Industrial IT and OT Networks

Design, validation and commissioning of industrial networks, plus the industrial-grade hardware they run on, for integrators, EPCs, OEMs and plant owners.

An open industrial control cabinet holding two rows of DIN-rail Ethernet switches joined by blue cable looped in a ring, with a production line blurred behind the door.
Industrial network with redundant ringControllers and field devices connect to industrial switches arranged in a redundant ring, so traffic survives a broken link. The ring feeds the control and SCADA servers. A firewall and a buffer network sit between the plant and office IT, and vendor access goes through a recorded jump host.PLANT NETWORKPLCSCells and linesFIELD DEVICESDrives and I/OREDUNDANT RINGValidated failoverSCADAControl serversFIREWALL ANDDMZIT and OT boundaryOFFICE ITBusiness systemsVENDOR ACCESSRecorded sessions

Reference system

A plant network with redundant rings, control levels, a demilitarised zone and the IT boundary.

Symptoms

When this matters

If any of these describe your environment, this is the conversation to have.

  1. 01A production line or process stops because a flat office-grade network carried plant traffic.
  2. 02The control network was built by several contractors, with no single plan for addressing, VLANs or redundancy.
  3. 03A new line, skid or plant needs a ring that recovers in milliseconds and has been proved before go-live.
  4. 04Office IT and the plant network touch, but nobody has defined what may cross.
  5. 05An integrator needs a specialist for the network and hardware side so they can focus on controls.

Scope

What KINNEX delivers

Industrial networks have a different job from office networks: they carry control traffic that must arrive, on time, every time, and recover from a fault faster than a process can notice. We engineer, validate and commission those networks, and supply the industrial hardware they run on.

  • Industrial network architecture, IP, VLAN, ACL and QoS planning for SCADA, DCS, PLC, MES and BMS.
  • Redundant ring design (PRP, HSR, MRP, ERPS), pilot-ring set-up, failover testing and validation.
  • Commissioning support, FAT and SAT readiness, and a complete documentation pack.
  • Industrial switches, gateways, servers, workstations, rugged laptops and storage supplied on one order.
  • IT and OT segmentation using the Purdue model, with secure vendor remote access.
  • Delivered behind your brand, alongside you as a named specialist, or directly with the plant owner.

Capability catalogue

Everything this covers

95 capabilities, scoped, sourced and delivered under one contract. Search for the exact term you use.

OT network architecture and planning12

A plan for the whole plant, before a single switch is mounted.

  • Industrial OT network architecture for SCADA, DCS, PLC, MES, BMS and IIoT
  • Purdue-model levels, zones and conduits
  • IP addressing plan, subnetting and naming standard
  • VLAN design and segmentation by cell, line and function
  • Access control lists (ACLs) and traffic-flow definition
  • Quality of service (QoS) for control, safety and video traffic
  • Multicast design for protocols such as PROFINET and EtherNet/IP
  • Redundancy and single-point-of-failure analysis
  • Cable-route, panel and cabinet planning
  • Brownfield network discovery and migration planning
  • Greenfield design for new plants, lines and skids
  • Network design for hazardous, outdoor and high-temperature areas
Redundant ring topologies and validation10

Recovery in milliseconds, proved on a test bench or on site before go-live.

