its own, so a cached value can be substituted and the rest of the flow still runs. Off by default; every saved pipeline renders exactly as before.

A lost administrator password is recoverable, and a console reset cannot be quiet. New in 1.0.4 qubiq admin reset-password at the server console prints a temporary password once, forces a change at next sign-in, and ends every session that account held. It is recorded three ways, one of which no one can dismiss. First-run setup is now genuinely one-shot: deleting the user table no longer reopens the public setup endpoint, which is the hole this replaces. → Console recovery

The database encryption key has an escape hatch. New in 1.0.4 qubiq db-key create prints a recovery key you write on paper. Without one, a changed service account or a rebuilt profile could leave app.db permanently unreadable — which needs no attacker, just an ordinary Tuesday. The key is also re-sealed on every boot so a service-account change stops being a data-loss event. → Console recovery

A backup will not be read by a build that would read it wrongly. New in 1.0.4 Archives carry a compatibility floor measured from what they actually contain, so an estate that never touched a newer feature keeps producing archives older builds accept. Two silent-corruption bugs went with it: a restore no longer turns disabled connections, disabled tags and suspended users back on. → Backup & restore

A script may not do what its caller could not. New in 1.0.4 Tag write levels now apply to system.tag.write, not just to a write from a screen; and a Gateway script started from a browser button runs with the caller's own capabilities rather than unclamped. The Script Sandbox page also says plainly, at the Install button, that a data library widens what scripts can reach — the sandbox stops mistakes, not a determined author. → The script sandbox

Handled faults have their own log level. New in 1.0.4 WARN sits between routine chatter and an outage, and is filterable. It also fixes a live bug: the log panel had been labelling every warn row RETRYING, telling its reader to expect an attempt that was never coming.

Two new API reference pages — every system.* and context.* member, with worked examples in both languages. → System API · Context API

An electrical symbol library. New in 1.0.4 529 electrical symbols across 24 categories — contacts, breakers, relays, logic gates, op-amps, MOSFETs, PLC ladder elements — join the 485 process symbols on the same canvas. 77 of them carry an operating state you can bind to a tag: a contact opens, a coil lights, a selector turns. Both states share a viewBox and terminal positions, so a bound line stays connected when the tag flips. → Drawing & symbols

The Breakpoint layout. New in 1.0.4 A fourth layout mode, for a screen whose phone version is a different screen rather than a narrower one. Each width tier gets its own authored panel and the view renders exactly one; a tier can mirror another, so a new view costs two screens rather than three. Switches at the project's own breakpoints, measures the container rather than the window (so they nest), and carries a dead-band for the flicker that happens when two tiers disagree about a scrollbar. → Breakpoint layout

The Timer node. New in 1.0.4 The pipeline runtime can now put time between messages — pulse a tag and put it back, hold a burst until it settles, delay every message, count down to a deadline, repeat on a cadence, or raise an alarm when a message that should have arrived did not. One independent timer per topic, controllable from the flow itself. → Timer node

Search that answers three questions. New in 1.0.4 A ⌘K / Ctrl+K palette across every project; faceted tag filters in the namespace (is:disabled, no:binding, is:unused, has:history, is:published, source:expression, …); where is this used for a tag or a connection; and an impact warning before a rename or delete that names what will break. → Search & impact

Telegram sends a position. New in 1.0.4 A pin, a named venue, a live location this platform then moves as a vehicle moves, or a button asking a recipient to share theirs. → Telegram node

Numeric readouts keep their decimals. New in 1.0.4 The Gauge, Tank, Moving Analog Indicator and HMI Trend take a decimals property instead of rounding a value away. A tag reading 23.998 is no longer displayed as 24 with no way to get the fraction back. → Gauge

Zoom and fit controls on the pipeline canvas. New in 1.0.4 Undo, redo, zoom in and out, reset to 100% and zoom-to-fit, with their keyboard equivalents shown on each.

The Connected column carries a date. New in 1.0.4 A LiveView screen on a wall stays up for days, and a bare 14:03 on such a row reads as a few minutes ago when it was Tuesday. The full instant is in the cell's tooltip.

