Industrial IoT and Business Operations · Study deck

Industrial Protocols: Selection and Security

The protocol families and timing calculations are clear, but a real plant still needs one justified choice across old equipment, traffic, recovery, and security.

Ada is your guide for this deck.

iiotindustrialprotocols
Ada, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • select an industrial protocol from timing and system duties
  • compare candidates with explicit decision evidence
  • define OT-IT security boundaries for the selected path
  • Explain: An OPC UA gateway can retain legacy devices, OPC UA can carry checked context toward IT, and PROFIsafe or FSoE adds a safety-rated layer.
iotclass.org

Major section

Protocol Selection Decision Tree

An OPC UA gateway can retain legacy devices, OPC UA can carry checked context toward IT, and PROFIsafe or FSoE adds a safety-rated layer.

  • The final stack keeps deterministic control near the machine and separates it from the integration path upward.
Industrial protocol selection starts with the control-loop timing and determinism budget, then accounts for safety, brownfield assets, and whether data must cross into MES, historian, analytics, or cloud systems.
Industrial protocol selection starts with the control-loop timing and determinism budget, then accounts for safety, brownfield assets, and whether data must cross into MES, historian, analytics, or cloud systems.
iotclass.org

Major section

Industrial IoT System Components Gallery

Sensors, valves and motors act on the process, and the controllers just above them close loops in about a millisecond, so that traffic stays on a fieldbus and never leaves the plant floor.

  • The band near the top is the one to study hardest.
  • Enterprise traffic is not allowed to reach the control levels directly.
Industrial IoT architectures organize functionality into distinct layers aligned with the ISA-95 model, enabling clear separation of concerns while supporting integration across operational technology (OT) and information technology (IT) domains.
Industrial IoT architectures organize functionality into distinct layers aligned with the ISA-95 model, enabling clear separation of concerns while supporting integration across operational technology (OT) and information technology (IT) domains.
iotclass.org

Major section

OT/IT Security Convergence

Incidents such as the Ukraine power grid attacks show why remote-access paths, engineering workstations, credentials, and SCADA operations need industrial-specific segmentation and monitoring.

  • Protocol exploitation: Industrial protocols (Modbus, PROFINET, EtherCAT) were designed for reliability, not security.
  • All traffic must traverse the Industrial DMZ (Level 3.5).
  • OT/IT convergence is inevitable for Industry 4.0 benefits.

Why it matters

Unidirectional gateways (data diodes): For highest-security zones, use hardware that physically prevents traffic from flowing backward into OT.

iotclass.org

Major section

OT/IT Security Convergence (continued)

Legacy system vulnerabilities: Long-lived PLCs, HMIs, engineering stations, and operating systems may have patch constraints that must be handled through segmentation, compensating controls, and maintenance windows.

  • Physical process manipulation: Unlike IT attacks that steal data, OT attacks can cause physical harm (explosions, spills, equipment destruction, product contamination).
  • Supply chain compromise: Compromised firmware, engineering tools, libraries, or vendor update channels can bypass perimeter assumptions and must be controlled through verification and change management.
  • Insider threat amplified: Shared OT credentials complicate attribution when incidents occur; individual remote-access logs and physical or personnel controls can help identify operators.
The Industry 4.0 paradigm integrates previously isolated automation systems into interconnected cyber-physical networks that enable connected monitoring and predictive maintenance in manufacturing operations.
The Industry 4.0 paradigm integrates previously isolated automation systems into interconnected cyber-physical networks that enable connected monitoring and predictive maintenance in manufacturing operations.
iotclass.org

Major section

Checkpoint: OT/IT Boundary

The final interactive section checks whether you can apply those boundaries without forgetting the timing constraints from the start of the chapter.

  • The edge stage collects and combines them, and that is the last point still inside the operations zone.
Modern industrial monitoring systems aggregate data from thousands of sensors across manufacturing facilities, enabling real-time visibility into equipment health, production rates, and energy consumption with historical trend analysis for optimization.
Modern industrial monitoring systems aggregate data from thousands of sensors across manufacturing facilities, enabling real-time visibility into equipment health, production rates, and energy consumption with historical trend analysis for optimization.
iotclass.org

Major section

Summary

Many remain installed and must be assessed for integration before replacement.

