Industrial Ethernet Basics
Engineering Determinism in Operational Technology (OT)
1. The Priority Inversion: IT vs OT
In standard enterprise IT networking, the primary goal is protecting data (Confidentiality). In Industrial Operational Technology (OT), the primary goal is protecting physical assets and human safety (Availability). This inversion of priorities fundamentally changes how we design and troubleshoot networks.
Information Technology (IT)
- Priority: CIA (Confidentiality First)
- Latency: Tolerant (milliseconds to seconds)
- Updates: Frequent & Automated
- Devices: 3-5 Year Lifecycle
Operational Technology (OT)
- Priority: AIC (Availability & Safety First)
- Latency: Deterministic (micro-jitter)
- Updates: Strictly Controlled (Change Mgmt)
- Devices: 15-30 Year Lifecycle
2. The Purdue Model: Logical Segmentation
The Purdue Enterprise Reference Architecture (PERA) remains the global standard for segmenting industrial networks. It ensures that a compromised email server in the office cannot directly command a robotic arm on the factory floor.
| Level | Name | Function |
|---|---|---|
| Level 4/5 | Enterprise IT | ERP, Email, Internet Access |
| Level 3.5 | Industrial DMZ | The Barrier: Jump hosts & Data Historians |
| Level 3 | Site Operations | SCADA Servers & HMI Masters |
| Level 2 | Area Control | PLCs executing local safety logic |
| Level 1 | Basic Control | Smart Sensors & Motor Drives (VFDs) |
3. Determinism & TSN
Standard Ethernet uses statistical multiplexing, which can lead to random delays (collisions and queuing). In a high-precision robot cell, high bandwidth is less important than Zero Jitter. Time-Sensitive Networking (TSN) adds mechanisms for scheduled time-slots on the wire.
PTP (Precision Time Protocol)
IEEE 1588v2 (PTP) provides nanosecond-level synchronization between switches and devices. Unlike NTP, it uses hardware-level timestamping at the PHY layer, accounting for the exact "residence time" a packet spends inside a switch.
Read more: Deep Dive into TSN & Determinism →4. Hardening Legacy Protocols
Most industrial protocols (Modbus, DNP3, CIP) were designed for serial lines and lack native encryption. When encapsulated in Ethernet (IP), they become susceptible to spoofing and unauthorized register writes.
- Modbus TCP: Port 502. No authentication. Must be isolated within a Level 2/3 zone and guarded by Deep Packet Inspection (DPI) firewalls.
- PROFINET IRT: Layer 2 protocol (no IP head). Requires specialized industrial switches to handle isochronous cycles.
- EtherNet/IP: Uses CIP (Common Industrial Protocol) over TCP/UDP. Heavily reliant on IGMP snooping for multicast management of I/O traffic.