Control Network

What is a Control Network?

A control network is the network segment within an OT environment that carries the real-time communication between automation components, such as PLCs, RTUs, IO modules, Remote IO stations, drives and the HMI panels at the machine. It is the backbone of industrial control: every start/stop command, every setpoint and every sensor reading travels across it. In the process industries the same segment is often called the Process Control Network (PCN).

The control network is essential for the safe, reliable and time-critical operation of industrial processes. A disruption of a few milliseconds can already stop a machine.

🧠 How does a control network work?

A control network is not about bandwidth but about predictability. A PLC cyclically exchanges small packets with its IO; if they arrive late, a watchdog trips and the installation moves to a safe state.

1. Deterministic communication

• Real-time transmission of signals such as start/stop, setpoints and feedback
• Low latency, little jitter and virtually no packet loss matter more than throughput (see deterministic behaviour)

2. Protocol- and application-oriented

• Typical protocols: ProfiNET, IP, Modbus TCP, S7 and EtherCAT
• OPC UA is used mainly vertically (towards SCADA and MES); with OPC UA FX and PubSub it is moving towards controller-to-controller communication
• Often supported by time synchronisation via PTP (IEEE 1588) or, less precisely, NTP

3. Network topologies

• Common forms: ring, line or star (see topology)
• Redundancy through ring protocols such as MRP and DLR, through RSTP, or through parallel networks with PRP and HSR

Which cycle times and protocols are common?

🧱 Where does the control network sit in the Purdue Model?

In the Purdue Model the control network covers level 1 (basic control) and the link to level 0 (field devices). Local HMI panels on a machine are often attached to it directly. The SCADA servers, the historian and engineering stations belong to the supervisory network at levels 2 and 3. In older plants these two segments are often mixed in practice; separating them is one of the first steps in an OT network design.

In a sound OT design these networks are at least logically separated (their own VLAN plus a firewall); physical separation follows where the risk assessment calls for it.

🏭 Where are control networks used?

• Controlling machines and production lines in discrete manufacturing
• Process control in power plants, chemicals, food and beverage and water authorities
• Integration of field equipment with PLC, SCADA or DCS
• Synchronisation between redundant controllers or Remote IO
• Substations, where IEC 61850 messages such as GOOSE between IEDs must arrive within a few milliseconds

Typical components:

• Industrial switches and managed switches supporting ring protocols, VLANs and QoS
• Drives, Sensors and Actuators
• Safety PLCs communicating over the same network with PROFIsafe or CIP Safety
• IO modules and fieldbus converters to, for example, Profibus or Modbus

🔄 How do you make a control network redundant?

Because an interruption means immediate production loss, redundancy is standard. The choice depends on the tolerable recovery time:

Always compare the recovery time with the watchdog time of your IO connections. A PROFINET device with a 1 ms update time and the usual watchdog factor of 3 reports a connection fault after just 3 ms, so it will not survive even a 200 ms MRP switchover. Set the watchdog time deliberately above the ring’s recovery time, or choose bumpless redundancy such as PRP or HSR when even a short interruption is unacceptable.

🔐 How do you secure a control network?

Many control protocols, such as Modbus TCP and S7, historically have no authentication. Anyone who reaches the control network can often send commands straight to a PLC; Stuxnet showed in 2010 what that can mean. Security therefore relies on the environment:

• Segmentation of the control network using VLANs, Firewalls and the zones and conduits model from IEC 62443; see also network segmentation
• Restrict access to trusted devices and ports only (Least Privilege), for example with port security or 802.1X where the equipment supports it
• Use Industrial Firewalls with DPI that understand protocol commands, so you can block write commands or PLC stops coming from the supervisory network
• Monitor for anomalous behaviour via anomaly detection or Security Monitoring, preferably with passive monitoring through a SPAN port so the real-time connections are not loaded
• Redundancy and High Availability for fault-free operation
• Remote access only via the iDMZ and controlled remote access, never with a private modem or 4G router in the cabinet

Disruption of the control network can lead to production downtime or safety risks. Security measures must therefore not add latency or a single point of failure themselves.

🔧 How do you design a control network in practice?

1. Inventory all devices, protocols and connections in an asset inventory; without that overview you cannot write firewall rules.
2. Define the zones per production line or process unit, based on a risk assessment according to IEC 62443-3-2, and assign each zone a target security level (SL-T); IEC 62443-3-3 describes which system requirements belong to that level.
3. Choose the redundancy based on watchdog times and the consequences of an outage.
4. Design the conduits: which connections to the supervisory network are really needed, with which protocol and in which direction?
5. Reserve capacity: keep IO traffic load well below link capacity, use QoS and limit broadcast and multicast traffic with IGMP snooping.
6. Test and document the design during FAT and SAT, including deliberately breaking a ring connection.

In the Netherlands this is more than good engineering practice. Organisations covered by the Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026, must take appropriate measures for their network and information systems. For drinking water companies, energy companies and water boards, that directly affects the control network.

❓ Frequently asked questions

What is the difference between a control network and a supervisory network?

A control network connects PLCs, IO and drives at Purdue levels 0–1 and is about deterministic communication within milliseconds. A supervisory network connects SCADA, historians and engineering stations at levels 2–3 and focuses on monitoring and operation. A controlled transition, usually a firewall, belongs between the two.

Is a control network the same as a fieldbus?

No, a fieldbus such as Profibus is a serial bus, whereas a modern control network usually runs on Industrial Ethernet. Both connect controllers to IO, and many control networks still contain converters to existing fieldbuses. The term control network is mainly used for the Ethernet segment around the controllers.

What latency is acceptable in a control network?

It depends on the application: process control loops often run at cycles of 100 ms to 1 s, machine control at 1 to 10 ms and motion control below 1 ms. More important than average latency is jitter, because a PLC expects predictable arrival times. Choose the protocol and switches based on the tightest cycle in the control network.

Can I use an ordinary office switch in a control network?

That is not recommended, because office switches usually lack an industrial temperature range, DIN-rail mounting, ring protocols and PROFINET or EtherNet/IP support. A control network needs industrial switches that also recover quickly after a fault. They also often lack the diagnostic functions that maintenance relies on.

May a control network be connected to the internet?

A control network should never be connected directly to the internet. Data to the cloud or IT flows via the supervisory network and an iDMZ, possibly through a data diode. Direct internet access makes PLCs without authentication discoverable and attackable.

How do I monitor a control network without disturbing control?

Use passive monitoring via a SPAN port or network TAP, so the monitoring tool only listens and sends no traffic to PLCs. OT-specific monitoring tools recognise industrial protocols and flag new devices or unusual write commands. Actively scanning a control network can make older controllers hang.

📌 In summary

The control network is the heart of industrial automation: the network at Purdue levels 0–1 where speed, reliability and determinism are paramount. Sound segmentation, security that adds no latency and redundancy matched to the watchdog times are essential for safe and stable production.