Also in 1.0.4: the trial is recorded outside the data directory, so deleting that folder no longer buys a second one; and the pipeline-level POST /api/pipelines/{id}/execute route was removed — it answered 500 on every call it ever received, and nothing used it.

Fixes worth knowing about: node status badges never rendered in a production build; the runtime's STALE indicator was measuring clock skew rather than staleness; Python results were being refused by the bus, and child processes looked for the interpreter in the wrong directory.

1.0.3

A configuration fix that matters on every production install: every service opened a different app.db. Also: the import browser no longer collapses, and the storage folder picker no longer flickers or turns unreadable on hover.

1.0.2

AI Specialists can compute. New in 1.0.2 A specialist may carry a Python compute body, run end to end behind every fence, and declare its inputs once — so a figure is calculated exactly rather than worked out in a model's head. A specialist can also be saved as a draft: testable by its author, withheld from the assistant. → Answering with code

The trial is 21 days, not 7. New in 1.0.2 A week can vanish waiting for PLC access or a downtime window. → Licensing

On Windows, double-clicking the executable no longer flashes a console, and an uninstalled copy refuses to run.

1.0.1

P&ID line types. New in 1.0.1 ISA-5.1 tells signal lines apart by a repeated glyph rather than by colour — pneumatic hashes, data-link circles, a capillary X, a sonic wave. A line now carries its meaning as a property. → Drawing & symbols

Fittings that ride the pipe. New in 1.0.1 A flange, orifice plate, strainer or spectacle blind sits on a run at a normalised position along it, and stays there through a drag, a bend or a change of routing mode. → Drawing & symbols

A multi-value Progress bar. New in 1.0.1 One track, several coloured segments, each separately bindable, in absolute or proportional mode. → Progress

Storage folders are browsed, not typed. New in 1.0.1 A server-side folder picker with OS-aware suggestions, so a path is chosen rather than guessed at.

The status panel shows every volume QUBIQ writes to, not just one. New in 1.0.1

Open-source notices. New in 1.0.1 A third-party licence inventory, and the page that shows it, at /notices.

Also in 1.0.1: multi-touch pinch and pan on the Designer and pipeline canvases; a rebuilt Windows installer, and the same application identity on macOS and Linux; and licence status in the app status bar.

The Breakpoint Container widget was withdrawn from the component library in this release. The idea returned in 1.0.4 as a layout mode rather than a widget you drag from the palette — its containers are structural, so they are not in the component reference.

1.0.0

The first release. The parts of it this manual gained pages for:

MQTT publishing. New in 1.0.0 Mirror namespace tags out to an external broker — classic MQTT or Sparkplug B, with scope and exclusion fences, four layers of loop protection, and a choice between live and durably-buffered delivery. → MQTT publishing

Per-module licensing. New in 1.0.0 Offline, hardware-bound activation; a modules page that never hides what you do not own; and a lapse that degrades visibly rather than stopping a plant. → Licensing & modules

The Switch node. New in 1.0.0 The first router in the pipeline runtime, and the only node with more than one output. → Switch node

A Color Picker widget, and menu components that can run an action instead of navigating. → Color Picker · Horizontal Menu

AI playbooks, specialists and named endpoints. New in 1.0.0 An answer procedure written down once so every phrasing of a question gets the same complete answer; saved sub-assistants the assistant hands one sub-question to; and an admin-authored menu of lookups into an ERP or a CMMS that the model can select from but never compose. → Playbooks · Specialists · External systems · Skills & fences

---

The platform at a glance

What QUBIQ does, and where each part is documented.

