QoS

What is QoS?

QoS (Quality of Service) is a set of network mechanisms that recognise, mark and, under load, forward traffic in a defined order, so that critical data arrives reliably, on time and with as little delay and jitter as possible. QoS does not create extra bandwidth: it only decides who goes first when a link or switch port fills up. In OT networks, QoS protects real-time communication such as GOOSE, Sampled Values (SV), OPC UA and VoIP from delay or packet loss when office, backup or camera streams share the same network.

🧠 How does QoS work?

QoS works in five steps that every switch and router along the path must support:

1. Classification - incoming traffic is recognised by protocol (Ethertype), port number, IP address or physical port
2. Marking - the packet is given a priority value:

• 802.1p / PCP (Priority Code Point) - 3 bits in the IEEE 802.1Q VLAN tag, giving eight levels (0–7) at layer 2
• DSCP (DiffServ Code Point) - 6 bits in the IP header (RFC 2474), giving 64 possible values at layer 3

3. Queuing - each egress port has several queues, usually four to eight; the marking decides which queue a frame enters
4. Scheduling - the switch decides which queue may transmit first, for example using strict priority or weighted sharing (WRR, WFQ)
5. Rate limiting - policing (dropping excess traffic) and shaping (buffering and smoothing it) prevent a single stream from taking over the link

QoS mainly works at layers 2 and 3 of the OSI-model; classification can also look at layer 4 ports. It only works end to end if every hop, including the end devices, respects the marking.

Crucially, QoS only has an effect during congestion. On an idle link everything is forwarded immediately; as soon as a port receives more traffic than it can send, QoS decides what waits and what is dropped.

🔍 Which QoS methods and markings exist?

The IEEE recommends a fixed meaning for the eight PCP values. Note that value 1 (background) ranks below 0 (best effort), because 0 is also the default for unmarked traffic.

At layer 3, EF (Expedited Forwarding, DSCP 46) is the best-known marking for voice; in addition there are four AF classes (Assured Forwarding), each with three drop precedences, and the classic CS0–CS7 values.

🏭 How do industrial protocols use QoS?

Many industrial protocols bring their own marking. A network designer needs to know them to configure the switches correctly:

• ProfiNET - PROFINET RT frames carry a VLAN tag with VLAN ID 0 and priority 6. For tighter requirements, PROFINET IRT uses reserved time slots rather than priority alone.
• IEC 61850 - GOOSE (Ethertype 0x88B8) and Sampled Values (0x88BA) are layer 2 multicast. If no priority is configured, GOOSE defaults to 4. IEC 61850-5 requires a transfer time of no more than 3 ms for trip commands.
• IP - the CIP QoS object (0x48) defaults to DSCP 55 for urgent I/O, 47 for scheduled, 43 for high, 31 for low and 27 for explicit messaging; PTP time synchronisation uses DSCP 59 for event messages.
• OPC UA PubSub - can publish over UDP or directly on Ethernet with VLAN priority and, together with TSN, forms the basis of OPC UA FX. The underlying PubSub pattern enables cyclic, deterministic data streams.
• SCADA and historian - Modbus TCP or OPC UA polling usually gets a middle class: above office and engineering traffic, below control traffic.

Other uses include VoIP for industrial telephony and paging, separating monitoring and log traffic (low) from process control (high), and minimising latency and jitter on control loops between a PLC and a variable-frequency drive.

In OT networks, QoS ensures that critical processes keep running stably, even when the network is under heavy load.

🔄 What is the difference between QoS, TSN and MQTT QoS?

Classic QoS gives precedence, not a guarantee: a frame with priority 7 may still have to wait until a large low-priority frame has been fully transmitted. At 100 Mbit/s, a 1,518-byte frame takes just over 120 µs. TSN (Time-Sensitive Networking) goes further with guaranteed time windows (802.1Qbv), frame preemption (802.1Qbu with 802.3br) and time synchronisation via PTP. The IEC/IEEE 60802 profile defines which TSN features industrial devices must support.

MQTT QoS means something different: level 0 is at most once, 1 at least once and 2 exactly once. That governs whether a message arrives, not how fast it travels through the network.

🔧 How do you set up QoS in an OT network?