  • Ring redundancy: PRP, HSR, MRP, ERPS and RSTP
  • Dual-homing and ring-coupling designs
  • Pilot-ring set-up and bench testing
  • Failover-time measurement under load
  • Link and switch failure testing with packet-loss measurement
  • Latency and jitter measurement for control traffic
  • Storm control, loop prevention and broadcast containment
  • Time synchronisation: PTP (IEEE 1588) and NTP
  • Bandwidth and capacity validation
  • Test reports for FAT and SAT
Industrial protocols and integration12
  • Modbus TCP and Modbus RTU gateways
  • PROFINET and PROFIBUS networks
  • EtherNet/IP and CIP
  • OPC UA and OPC DA servers and gateways
  • IEC 61850 for substations and power automation
  • DNP3 and IEC 60870-5-104 for utilities
  • BACnet and KNX for building automation
  • MQTT and Sparkplug B for IIoT
  • Serial-to-Ethernet device servers and protocol converters
  • SCADA, historian and MES connectivity
  • Remote I/O and PLC network integration
  • Vendor-specific protocols and legacy fieldbus bridging
Commissioning, FAT and SAT10
  • Factory acceptance test (FAT) network preparation
  • Site acceptance test (SAT) network testing
  • Staged commissioning and live cut-over in shutdown windows
  • Rollback plans and contingency planning
  • Switch configuration, staging and burn-in
  • Network documentation pack: IP plan, VLAN plan, configurations, test reports
  • As-built drawings and panel schedules
  • Operator and maintenance training
  • Knowledge transfer and post-handover support
  • Punch-list and snag management
Industrial hardware supply15
  • Industrial managed and unmanaged switches: DIN-rail, rack and rugged
  • PoE industrial switches for cameras and access points
  • Industrial routers, gateways and wireless access points
  • Industrial firewalls and secure remote-access appliances
  • Industrial PCs, HMI panels and edge computers
  • Servers for SCADA, historian and virtualisation
  • Engineering workstations and laptops
  • Rugged laptops and tablets for field commissioning
  • Handhelds, barcode scanners and RFID readers
  • NAS, SAN and storage for plant data
  • UPS, DIN-rail power supplies and surge protection
  • Industrial enclosures, racks and cooling
  • Fibre, copper and industrial-rated cabling and connectors
  • SFP transceivers: multimode, single-mode and extended-temperature
  • Single PO, GST invoicing and OEM warranty
IT and OT security11
  • IT and OT segmentation with industrial firewalls and a DMZ
  • IEC 62443-aligned zone and conduit design
  • Secure vendor and contractor remote access with session recording
  • Jump hosts, bastion access and multi-factor authentication
  • Passive asset discovery and network monitoring
  • OT anomaly detection and threat monitoring
  • Patch and vulnerability management for control systems
  • Backup and restore of controllers, HMIs and servers
  • Air-gap, removable-media control and USB hygiene
  • Whitelisting and endpoint protection suited to industrial hosts
  • Security assessment and risk register for the plant network
Wireless and mobility in the plant7
  • Industrial Wi-Fi for handhelds, AGVs and vehicle terminals
  • Roaming and latency design for moving equipment
  • Point-to-point and mesh wireless links
  • Private LTE and 5G options through specialists
  • RFID and RTLS for asset and personnel tracking
  • Wireless survey in metal-rich and dusty environments
  • Hazardous-area rated wireless equipment
Industries and applications10
  • Process plants: chemical, oil and gas, petrochemical
  • Power and energy: generation, substations, renewables and distribution
  • Discrete manufacturing: automotive, engineering and assembly
  • Water, wastewater and utilities
  • Pharmaceuticals and life sciences
  • Food and beverage
  • Buildings and infrastructure: BMS, tunnels and metro
  • Ports, logistics and material handling
  • Mining, cement and steel
  • Automation OEMs and skid builders
Engagement models8
  • Sub-vendor delivery behind your brand, with NDA as standard
  • Named as a specialist in your bid or proposal, with joint kick-off
  • Direct engagement with the plant owner
  • Design-only, supply-only or design-and-supply scopes
  • Fixed-fee proposals after a short scoping call
  • Clear commercial terms: scope, validity, milestones, GST, IP and confidentiality
  • Top-tier specialist engineers brought in for complex phases
  • Maintenance and support under an agreed SOP and SLA

The site, in 3D

A plant network that recovers before the process notices

Redundant rings proved on the bench and on site, with a defined boundary between plant and office IT.

  • Redundant ring
  • Cells and PLCs
  • IT and OT boundary
  • FAT and SAT

Real-time 3D illustration of a typical site, not a specific client project.

Use cases

Where this shows up

Typical situations that lead an organisation to this work.

