Industrial Networks

Industrial versus office Ethernet

Industrial Ethernet is ordinary Ethernet (IEEE 802.3 frames, MAC addresses, VLANs) running on equipment built for factories, substations, wind farms and pumping stations. The protocols are familiar to anyone from IT; the environment and the expectations are not.

• Harsh conditions. A switch in an outdoor cabinet or next to a 150 kV transformer sees temperatures far below zero and well above 50 °C, dust, humidity, vibration and strong electromagnetic fields. Industrial switches are fanless, have extended temperature ratings and are tested for electromagnetic immunity; substation-grade equipment is tested against standards such as IEC 61850-3 and IEEE 1613.
• Mounting and power. Devices clip onto a DIN rail (a standard metal rail in a control cabinet), take 24 V or 48 V DC, often from two redundant power inputs, and may use screw terminals or rugged M12 connectors instead of RJ45.
• Fiber where copper would suffer. Inside a substation, fiber-optic cable is common because it is immune to electrical interference and keeps high-voltage equipment electrically isolated from control rooms.
• Long life. An office switch is replaced after five to seven years. Industrial network equipment often stays in service for fifteen years or more, because replacing it means an outage of the process it serves. That is why old firmware and unsupported devices are normal in OT, and why the OT security approach differs from IT.

The traffic differs too. An office network carries bursty human traffic (web, mail, video calls). An industrial network carries small, regular, machine-to-machine messages: a controller polling its I/O every few milliseconds, a supervisory system polling field devices every second or two, protection relays exchanging trip signals. The industrial protocols page covers what those messages look like.

Determinism and real time

Determinism means that a message is delivered within a known, guaranteed maximum time, every time. "Real time" in control engineering does not mean "fast"; it means "on time". A network that delivers 99.9% of messages in 1 ms but occasionally needs 300 ms is fast on average and useless for protection.

Two numbers matter: latency (how long a message takes) and jitter (how much that time varies). Why jitter hurts:

• Control loops assume measurements arrive at a fixed rate. A PID controller (see industrial control systems) that receives a sample late computes the wrong rate of change, and the loop starts to oscillate.
• Protection must clear a short circuit before it damages equipment or makes the grid unstable. Inside a substation, trip messages between relays (IEC 61850 GOOSE) must arrive within a few milliseconds. A late trip is a failed trip.
• Motion control (robots, printing presses, packaging lines) coordinates many axes. If one drive receives its position command late, parts collide.

Classic Ethernet gives no guarantees: a frame can wait behind a large file transfer in a switch queue. Industrial networks get close to determinism by keeping control traffic on separate, lightly loaded networks or VLANs, prioritizing it with IEEE 802.1p priority tags, and, for the strictest cases, using fieldbuses and Ethernet variants with scheduled transmission (PROFINET IRT, EtherCAT) or Time-Sensitive Networking.

Rings and the Media Redundancy Protocol

Office networks are trees: access switches hang off distribution switches. In a plant, cable runs follow the process, so switches are often daisy-chained along a production line or between bays in a substation. A chain (a line) breaks completely when one cable or switch fails. Closing the chain into a ring gives every switch a second path.

A ring is also a layer 2 loop, so one link must be logically blocked until it is needed. The Spanning Tree Protocol can do that, but its convergence time depends on the topology and can run to seconds, and classic STP takes tens of seconds. Industry uses ring protocols that are simpler and faster.

The Media Redundancy Protocol (MRP, IEC 62439-2) is the standardized one. One switch is the ring manager; the others are ring clients. The manager sends test frames around the ring from both of its ring ports and keeps one port blocked as long as the test frames come back. When a cable or switch fails, the test frames stop arriving (and clients next to the break report the link loss); the manager unblocks its port and tells the switches to flush their MAC address tables so traffic takes the other way round.

The standard defines worst-case recovery time classes. Vendor documentation describes classes of 500, 200 and 30 ms for rings of up to 50 switches, and 10 ms for rings of up to 14 switches. For supervisory traffic that is fine. For a protection trip that must arrive in a few milliseconds, even 10 ms of lost frames is too much, which is why the next section exists.

Zero recovery time: PRP and HSR

Rings recover after a failure. The two protocols of IEC 62439-3 avoid recovery altogether: every frame is sent twice, over two independent paths, and the receiver keeps whichever copy arrives first. A single failure therefore loses no frames and costs no time. This is what substations with IEC 61850 protection and process buses typically use.

