Manufacturing IT
Wi-Fi that holds in a racked aisle, VLANs that separate production from office, and cabling built for a building with forklifts in it.
Plant networks should separate office traffic, production equipment, scanners, voice and cameras into distinct VLANs with firewall policy between them; provide Wi-Fi validated for handheld devices moving through full racks rather than for an empty room; use fiber between buildings and closets; and place IDFs so copper runs stay within spec across large floor plates.
Steel racking, stacked inventory, refrigeration, high ceilings and moving equipment all attenuate and reflect signal. Handheld scanners have weaker radios than laptops and roam constantly.
Coverage has to be designed along the aisles and validated at device height with the racks loaded. A survey of an empty warehouse describes a building that will not exist next month.
Once receiving, picking and shipping depend on a cloud ERP, an internet outage is a production outage. Redundant connectivity stops being a nice-to-have and becomes part of the operating plan.
A plant network designed around the Purdue model so control systems stay reachable without becoming a doorway into the business.
The Purdue model organizes a manufacturing environment into levels: Level 0 field instruments, Level 1 controllers, Level 2 local operator interfaces, Level 3 manufacturing operations and the control center LAN, Level 4 enterprise business systems, and Level 5 the internet. The design goal is that a problem in a higher level cannot directly reach a lower level, so a compromised office PC cannot send commands to a PLC.
Industrial control systems were not designed for the internet. They often run old operating systems, rely on flat addressing, and assume every device on the network is trusted. When they are connected to the same network as the office, ransomware, misconfigured updates, or a single malicious email can stop production.
The Purdue model solves this by separating zones and only allowing traffic through controlled, documented paths.
The DMZ is the only place where business and control systems are allowed to meet. A historian replica in the DMZ lets ERP and reporting read production data without touching the live SCADA server. A patch server in the DMZ can push updates to isolated equipment. A jump server lets vendors reach the device they support without a tunnel to the rest of the plant.
The physical layer that lets a plant keep running: hardened switches, fiber, ring topology and cabling built for heat, vibration and metal.
Plant floor networks have to survive conditions office networks never see: high heat, dust, vibration, electromagnetic interference from welders and VFDs, and physical abuse from forklifts and production carts. Industrial Ethernet uses hardened switches, ruggedized cabling, fiber between buildings and cabinets, ring topology for fast failover, and proper grounding and shielding. An office-grade switch in a machine cabinet will fail, often silently, until a line stops.
A ring topology lets the network heal around a single cut cable or failed switch in milliseconds. Redundant uplinks from each cell/area back to the control center keep a single point of failure from taking down a whole production zone.
Cable that works in a ceiling does not work on a plant floor. We use armored, shielded, oil-resistant, high-flex or metal-clad cable where the path requires it, and we keep cable runs away from VFDs, welders and high-voltage lines.
EtherNet/IP, PROFINET, Modbus, OPC UA and MQTT: how machines talk, and how to get their data out without destabilizing control.
Modern machines commonly use EtherNet/IP, PROFINET or Modbus TCP over Ethernet. Older equipment still uses serial fieldbus such as Modbus RTU, DeviceNet or PROFIBUS. To get data from these systems to ERP and reporting safely, we use OPC UA or MQTT brokers as a translation and isolation layer, so business systems read from the broker instead of polling controllers directly.
Industrial protocols are often chatty and sometimes broadcast-heavy. A misconfigured DHCP server, a duplicate IP, or a device leaking multicast traffic can stop a deterministic network. IGMP snooping, VLANs, QoS and careful IP planning are not optional once the machine count grows.
We never let ERP or BI talk directly to a PLC. Data flows from the controller to an HMI or SCADA, then to a historian or OPC UA/MQTT broker in the industrial DMZ, and from there to business systems. The return path is blocked.
Plant Wi-Fi designed for scanners and mobile devices that move through racking, metal and changing inventory.
