Industrial networking is the design of the wired and wireless networks that connect machines, controllers, and plant systems. It differs from office networking in one demand: control traffic cannot wait. That drives the whole toolkit, managed switches, ring topologies, VLAN segmentation, and determinism, so data arrives reliably and on time without exposing the control layer.
Most plant network trouble is not exotic. It is a flat network someone grew by adding unmanaged switches until an office broadcast storm jittered a motion loop, or a "temporary" cable that bridged the control network to the internet and never came out. This guide covers the basics that prevent both: topologies, the switches that matter, segmentation with VLANs, why determinism is a real requirement, and how OT networks differ from IT networks.
Why does the plant floor need its own kind of network?
Because a late packet on the floor is a failure, not an inconvenience. When you load a web page and it takes an extra 80 milliseconds, you never notice. When a controller's command to a drive is 80 milliseconds late, a motion loop can fault, a robot can trip, or a product can be ruined. Office networks are built for throughput and best-effort delivery; control networks are built for predictable timing and uptime. Same cables and connectors, very different priorities, and confusing the two is the single most common source of plant network pain. It is worth naming the failure mode directly, because it is so common: an IT team, applying perfectly reasonable office practices, pushes a switch firmware update or a network scan during production and inadvertently stalls a control loop that had no slack to give. Nobody was careless; the two worlds simply run by different rules, and the fix is to treat the control network as its own domain with its own change control rather than an extension of the office LAN.
| Dimension | Office (IT) network | Control (OT) network |
|---|---|---|
| Top priority | Throughput, features, confidentiality | Determinism, uptime, safety |
| Late data | A minor delay | A potential fault or hazard |
| Downtime tolerance | Reboot when convenient | Must keep running |
| Equipment life | 3-5 years | 10-30 years |
| Change cadence | Frequent updates | Change-controlled, cautious |
What are the common network topologies?
Topology is the shape of the wiring, how devices connect to each other. Three shapes cover most of the floor, and the choice is mostly about what happens when a cable breaks.
Star is the office default, everything home-runs to a switch, which is simple but makes that switch a single point of failure. Line (or bus) daisy-chains devices, which saves cable on a long conveyor but means one break can split the network. Ring is the floor favorite: it wires like a line but closes the loop, so a single cable break heals automatically. With managed switches running a redundancy protocol, a ring can recover in tens of milliseconds, fast enough that control often never notices.
Why do managed switches matter?
Because an unmanaged switch just passes traffic, while a managed switch lets you control it, and control is the entire game on a plant network. A managed switch can prioritize control traffic over bulk data, run ring-redundancy protocols, enforce VLAN segmentation, and report its own health so you see a failing port before it fails. Unmanaged switches are cheap and invisible, which is exactly the problem: they hide the network from you and treat a firmware download and a safety heartbeat as equally urgent. The rule of thumb: unmanaged switches are fine for a printer closet and wrong for a control network.
What are VLANs and why segment the network?
A VLAN (virtual LAN) splits one physical network into separate logical networks, so devices that should not talk to each other cannot, even on the same switch. Segmentation is the practical heart of both reliability and security. Put control traffic on its own VLAN and an office broadcast storm can no longer reach a PLC. Put the guest Wi-Fi on another and a visitor's laptop can never see the control system.
Segmentation is also where networking meets security. The zones-and-conduits architecture of IEC 62443 is, at the network layer, exactly this: VLANs and firewalls that keep the control zone isolated and inspect anything crossing between zones. A flat network, one big VLAN where everything can reach everything, is the condition every industrial security guide warns against, because a single compromised laptop can then reach the safety controller.
What does determinism mean, and when do you need it?
Determinism means data arrives within a guaranteed time window, every time, not just usually. Standard Ethernet is best-effort: it delivers eventually, but timing wanders, and under heavy load that jitter can stretch into the tens of milliseconds. Fast control loops cannot live with that uncertainty, which is why real-time industrial Ethernet protocols and, increasingly, Time-Sensitive Networking (TSN) add guaranteed timing on top of ordinary Ethernet.
The honest guidance: you need hard determinism only for the fast control loops, motion, safety, tightly coupled I/O. Data collection for machine monitoring dashboards, and analytics does not need it, because a metric arriving 50 milliseconds late is still perfectly useful. This matters for planning: getting data off the floor for a data layer is a far lighter networking job than the real-time control it reads from, so do not let control-grade requirements scare you off a monitoring project.
Where does wireless fit on a plant network?
At the edges, deliberately, never as a shortcut around good wiring. Wired Ethernet remains the backbone of any serious control network because it is predictable and hard to jam. Wireless earns its place for things that move or cannot be cabled: tablets at operator stations, sensors on rotating equipment, vehicles that roam the floor. The classic case is an AMR fleet autonomous mobile robots that cannot trail a cable and depend on solid, well-planned Wi-Fi coverage to stay coordinated.
The rules for wireless are the same as for everything else, just stricter. Put it on its own segment, so a compromised or misbehaving wireless device cannot reach the control VLAN. Treat coverage as an engineering problem, not a guess, dead spots on a floor full of steel and moving equipment are common, and a dropped connection to a moving robot is a safety concern, not a nuisance. And be honest about what belongs on wireless at all: the fast, safety-critical control loops stay wired, while wireless carries the data-collection and mobility traffic that tolerates the occasional retransmit. Done that way, wireless extends the network without weakening it. Done as a lazy substitute for pulling cable, it becomes the flaky layer everyone blames and no one can fix.
How do you design a solid industrial network?
- Map what exists. Document every switch, cable run, controller, and connection. Unmanaged switches hiding in panels are where problems and security gaps live.
- Separate OT from IT. Put control traffic and business traffic on different segments. This one decision prevents the majority of avoidable network incidents.
- Use managed switches on the control network. You need prioritization, redundancy, VLANs, and health reporting, none of which an unmanaged switch provides.
- Segment with VLANs and a firewall. Give control, supervisory, and office traffic their own VLANs, and route anything crossing between them through a firewall on purpose.
- Choose topology for resilience. Use ring redundancy where a cable break must not stop production; reserve simple star wiring for non-critical areas.
- Plan the path for data out. Decide now how monitoring data leaves the control network, a read-mostly conduit through a gateway, so connectivity is designed in, not bolted on.
What do the standards say?
- Time-Sensitive Networking (TSN) is a set of IEEE 802.1 standards that add deterministic, real-time delivery to standard Ethernet through features like time synchronization and traffic scheduling (IEEE 802.1 TSN).
- Network segmentation into zones and conduits the VLAN-and-firewall discipline above, is the core of the ISA/IEC 62443 industrial security series.
- U.S. federal OT security guidance, NIST SP 800-82 Revision 3, treats network segmentation as a foundational control for protecting SCADA, DCS, and PLC environments (NIST).
A well-designed industrial network is invisible when it works and priceless when something goes wrong. It is also the foundation everything else in this cluster stands on, the protocols run over it, the gateways plug into it, and the control systems depend on it. Even mobile automation like an AMR fleet lives or dies on solid wireless segmentation. Get the network right and connecting the floor for real-time visibility becomes a straightforward step rather than a fight. Harmony reads from that connected floor to compute true OEE and surface issues, with the control network segmented and untouched (see the connected systems module). For the bigger picture, see IIoT and smart factory technology.