01

An automation integrator needing the network design and industrial switches for a new line.

02

A plant replacing a flat network with segmented, redundant rings during a shutdown window.

03

A utility or process plant separating business IT from the control network.

Delivery method

How the work runs

Architecture before equipment. Validation before handover.

  1. Stage 01 of 6

    Assess

    Review the process, the control system, existing network, availability needs and safety constraints.

  2. Stage 02 of 6

    Design

    Produce the architecture, IP and VLAN plans, ring topology, security zones and hardware specification.

  3. Stage 03 of 6

    Implement

    Stage and configure switches, build a pilot ring, install and cut over in agreed windows.

  4. Stage 04 of 6

    Validate

    Prove failover times, loss, latency and protocol behaviour; support FAT and SAT.

  5. Stage 05 of 6

    Document

    Hand over IP plan, VLAN plan, configurations, test reports and as-built drawings.

  6. Stage 06 of 6

    Support

    Knowledge transfer and post-handover support, with maintenance under an agreed SOP and SLA.

Free tool

Subnet calculator and VLAN plan

Work out subnets, then lay plant zones into one address block with room to grow. A starting point for the design conversation.

Subnet calculator

Network
192.168.10.64/26
Subnet mask
255.255.255.192
Wildcard
0.0.0.63
Broadcast
192.168.10.127
First usable
192.168.10.65
Last usable
192.168.10.126
Usable hosts
62
Total addresses
64

VLAN and IP plan

Set the address block for the site and how many devices each zone needs. The planner adds headroom and fits the zones into the block, largest first, with no overlaps.

Zones with VLAN, device count and allocated subnet
ZoneVLANDevicesSubnetGatewayUsable
Does not fit
10.20.3.128/2510.20.3.129126
10.20.2.0/2410.20.2.1254
10.20.0.0/2310.20.0.1510
10.20.3.0/2510.20.3.1126
Does not fit
Does not fit
Does not fit

The block is too small for: Wireless and handhelds, Level 3 operations and servers, Network management, DMZ and remote access. Use a shorter prefix.

A starting layout only. Real plant plans also reflect firewall zones, redundancy, vendor address rules and existing equipment.

How we take this on

One contract. The right specialist for every part

Your project is wider than any single team. We scope all of it, source all of it and carry the responsibility for all of it.

  1. 01

    Scope

    We survey, size and specify against standards and your operating reality, not against a brochure.

  2. 02

    Source

    Any make, any model, from the manufacturer, distribution or registered importers. GST-compliant invoicing, warranty and returns handled for you.

  3. 03

    Deliver

    KINNEX engineers do the work we do every day. Where a job needs a specialist, we bring in the right expert team as a sub-order under your single contract.

  4. 04

    Own

    One scope, one SOP, one SLA and one point of accountability, whoever is on site.

Standards and terms

Standards we design to, and the terms you will hear

Specifications are written against recognised standards. Here is the vocabulary, in plain language.