Warehouse and plant environments are full of signal killers: steel racking, high ceilings, refrigeration units, moving equipment and loaded inventory that changes by the day. A heat map shows actual signal strength at device height along the aisles, so access points are placed where they are needed and not where the ceiling makes it easy. Without it, barcode scanners and forklift-mounted terminals drop sessions, forcing users to re-enter work or lose scans.
Barcode scanners and vehicle-mounted terminals have different radios and roaming behavior than laptops. A design that looks good on a laptop survey can fail for handhelds. We validate with the same devices operators carry, moving at the same speeds they move.
Production scanners, AGVs, visitor devices, voice and office traffic should not share the same wireless space. We separate them with SSIDs, VLANs and bandwidth controls so a warehouse employee's phone does not compete with a scan that posts inventory to ERP.
Connect older machines and brownfield equipment to reporting without letting them touch the control network.
Many productive machines have no Ethernet port, no API and no digital output. We connect them at the edge: add a sensor or tap an existing signal, collect data on a hardened gateway, and push it one-way to a historian or broker. The data flows out for OEE and reporting, but nothing flows back into the machine controller. The machine keeps running exactly as it did, and we do not ask the vendor to change anything.
The fastest way to create a safety or warranty problem is to send commands back to an old machine. Our edge designs are read-only by default. If a control signal is required, it is engineered separately, documented, tested and approved by the machine owner and vendor.
You do not need all new machines to get useful data. The first phase is often a proof of concept on one or two lines: count cycles, measure uptime, capture downtime reasons. Once the value is proven, the design is repeated across the plant.
Standards that let a second or third plant open without reinventing the environment.
Every site adds a network, a set of devices, a set of users and a piece of the inventory picture. Without standards, each location drifts into its own design, and reporting stops reconciling. Multi-site work means a repeatable network and identity template, consistent ERP location and dimension structure, reliable site-to-site connectivity, and one place to see all of it.
New buildings need circuits ordered months ahead, cabling designed before tenant improvements finish, and an ERP location configured before the first receipt. Discovering that during move week is expensive.
We keep a deployment checklist so a new site is a repeat of a known process rather than an improvisation.
Common questions
Often yes — placement, channel and power tuning, and adding a few well-placed access points fixes many aisle dead zones. When drops don't exist where coverage is needed, cabling is the honest answer.
Yes. We design and specify, then manage the contractor to that specification so labeling and documentation stay consistent.
Yes. The model is about network zones and firewall rules, not about replacing controllers. The hard part is usually discovering what is actually on the floor and deciding what each device really needs to talk to.
No. The model is a reference, not a mandate. A small shop may collapse some levels, but the principle remains: separate control from office and make the path between them intentional.
In clean, climate-controlled office areas, yes. In machine cabinets, production lines or warehouses, industrial switches are worth the cost because they fail less often and give better diagnostics when they do.
Depending on the protocol and switch hardware, ring healing can happen in under 50 milliseconds. That is fast enough that most production protocols do not notice a single link failure.
Yes, with protocol gateways that convert serial to Ethernet or Modbus TCP to OPC UA. The gateway is placed in the right zone and configured to expose only the data required.
No, if it is separated. MQTT is for telemetry, not control. It sits on a separate network path or VLAN, so production messages keep their priority.
After any major racking change, seasonal inventory shift, or when new devices are introduced. A static design is usually wrong within a year in a busy warehouse.
Sometimes — power, channel, antenna and orientation changes can fill gaps. But in many cases, especially in high racking or long aisles, adding an AP is the honest fix.
No, if done correctly. Non-intrusive taps and separate edge gateways do not modify the machine control system. We coordinate with the vendor when anything touches the machine's own network.
Cycle counts, run/stop state, uptime, part count, vibration, temperature, power draw and alarms. The goal is enough to calculate OEE and downtime without interfering with control.
It depends on latency tolerance and what must keep running during a connectivity failure. Many manufacturers land on local infrastructure for production-critical systems and cloud for everything else.
As soon as the lease is being considered — circuit availability and lead times at that address can influence the decision itself.
We review your network, security posture, cloud tenant and recovery plan, then hand you a plain-language report of what we found and what it means for the business.