  • Modern industrial Ethernet protocols (PROFINET, EtherNet/IP, EtherCAT) provide deterministic, high-speed communication while maintaining compatibility with standard IT infrastructure.
  • Security considerations are critical as OT/IT convergence exposes previously isolated industrial systems to cyber threats.
  • Brownfield integration is as important as greenfield design.
iotclass.org

Major section

Bottling Plant Protocol Selection

Scenario: A beverage company is upgrading an older bottling line that currently uses Modbus RTU over RS-485 to connect sensors and actuators to a legacy PLC.

  • Existing bottle sensors/actuators: adequate for the current filling and capping sequence -- no immediate need to replace.
  • New vibration sensors: high-rate sampling locally, but only quality-checked alerts and summaries need to cross into operations systems.
  • Cloud dashboard subscribes to MQTT topics published by edge gateway.
iotclass.org

Deck summary

Key takeaways

An OPC UA gateway can retain legacy devices, OPC UA can carry checked context toward IT, and PROFIsafe or FSoE adds a safety-rated layer.

  • Sensors, valves and motors act on the process, and the controllers just above them close loops in about a millisecond, so that traffic stays on a fieldbus and never leaves the plant floor.
  • Incidents such as the Ukraine power grid attacks show why remote-access paths, engineering workstations, credentials, and SCADA operations need industrial-specific segmentation and monitoring.
  • The final interactive section checks whether you can apply those boundaries without forgetting the timing constraints from the start of the chapter.
iotclass.org

Retrieval practice

Recall check 1 of 3

Ada says: answer from memory, then check your reasoning.

Q1A regulated batch-processing line needs bounded timing for ingredient dosing, long service life, and historian/MES integration. An independently engineered safety-rated control path is already specified. Which protocol combination best separates machine control from integration?

AMQTT + Wi-Fi for flexibility and easy IT integration
BEtherCAT for motion control + OPC-UA for IT integration
CModbus TCP for simplicity and wide device support
DStandard Ethernet with custom protocols for maximum speed
Show answer

Answer: B EtherCAT can support the bounded machine-control path, while OPC UA carries structured historian and MES data.

iotclass.org

Retrieval practice

Recall check 2 of 3

Ada says: answer from memory, then check your reasoning.

Q2According to the Purdue Model (ISA-95/IEC 62443), what is the most critical security principle for converged IT/OT environments?

AAll OT devices should be directly connected to the internet for remote monitoring
BIT and OT networks should share the same firewall and security policies for simplicity
CRoute IT-to-OT traffic through a controlled industrial DMZ
DOT systems should be completely air-gapped with no connection to IT networks whatsoever
Show answer

Answer: C Enterprise, cloud, and remote-access traffic should not reach process-control networks directly.

Q3What tests whether range, bandwidth, power and interference fit an industrial link deployment?

ATraffic profile
BCoexistence evidence
CLifecycle record
DLink fit
Show answer

Answer: D It tests whether range, bandwidth, power, and interference fit the deployment.

iotclass.org

Retrieval practice

Recall check 3 of 3

Ada says: answer from memory, then check your reasoning.

Q4Complete the industrial protocol routing gate:

Aif message.get('loop') == 'motion' and message.get('cycle_ms', 999) <= 1:
Bif message.get('loop') == 'dashboard' and message.get('cycle_ms', 999) <= 1:
Cif message.get('owner') == 'marketing' and message.get('cycle_ms', 999) <= 1:
Dif message.get('encoding') == 'json' and message.get('cycle_ms', 999) <= 1:
Show answer

Answer: A A routing gate should keep bad-quality data out, route bounded motion traffic to the real-time field layer, and expose semantic integration only through the controlled DMZ path.

iotclass.org

Print reference

Answers

Answer key.

  1. B · EtherCAT can support the bounded machine-control path, while OPC UA carries structured historian and MES data.
  2. C · Enterprise, cloud, and remote-access traffic should not reach process-control networks directly.
  3. D · It tests whether range, bandwidth, power, and interference fit the deployment.
  4. A · A routing gate should keep bad-quality data out, route bounded motion traffic to the real-time field layer, and expose semantic integration only through the controlled DMZ path.
iotclass.org