A practical approach for a plant or substation network:

1. Inventory the traffic flows - which protocols, which directions and which timing requirements (cycle time, maximum latency). Network monitoring or a capture with Wireshark shows what is actually on the wire.
2. Define a small number of classes - four to six classes is manageable in practice, for example network management, control/protection, time synchronisation, SCADA, voice/video and best effort.
3. Set the trust boundary - trust markings only from known devices on access ports; rewrite markings from unknown devices to 0.
4. Configure every switch on the path - queue mapping per PCP/DSCP, strict priority for the highest class and weighted sharing for the rest. Use a managed industrial switch.
5. Cap the highest class - limit it to a modest share of link capacity, so that a fault or attack in that class cannot crowd out everything else.
6. Test under load - measure latency and jitter while deliberately filling the link, for example with a backup or camera stream.

Reference architectures such as Converged Plantwide Ethernet describe this approach in detail. QoS works best combined with network segmentation: VLANs separate traffic logically, QoS sets the order within a shared link.

🔐 What are the security risks of QoS?

• Tampering with markings - an unauthorised device can set its own traffic to priority 7 or DSCP 46 and crowd out critical traffic
• Starvation - with strict priority, an overloaded top queue can stall all lower queues
• Too much on the highest priority - if everything has priority, nothing does
• Access to configuration - restrict who can change QoS settings using RBAC and ACLs
• Detection - monitor high-priority traffic via a SIEM or network monitoring and alert on unexpected markings

IEC 62443-3-3 requires, under foundational requirement 7 (resource availability), protection against denial of service (SR 7.1), including managing communication loads. QoS is an important tool for this, but no substitute for protection against DDoS attacks at the network edge. These points are part of the wider security design of an OT network.

An incorrect or abused QoS configuration can itself lead to denial-of-service on critical networks.

❓ Frequently asked questions

Does QoS make sense if the network is never full?

QoS only has an effect when a port receives more traffic than it can send. Even networks with a low average load see short bursts, for example from broadcasts, backups or a fault, and that is exactly when QoS protects critical traffic. In OT networks, QoS is therefore insurance for the moments when things go wrong.

What is the difference between 802.1p and DSCP?

802.1p (PCP) is a 3-bit priority in the VLAN tag of an Ethernet frame and works within a layer 2 network. DSCP is a 6-bit marking in the IP header and is preserved when a router forwards the packet to another subnet. Many switches translate between the two using a mapping table.

Which priority does PROFINET use?

PROFINET RT frames use a VLAN tag with VLAN ID 0 and priority 6 in the 802.1Q field. Switches that do not handle this tag correctly, for example because they reject VLAN ID 0, can disrupt PROFINET communication. When choosing a switch, check that PROFINET support has been explicitly tested.

Is QoS the same as TSN?

QoS is not the same as TSN: classic QoS gives precedence, whereas TSN guarantees bounded and predictable latency using time windows and time synchronisation. TSN builds on the 802.1Q priorities and adds scheduling, frame preemption and PTP. For most SCADA applications classic QoS is sufficient; for motion control and converged networks, TSN is the next step.

Does QoS work over Wi-Fi and 5G?

Yes, wireless networks also have QoS. Wi-Fi uses WMM (based on IEEE 802.11e) with four access categories: voice, video, best effort and background. 5G works with QoS flows that each get a 5QI value, allowing a private 5G network to treat control traffic separately.

Who configures QoS in a plant: IT or OT?

QoS configuration requires knowledge of both networks and processes, which makes it a typical task for OT collaboration. OT provides the timing requirements of the protocols, while IT or the network administrator turns them into a consistent QoS policy on all switches and routers. Record that policy in a network design, so that later changes do not silently break it.

📌 In summary

QoS classifies, marks and schedules network traffic so that control, protection and time synchronisation traffic takes precedence over office, backup and video traffic. Industrial protocols such as PROFINET, IEC 61850 and EtherNet/IP use fixed markings that every switch must respect. A good design keeps the number of classes small, sets a trust boundary and caps the highest priority; where hard timing guarantees are needed, TSN is the successor.

QoS is indispensable in industrial networks for ensuring the availability, timing and reliability of critical communication: it makes sure that what matters always gets priority.