Industrial Ethernet switching is the backbone of modern automation networks. From a handful of PLCs on a production line to thousands of devices across a plant, the network that carries control, safety, and monitoring traffic must be reliable, deterministic where it matters, and resilient to failures. This article explains the fundamentals of managed industrial switches, the key features that matter in OT networks, and the design practices that keep an industrial network healthy for years.
Managed vs. Unmanaged Switches
| Feature | Unmanaged | Managed |
|---|---|---|
| Configuration | Plug-and-play, no interface | Web/CLI/SNMP configuration |
| VLANs / segmentation | No | Yes |
| Redundancy (RSTP/MRP/HSR) | No | Yes |
| Monitoring & diagnostics | Minimal | Yes (SNMP, port stats, alarms) |
| QoS / traffic prioritization | No | Yes |
| Security (port control, ACLs) | No | Yes |
Managed switches are the norm for control networks, even small ones: the ability to segment, prioritize, and diagnose traffic is worth the extra cost. Unmanaged switches are acceptable only for isolated, low-criticality segments with no redundancy requirement — and even then they should be hardened (industrial-grade) devices.
Key Features for OT Networks
Redundancy protocols
Network redundancy means the network survives a cable break or switch failure:
- RSTP (Rapid Spanning Tree) — the general standard; recovery in the order of seconds with careful tuning.
- MRP (Media Redundancy Protocol) — IEC 62439-2, common in PROFINET networks; ring recovery in ~200 ms or less.
- HSR/PRP — IEC 62439-3, zero-recovery-time redundancy for the most critical applications (power, high-speed control).
- DLR (Device Level Ring) — EtherNet/IP's ring protocol, sub-3 ms recovery in many implementations.
Choose the redundancy protocol that matches the fieldbus ecosystem of the plant and test the actual failover time, not the datasheet value.
Segmentation with VLANs
VLANs split one physical network into logical segments — e.g., separating control traffic, HMI traffic, and engineering access. Benefits: smaller broadcast domains, isolation of noisy devices, and a foundation for access control. Assign each function its own VLAN and route between them only where necessary (firewalls/ACLs).
QoS (Quality of Service)
When traffic types share a network, prioritize the time-critical ones. Mark real-time control traffic (e.g., PROFINET, EtherNet/IP implicit messages) with the appropriate IEEE 802.1p priority and configure switch queues so that bursts of file transfers or web traffic cannot delay control frames.
Port security and diagnostics
Disable unused ports, enable MAC-based port security where appropriate, and use SNMP monitoring to track link errors, dropped frames, and port utilization. A managed switch that reports its own health is the difference between finding a failing port early and discovering it during an outage.
Design Practices
Topology
- Star for machine-level networks: each device to a central switch; simple, easy to diagnose.
- Ring for plant-level backbones: resilience to a single cable break with MRP/RSTP.
- Hierarchical: machine switches uplink to area switches, which uplink to a plant backbone. This bounds failure domains and keeps traffic local.
- Redundant core: for large plants, a redundant backbone with dual paths to critical areas.
Cabling and physical layer
- Use industrial-grade cabling (shielded twisted pair, M12/RJ45 with strain relief) and keep cable runs away from power cables and VFDs.
- Respect segment lengths (100 m for copper Ethernet; use fiber for longer runs and for inter-building links).
- Follow the plant's cable tray and routing standards; label everything.
Addressing and documentation
- Plan the IP scheme before installation: separate subnets per area/VLAN, reserved ranges for infrastructure, DHCP with reservations or fixed IPs for devices.
- Maintain a network drawing (cabling, switches, ports, VLANs, IPs) and update it with every change. An undocumented network is a future outage.
Performance and Monitoring
- Baseline utilization: know normal port utilization and broadcast rates; investigate deviations.
- Error counters: CRC errors, collisions, and dropped frames indicate cabling or duplex problems; trend them.
- Switch health: monitor temperature, power supply status, and firmware versions — industrial switches report these.
- Firmware updates: keep switches patched, following the plant's change windows and testing procedure.
Security Integration
Network design and security go together (see the Purdue Model and IEC 62443 articles): segment control from business networks, restrict engineering access, disable unnecessary services on switches, and log configuration changes. The network is the enforcement point for most OT security policy.
Summary
Industrial Ethernet switching is a discipline: choose managed switches, use the redundancy protocol that matches the fieldbus ecosystem, segment with VLANs, prioritize real-time traffic, plan and document the topology, and monitor the network continuously. A well-designed industrial network is boring — it carries control traffic reliably for years without anyone thinking about it. That is exactly the point.