Industrial Processes

What are industrial processes?

Industrial processes are the systematic, repeatable operations through which a plant or installation converts raw materials, energy or semi-finished goods into products or services, such as clean drinking water, electricity or medicines, under the supervision and control of technical systems. In modern plants that control is largely automatic: PLCs, DCS systems and RTUs read measurements from sensors and drive actuators, supervised by SCADA and operators. Anyone who wants to understand or secure OT starts with the process itself: what physically happens, how fast, and what goes wrong when control fails.

🧠 What characterises an industrial process?

Every industrial process revolves around the same cycle: measure, compare and correct. A sensor measures the actual process variable, a controller compares it with the desired value (setpoint) and adjusts an actuator such as a pump or control valve. That control loop is often a PID controller that the control system recalculates continuously.

Industrial processes also share a number of properties:

• Physical consequences — an error does not produce a wrong invoice, but rejected product, damaged equipment or danger to people and the environment
• High availability — many processes run 24/7; downtime costs production immediately, and restarting a continuous process can take hours or days
• Real-time behaviour — control loops and safety functions must respond within milliseconds to seconds
• Long service life — control systems often stay in service for twenty years or more, far longer than office IT
• Strict safety requirements — legal frameworks such as the Seveso rules, GMP and the Machinery Regulation determine how a process is designed and operated

These properties explain why IT and OT think so differently about change, patching and risk.

🔧 What types of industrial processes are there?

By the way they produce, industrial processes are divided into discrete, batch and continuous processes. The type largely determines which control approach and standards fit.

Hybrids are common in practice. A brewery brews in batches but fills continuously on a discrete packaging line. For batch processes ISA-88 is the key standard: ISA approved Part 1 in 1995, the IEC adopted it in 1997 as IEC 61512-1, and a revision followed in 2010. ISA-88 separates the recipe (what has to happen) from the equipment (what it happens with), using a physical model from enterprise down to control module and a procedural model from procedure down to phase. As a result, the same plant can make different products without the control software being rewritten each time.

🏭 In which sectors do industrial processes run?

Industrial processes are at the heart of both manufacturing and critical infrastructure. Many of these sectors fall under NIS2 and, in the Netherlands, under the Cybersecurity Act (Cyberbeveiligingswet).

Water, energy and transport are often grouped together as critical infrastructure. That is not a separate process type but a societal classification: an outage affects society directly.

🏗️ How is the automation of an industrial process structured?

The control of an industrial process is built in layers. The Purdue Model and ISA-95 (internationally IEC 62264) describe those layers; the automation pyramid is the same idea in simplified form.

Signals travel from the field to the controllers over analogue 4-20 mA loops, O or fieldbuses, and increasingly over Industrial Ethernet. To understand the industrial automation of a process, read its piping and instrumentation diagram (P&ID): it shows every line, instrument and control loop. The specific approach for continuous and batch processes is covered under process automation.

Data from levels 1 and 2 also drives improvement. OEE (availability × performance × quality) exposes losses in discrete production, while condition monitoring and predictive maintenance use vibration and temperature data to stay ahead of failures.

🦺 How is process safety assured?

In processes with hazardous substances, normal control is not enough. A separate Safety Instrumented System (SIS) automatically brings the process to a safe state when pressure, temperature or level exceeds a limit. Design and maintenance follow IEC 61511, the process-sector version of IEC 61508 for functional safety.

• Risk analysis — in a HAZOP, a team works out per process section what can go wrong
• Required reliability — each safety function is assigned a SIL (1 to 4), depending on the risk reduction needed
• Independence — the SIS is separate from basic control, so a single failure cannot disable both
• Security — since the 2016 edition, IEC 61511 also requires a security risk assessment of the SIS

In the Netherlands, companies holding large quantities of hazardous substances fall under the European Seveso III Directive (2012/18/EU); in 2020 there were 407 of them. Until the end of 2023 the Dutch implementation was the Brzo 2015 decree; since 1 January 2024 the rules sit in the Environment and Planning Act (Omgevingswet). How cybersecurity fits in is covered under Seveso and Cybersecurity.