Platform

Ships as one file. A single executable contains every service. Starting it with no arguments boots the supervisor, which runs one process per service under its own QBQ-* name. → Architecture

Zero-port internal bus. The message bus binds to loopback on a random port. No broker port is exposed, authenticated or firewalled, and no service other than the gateways opens a port. → The gateway

Encryption at rest. The configuration database is encrypted with a key bound to the machine it runs on. JWT_SECRET and ENCRYPTION_KEY are required, with no insecure defaults. → Security

In-app setup wizard. There is no default account and no create-superadmin step; the first super admin is created through the interface, once. → First-run setup

Connectivity

Protocol coverage — OPC-UA, MQTT with Sparkplug B, Modbus, SNMP (v1/v2c/v3 with vendor MIBs and traps), raw TCP/UDP, SQL, MongoDB, QuestDB and media servers — plus SMTP, Telegram and WhatsApp for notification and a Qdrant vector store for the assistant. → Connections

Publishing out, not just reading in: tags mirrored to an external broker in classic MQTT or Sparkplug B, at the change rate rather than the scan rate, with a per-publisher heartbeat and a per-tag cadence. → MQTT publishing

Passive liveness. Connection health comes from the protocol libraries' own callbacks rather than from polling. LIVENESS_MODE selects passive (default), hybrid or active. → Connections

OPC-UA node quarantine. A repeatedly-failing node is quarantined so one bad address cannot degrade a whole subscription, with a release path when the PLC program is fixed. → OPC-UA

Isolated MIB compilation. Vendor SNMP MIBs are compiled in a separate child process, so a malformed MIB cannot crash the gateway. → SNMP

Data model

User-defined types with parameters, nesting, reconciliation planning, per-instance overrides and member-context capture/revert. → User-defined types

Portable namespace import/export. Documents carry no database identifiers and reference connections by name, so a model moves between environments cleanly. → Bulk import & export

Tag write-security levels. A 0–3 hierarchy enforced server-side, independent of the writable flag. → Tags

Reference tracking. Where a tag is used, what a rename would break, and what nothing references at all. → Search & impact

Historian

History epochs. Changing the historian is non-destructive: reads resolve across epochs and stitch the timeline. Range statistics are recombined exactly rather than averaged. → Historian

Physical store ownership. Ownership is recorded inside the QuestDB store, so a cloned VM or a restored backup cannot silently corrupt a live historian. → QuestDB

Self-healing. Schema-drift repair in place, write-ahead-log supervision that alarms and leaves any history-losing skip to an operator, and rollups rebuilt automatically only when nothing is lost.

Quality and event time in history — every row records its quality and whose clock stamped it, with 1-hour and 1-day rollup tiers for long trends and statistics such as time-weighted average, totals, counter increase and run time. → Quality and time → Historian configuration

Live-tail merge. Recent in-memory samples are merged into live chart queries, so charts look live despite batched storage.

Reliability

Store and forward for all outgoing data writes: a durable per-connection buffer, ordered ack-after-flush drain, an ordering latch, transient-versus-permanent failure classification, buffer pressure alarms and an operator quarantine. → Store and forward

Pipeline error handling — a Catch node that reports any node's failure with the payload that caused it, and a per-node error output that lets the flow recover in place. → Errors

Alarms

ISA-18.2 lifecycle — NORM / UNACK / ACK / RTNUN, with latching, require-ack, on/off delays, absolute and percentage deadbands, and bad-quality alarming. → Configuring alarms

Three distinct suppression kinds — timed shelving with automatic release, indefinite suppress-by-design, and out-of-service — so the reason an alarm is silent is always recorded. → Operating alarms

Performance metrics — rate, floods, bad actors, priority distribution and standing alarms.

Visualization

56 widgets, 9 drawing tools, 1048 symbols — 485 process (P&ID) and 529 electrical, plus a digital-twin 3D viewer, PDF, video, maps, scheduling, QR and barcode generation and scanning, and a full form engine. → Components

Your own symbol library — import SVGs or draw symbols in the Symbol Editor, with parameters, rules, states and ports that bind to tags, or ask the AI to draw one. → Symbol Editor

Vector drawing with orthogonal, isometric and curved routing, endpoint binding to equipment, ISA-5.1 line types, in-line fittings and stroke animation for process mimics. → Drawing & symbols

Four layout modes — coordinate, grid, flex and breakpoint — chosen per view. Breakpoint gives each width tier its own authored screen rather than reflowing one. → Views and layout · Breakpoint layout

Optimistic locking on views, scripts and pipelines: a conflicting concurrent save is rejected rather than silently overwriting.