  • IEC 62443 (industrial automation and control security)
  • ISA/IEC 62443 zones and conduits
  • Purdue Enterprise Reference Architecture
  • IEC 62439 (PRP and HSR redundancy)
  • IEC 62439-2 (MRP) and ITU-T G.8032 (ERPS)
  • IEEE 802.1D and 802.1w (spanning tree)
  • IEEE 1588 (precision time protocol)
  • IEC 61850 (power utility automation)
  • IEC 61158 and IEC 61784 (fieldbus and real-time Ethernet)
  • OPC UA (IEC 62541)
  • NAMUR and ATEX / IECEx for hazardous areas
  • IP and NEMA enclosure ratings
  • EN 50155 and EN 50121 for rail and EMC where relevant
  • ISO/IEC 27001 aligned practices
OT vs IT
Operational technology runs physical processes and must be available and predictable. Information technology runs business data and favours flexibility. The two need a defined boundary.
SCADA, DCS, PLC
Supervisory control and data acquisition, distributed control systems and programmable logic controllers: the systems that run a plant.
Purdue model
A layered reference architecture that separates field devices, control, supervision and business IT.
Ring redundancy
Switches joined in a loop so traffic still gets through if one link or switch fails.
PRP and HSR
Redundancy protocols that send each frame twice over two paths, giving zero recovery time.
MRP and ERPS
Ring protocols that recover from a break in milliseconds, widely used in industrial networks.
RSTP
Rapid spanning tree: a general loop-prevention protocol that recovers more slowly than ring protocols.
FAT and SAT
Factory acceptance test and site acceptance test: the formal tests proving a system works before and after installation.
DMZ
A buffer network between IT and OT where data is exchanged under strict rules.
Zones and conduits
IEC 62443 terms: groups of assets with equal security needs, and the controlled paths between them.
OPC UA
A secure, platform-independent standard for exchanging data between industrial devices and software.
PTP
Precision time protocol: sub-microsecond clock synchronisation for motion control and power systems.
DIN rail
The standard metal rail inside control panels on which industrial switches and power supplies are mounted.
ATEX / IECEx
Markings for equipment safe to use in explosive atmospheres.
SOP and SLA
The documented procedures for maintaining the network, and the response targets agreed for it.

Brands

Any make. Sourced, supplied and supported

We specify against your requirement and standards, then source the right product from the manufacturer, distribution or registered importers. Delivered, installed and supported under one contract.

Industrial automation and OT networking

Industrial Ethernet, automation platforms, SCADA and OT security.

  • Phoenix Contact
  • Advantech
  • Siemens
  • Rockwell Automation
  • Schneider Electric
  • ABB
  • Honeywell
  • Yokogawa
  • Mitsubishi Electric
  • Omron
  • Belden
  • Pepperl+Fuchs
  • Beckhoff
  • WAGO
  • Fortinet
  • Cisco Cyber Vision
  • Inductive Automation
  • GE Vernova
Show 35 more brands
  • Fuji Electric
  • Hitachi
  • Danfoss
  • Festo
  • Cognex
  • HMS Networks
  • Moxa
  • Hirschmann
  • Westermo
  • ORing
  • Emerson
  • Ruijie Networks
  • Red Lion
  • Lantronix
  • Weidmuller
  • Claroty
  • Nozomi Networks
  • Dragos
  • Waterfall Security
  • AVEVA
  • Kepware
  • Delta Electronics
  • Eaton
  • Endress+Hauser
  • SMC
  • Turck
  • Banner Engineering
  • SICK
  • Keyence
  • Eurotech
  • Digi International
  • ProSoft
  • Kyland
  • Planet Technology
  • Korenix

Networking, Wi-Fi and SD-WAN

Switching, routing, wireless, SD-WAN and application delivery.

  • Cisco
  • Aruba
  • Juniper Networks
  • Ubiquiti
  • TP-Link
  • D-Link
  • Netgear
  • Cambium Networks
  • Fortinet
  • Huawei
  • MikroTik
  • Arista Networks
  • Dell Technologies
  • Zyxel
  • Cisco Meraki
  • Alcatel-Lucent Enterprise
  • Allied Telesis
  • Array Networks
Show 19 more brands
  • F5
  • Citrix
  • Radware
  • HPE
  • VMware
  • Palo Alto Networks
  • Tejas Networks
  • Nokia
  • Ericsson
  • Ruckus Networks
  • Extreme Networks
  • Ruijie Networks
  • Juniper Mist
  • Digisol
  • A10 Networks
  • Versa Networks
  • Peplink
  • Cradlepoint
  • Teltonika

Rugged, mobile and field computing

Rugged laptops, tablets, handhelds, scanners and label printers.