Parallel Redundancy Protocol

With the Parallel Redundancy Protocol (PRP), every critical device has two network ports connected to two completely separate LANs, called LAN A and LAN B. The two LANs can have different topologies and even different switch vendors; they share nothing. The sending device transmits each frame on both LANs and appends a short trailer with a sequence number. The receiver passes the first copy to the application and discards the duplicate. Devices with only one port connect through a redundancy box (RedBox).

High-availability Seamless Redundancy

High-availability Seamless Redundancy (HSR) gets the same effect with a single ring and no separate switches. Each device has two ring ports and forwards frames for its neighbors. A sender puts each frame into the ring in both directions, with an HSR tag carrying a sequence number. The destination accepts the first copy and discards the second; when a frame comes all the way round to its sender, the sender removes it, so frames do not circulate forever.

The trade-offs are practical. PRP doubles the network hardware but leaves each LAN an ordinary Ethernet network. HSR needs no extra switches, but every frame travels the ring twice and every device forwards traffic for the others, so ring size and bandwidth are limited and every ring device must support HSR. Both only protect against a single failure: if LAN A and LAN B share one power supply, one cable duct or one misconfiguration pushed to both, the redundancy is gone. Look for such single points of failure when you review a design.

Duplicate discard in Python

The receiver's job is simple to model: remember which (source, sequence number) pairs it has already seen. In the list below, LAN A lost one frame, and the application still receives every message exactly once.

# Simplified PRP receiver: each frame arrives on LAN A and LAN B with the
# same source and sequence number. Keep the first copy, discard the second.
frames = [
    # (LAN, source, sequence number, payload), in order of arrival
    ("A", "relay-01", 4101, "breaker 1 closed"),
    ("B", "relay-01", 4101, "breaker 1 closed"),
    ("B", "relay-01", 4102, "current 412 A"),
    ("A", "relay-01", 4102, "current 412 A"),
    ("B", "relay-02", 977, "trip"),        # LAN A lost this copy
    ("A", "relay-01", 4103, "current 415 A"),
    ("B", "relay-01", 4103, "current 415 A"),
]

seen = set()
delivered = 0
discarded = 0
for lan, source, seq, payload in frames:
    key = (source, seq)
    if key in seen:
        discarded += 1
        print(f"LAN {lan}  {source} #{seq:<5} duplicate, discarded")
    else:
        seen.add(key)
        delivered += 1
        print(f"LAN {lan}  {source} #{seq:<5} delivered: {payload}")

print(f"\n{delivered} delivered, {discarded} discarded")

LAN A  relay-01 #4101  delivered: breaker 1 closed
LAN B  relay-01 #4101  duplicate, discarded
LAN B  relay-01 #4102  delivered: current 412 A
LAN A  relay-01 #4102  duplicate, discarded
LAN B  relay-02 #977   delivered: trip
LAN A  relay-01 #4103  delivered: current 415 A
LAN B  relay-01 #4103  duplicate, discarded

4 delivered, 3 discarded

Real implementations keep a sliding window of recent sequence numbers per source instead of an ever-growing set, and they count how often only one LAN delivered a frame. That counter is useful monitoring: a LAN that silently stopped delivering leaves the system running without redundancy, and nobody notices until the second failure.

Precise time: PTP versus NTP

Office networks synchronize clocks with NTP, which typically keeps servers within about a millisecond of each other over a LAN (tens of milliseconds over the internet). That is plenty for log timestamps and Kerberos. It is not enough for a substation.

The Precision Time Protocol (PTP, IEEE 1588, also published as IEC 61588) reaches sub-microsecond accuracy. A grandmaster clock, usually locked to GPS or another satellite system, sends time messages; every PTP-aware switch on the way measures how long it held each message and corrects for it (a transparent clock), or acts as a clock itself (a boundary clock). Because the variable queueing delay is measured instead of guessed, the remaining error is tiny. In substations, the power profiles run PTP directly on Ethernet, as a layer 2 protocol that does not cross routers; other profiles carry it over UDP/IP (ports 319 and 320).

Industries define profiles of PTP: which options to use and what accuracy to reach. For power utility automation, the profile is IEC/IEEE 61850-9-3:2016, which targets an accuracy of about 1 µs; IEEE C37.238-2017 is a related power profile.