Streamed query results in LiveView, so a large result set renders as it arrives rather than after it has all landed.

Pipelines

26 node types across nine categories — sources, routing, protocol I/O, databases, transforms, AI, notification, REST, the message bus and error handling. → Node reference

A project message bus shared by pipelines, screens and scripts, with request and reply. → Message bus

Scripting

One API surface in two languages. system.* is identical, camelCase, in Python and JavaScript. → System API reference

Gateway scripts with default-deny @gateway exports, static AST-based discovery and idempotency keys. → Gateway scripts

Managed transactions with isolation levels and a server-side TTL, so a browser disconnect cannot strand an open transaction.

Capability scopes gating every system call, fail-safe by default — a newly-added API is gated rather than accidentally open. → The script sandbox

Administrator-installed Python packages, isolated in a managed directory with a connectivity check for air-gapped networks.

Security

Two independent sign-in systems. Engineers and plant operators sign in separately, against different user stores. Neither system accepts the other's sign-in. → LiveView authentication

Tamper-evident audit journal in an external SQL database, hash-chained, durable-buffered, with a verification endpoint — aligned to IEC 62443-3-3. → Audit journal

Scoped API keys, hashed at rest, with fail-closed REST routes, IP allow-lists, rate limits and payload caps. → API keys

Sandboxed user SQLite connections, confined to a resolved directory with traversal and internal-database denial.

Console recovery without a back door. A lost administrator password and a lost database key are both recoverable by somebody with the server's data directory, and by nobody else. Every reset is audited and surfaced where an administrator will see it. → Console recovery

AI assistant

Propose-and-approve. The assistant drafts views, pipelines, alarms and queries as proposals a human approves. Actions are audited under both the assistant and the approving user. → AI assistant

Skills, realms and fences. What an assistant may do is the intersection of its skills, where it runs, what the administrator switched on, and what the person asking already holds — and each instance carries its own fences over tags, databases, external systems and specialists. → Skills & fences

Playbooks and specialists — a procedure written down once, and saved sub-assistants with their own fences and budgets. → Playbooks · Specialists

Per-connection access and read-only credentials, so the assistant can explore a production database without being able to change it.

Administration

Per-module, offline licensing with a modules page that locks rather than hides, and a licence that reaches every running service without a restart. → Licensing & modules

Backup and restore with whole-archive passphrase encryption, secret re-keying between machines, opt-in media, and a filename pre-flight that makes an archive portable between Linux, Windows and macOS. → Backup & restore

Project lifecycle — enable, disable, trash with a 30-day retention window, restore and purge. → Projects

Service control from the interface, with the supervisor honouring a deliberate stop. → Services

---

Upgrading

1. Take a backup — schema migrations are not reversible.
2. Stop the service.
3. Replace the binary.
4. Start it. The supervisor migrates the schema before spawning children.
5. Check the startup report, then verify connections and pipelines.

Coming from 1.0.7, read Before you upgrade first. Upgrade QuestDB to 9.4.0 or later before you upgrade QUBIQ, and plan to review menus, maps, 3D Viewers and any script that sends messages.

Coming from 1.0.5, two changes are worth checking after the first start:

• MQTT publishers drop to the change rate. Intended, and a large reduction — but if a subscriber was treating message arrival as a liveness signal, give the publisher a heartbeat.
• Exports no longer carry File Manager or uploaded files by default, so the next backup will be dramatically smaller than the last. Tick Include File Manager & uploaded files for a full disaster-recovery copy, or back those two folders up with your file-backup tool. → Media

Keep .env. Losing ENCRYPTION_KEY makes every stored credential unrecoverable, and losing this machine's database key store makes app.db unreadable — so run qubiq db-key create and file the code somewhere off the machine. → Console recovery

Check your licence covers the version

A licence names the versions it covers. Upgrading past that ceiling reports version not covered — not unlicensed — and the remedy is to install the version you own or extend the licence. → Licensing