  • Panasonic Toughbook
  • Dell Rugged
  • Zebra Technologies
  • Honeywell
  • Samsung Galaxy Tab Active
  • Datalogic
  • Trimble
  • Unitech
  • Sunmi
  • Motorola Solutions
  • Kyocera DuraForce
  • Brady
  • Epson
  • Citizen
  • Bixolon
  • Getac
  • Bluebird
  • Newland
Show 11 more brands
  • Cipherlab
  • Pidion
  • Xplore
  • Durabook
  • Juniper Systems
  • Sonim
  • CAT Phones
  • TSC
  • Godex
  • SATO
  • Intermec

Servers, storage and data-centre compute

Rack, tower and edge servers, SAN, NAS, all-flash and tape.

  • Dell Technologies
  • HPE
  • Lenovo
  • Cisco UCS
  • Supermicro
  • Fujitsu
  • IBM
  • Huawei
  • Inspur
  • NetApp
  • Pure Storage
  • Synology
  • QNAP
  • Western Digital
  • Seagate
  • Hitachi Vantara
  • TrueNAS
  • Toshiba
Show 24 more brands
  • Intel
  • AMD
  • NVIDIA
  • Samsung
  • Micron
  • Dell EMC
  • HP
  • ASUS
  • Gigabyte
  • Wiwynn
  • Marvell
  • Broadcom
  • Arm
  • SK hynix
  • Kioxia
  • SanDisk
  • Transcend
  • Quantum
  • Asustor
  • Kingston
  • Crucial
  • Nimble Storage
  • Mellanox
  • Ampere

Power, cooling, racks and data-centre facility

UPS, batteries, PDUs, precision cooling, racks and monitoring.

  • APC
  • Schneider Electric
  • Vertiv
  • Rittal
  • Exide
  • Cummins
  • Kirloskar
  • Stulz
  • Liebert
  • ABB
  • Siemens
  • Hitachi Hi-Rel
  • Havells
  • Tripp Lite
  • Kohler
  • Caterpillar
  • Perkins
  • Eaton
Show 24 more brands
  • Delta Electronics
  • Legrand
  • Netrack
  • Valrack
  • Raritan
  • Socomec
  • Riello
  • Numeric
  • Luminous
  • Microtek
  • Amara Raja
  • Mahindra Powerol
  • Panduit
  • Emerson
  • Su-Kam
  • Livguard
  • Okaya
  • CyberPower
  • Centiel
  • Piller
  • Ashok Leyland
  • Server Technology
  • Sensaphone
  • AKCP

Product names, logos and brands are property of their respective owners and are used for identification only. Don't see what you need? We can usually source it, including through registered importers.Ask us.

Technology fit

The technology categories this work draws on.

  • Industrial Ethernet switches, DIN-rail and rugged
  • Ring redundancy: PRP, HSR, MRP, ERPS, RSTP
  • Industrial protocols: Modbus TCP, PROFINET, EtherNet/IP, OPC UA, IEC 61850, DNP3
  • IEC 62443-aligned zones and conduits
  • Rugged laptops, industrial PCs and HMI
  • Remote access with session recording

Questions

Frequently asked questions

We build the ring on the bench or on site, then deliberately break links and power down switches while measuring how long traffic takes to recover and whether any control traffic is lost. The results go into a test report, so the redundancy is proved, not assumed.

We design to your platform and specify whatever the project standardises on, including Moxa, Hirschmann, Westermo, ORing, Phoenix Contact, Cisco, Ruijie and Advantech, and source from the manufacturer or distribution.

Yes. Many integrators bring us in as a sub-vendor under their brand, with an NDA as standard. We can also be named in a bid, or work directly with the plant owner.

Using the Purdue model and IEC 62443-aligned zones and conduits: industrial firewalls and a DMZ at the boundary, strictly defined flows, and vendor remote access that goes through a controlled, recorded jump host.

We prepare the network side for factory and site acceptance tests, run the network tests, and supply the reports. Controls testing stays with the control-system integrator.

Yes. Industrial switches, servers, engineering workstations, rugged field laptops for commissioning, storage and power can all be supplied on one purchase order.

Discuss an industrial network

Tell us the site, the constraint or the outcome you need, and we will come back with the right next step.