💧 How does an industrial process work in practice? Example: wastewater treatment

In 2024 the Netherlands had 313 wastewater treatment plants (WWTPs), operated by the 21 regional water authorities (waterschappen). A WWTP is a good example of a continuous process that runs almost entirely automatically:

1. Influent pumping — pumping stations and screw pumps bring in the sewage; PLCs switch pumps based on level measurements
2. Mechanical pre-treatment — screens and grit chambers remove coarse debris and sand
3. Biological treatment — in the aeration tank, bacteria (activated sludge) break down the pollution. A dissolved oxygen sensor feeds a control loop that holds oxygen around a setpoint of roughly 2 mg/l by adjusting blower speed through frequency drives
4. Secondary settling — the sludge settles; the treated effluent is discharged to surface water
5. Sludge treatment — surplus sludge is thickened and often digested to produce biogas

Aeration and pumping are the most energy-intensive parts of such a plant, so a well-tuned oxygen control loop saves energy directly. SCADA shows the status to operators in a central control room and raises alarms on deviations, a historian stores the time series for reporting to permit authorities, and the ERP handles maintenance scheduling and chemical consumption. Many WWTPs are unmanned at night and operated remotely, which makes them vulnerable if that access is poorly secured. More on this under Water Sector OT Security.

🔐 Why are industrial processes vulnerable to cyberattacks?

Over the years, industrial processes have become ever more tightly connected to IT networks, suppliers and the cloud. This OT convergence brings data and efficiency, but also opens the door to attacks with physical consequences:

• Ransomware and malware — can render control systems and HMIs unusable; at Colonial Pipeline (2021) ransomware hit only IT, yet the pipeline was shut down for six days as a precaution
• Manipulation of setpoints or O — an attacker with write access can push a process beyond its limits; Stuxnet (discovered in 2010) altered the rotational speed of uranium centrifuges through Siemens PLCs
• Attacks on safety systems — in 2017 TRITON tried to reprogram the safety controllers of a petrochemical plant in Saudi Arabia
• Insecure protocols — Modbus has no built-in authentication, and older ProfiNET installations also trust every device on the network; newer protocols such as OPC UA do offer encryption and certificates

That is why you secure industrial processes through defence in depth: network segmentation based on the zones and conduits model of IEC 62443, strict control of remote access, and detection through a SIEM or an OT SOC. A full overview of measures is under cybersecurity.

❓ Frequently asked questions

What is the difference between an industrial process and a business process?

An industrial process physically transforms material or energy, such as treating water or assembling a car. A business process, such as purchasing or invoicing, processes information. Industrial processes are controlled by OT systems such as PLCs and DCSs, business processes by IT systems such as ERP.

Which systems control an industrial process?

At the lowest level an industrial process is controlled by PLCs, DCS controllers or RTUs that read sensors and drive actuators. Above them, SCADA and HMIs provide supervision and operation, while MES, historians and ERP handle manufacturing operations and planning. A separate Safety Instrumented System protects hazardous processes.

Why can’t you simply patch or restart an industrial process?

Industrial processes often run 24/7, and restarting a continuous process can take hours or days and produce off-spec product. Every change to the control system must also be tested and sometimes formally validated, for example under GMP. That is why patches in OT are scheduled for maintenance shutdowns rather than installed immediately.

What is the difference between batch and continuous processes?

A batch process makes a delimited quantity of product according to a recipe, such as a lot of medicine or beer, and its control usually follows ISA-88. A continuous process handles an uninterrupted flow of raw material, as in a refinery or water treatment plant, and is mainly controlled through control loops in a DCS. Batch processes revolve around recipes and traceability, continuous processes around stability.

Do industrial processes fall under NIS2 and the Dutch Cybersecurity Act?

Many industrial processes fall under NIS2, which the Netherlands implemented through the Cyberbeveiligingswet that entered into force on 15 August 2026. Energy, drinking water and wastewater are listed in Annex I; chemicals, food and parts of manufacturing in Annex II. Whether an organisation is in scope also depends on its size: usually from 50 employees, or 10 million euros in both turnover and balance sheet total.

How do you protect an industrial process against cyberattacks?

You protect an industrial process with multiple layers: separate the OT network from IT in zones with controlled connections, restrict and monitor remote access, and keep an up-to-date inventory of all equipment. IEC 62443 is the international reference for this. In addition, the safety system (SIS) belongs in its own zone, so that an attack on the control system cannot also disable the last line of protection.

📌 In summary

Industrial processes convert raw materials and energy into products and services under automatic control, and because failures have physical consequences, they require reliable control, an independent safety layer and OT security in line with IEC 62443.

Once you know the type of process (discrete, batch or continuous), the sector and the control layers from level 0 to 4, it becomes clear why OT works differently from IT and where the risks to process safety and cybersecurity lie.