Why substations need microseconds

The grid runs at 50 Hz, so one cycle lasts 20 ms and one degree of phase angle is about 56 µs. Protection and measurement compare currents and voltages taken at different places:

• Sampled values on the process bus. Merging units next to the high-voltage equipment digitize current and voltage thousands of times per second and send the samples to protection relays. A relay that compares samples from two merging units assumes they were taken at the same instant. A 1 ms timing error is an 18° phase error (360° × 1/20), enough to make a healthy line look faulty or hide a real fault.
• Line differential protection and phasor measurement. Comparing the current entering and leaving a line, or the phase angles across a whole grid, only works if all ends share the same time.
• Event reconstruction. After a disturbance, engineers line up recordings from many substations to see which breaker opened first. Sequence-of-events records need a common clock to be meaningful.

Serial links and serial-to-IP gateways

Before industrial Ethernet, field devices talked over serial lines, and many still do: meters, drives, older protection relays and remote I/O installed decades ago. RS-485 (TIA/EIA-485) is the most common physical layer: two wires carrying a differential signal, which makes it robust against electrical noise. It is a multidrop bus, so one master can talk to many devices on the same pair of wires, typically up to 32 standard loads and distances of around 1,200 m at low speeds. It is the most common physical layer for Modbus RTU; RS-232 (point to point, short distances) appears on older equipment and maintenance ports.

Serial networks have no addresses beyond the device number in the protocol, no authentication and no encryption. Anyone with access to the wires, or to the device that bridges them to IP, can read and send messages.

A serial-to-IP gateway (also called a serial device server, or a protocol converter when it also translates, for example from Modbus RTU to Modbus TCP) connects those serial devices to the Ethernet network. They are small, cheap and often forgotten, which makes them important:

• The gateway is where serial devices become reachable from the IP network. Its firewall rules and management interface decide who can talk to everything behind it.
• Its firmware is a target. In the December 2015 attack on Ukrainian distribution companies, the attackers corrupted the firmware of serial-to-Ethernet devices, which cut the control centers off from their substations and slowed recovery (see threats and notable incidents).
• It belongs in the asset inventory, with its firmware version, configuration backup and spare.

Time-Sensitive Networking

Time-Sensitive Networking (TSN) is a set of IEEE 802.1 standards that add determinism to standard Ethernet. The main building blocks:

• Time synchronization (IEEE 802.1AS, a profile of PTP), so every switch shares one clock.
• Scheduled traffic (IEEE 802.1Qbv): switches open and close transmit queues on a fixed timetable, so a control frame never waits behind a bulk transfer.
• Frame preemption (IEEE 802.1Qbu with IEEE 802.3br): an urgent frame can interrupt a long one in progress.
• Redundancy (IEEE 802.1CB): frame replication and elimination, the same idea as PRP and HSR.

The promise is one converged network for control traffic and everything else, replacing several incompatible industrial Ethernet variants. The industrial automation profile, IEC/IEEE 60802, was published as Edition 1.0 in June 2026. As of 2026, TSN is in new products and new plants, while most installed systems still run the techniques described above. Expect to meet it in designs before you meet it in operation.

Data diodes and unidirectional gateways

Many OT environments need to send data out (measurements to a historian copy in the IT network, logs to a security operations center) without accepting anything in. A firewall can enforce that with rules, but rules can be misconfigured, and the firewall itself is software that can have vulnerabilities.

A data diode enforces one-way traffic physically: in a fiber-based design, the sending side has only a transmitter and the receiving side only a receiver, so no signal can travel back however the software is configured. A unidirectional gateway adds software on both sides. Because protocols such as TCP need acknowledgments, the sending-side proxy talks to the OT systems, pushes the data over the one-way link, and the receiving-side proxy replays it to IT systems (for example, replicating a historian or forwarding syslog).

The UK NCSC guidance Secure connectivity principles for operational technology (January 2026), published with international partner agencies including the Dutch NCSC-NL, sets out eight principles for connecting OT, from limiting exposure and hardening the OT boundary to logging all connectivity and having an isolation plan. It treats one-way devices as a strong control for directionality, and warns that they are not a complete solution on their own.

• A diode does nothing against threats that arrive another way: a maintenance laptop, a USB stick, a vendor's remote access (see remote access and third parties).
• The outbound data can still be wrong, so the receiving side must treat it as untrusted input.
• Anything that needs a reply (remote operation, file transfer into the plant, most patching) cannot use a diode, and organizations sometimes add a "temporary" bypass that becomes permanent.

Diodes fit best at the boundaries in the Purdue model where the data flow really is one-way. Elsewhere, a well-managed firewall with tight rules is the normal control.