Home / Solutions / Industrial Networking & Datacom / Energy & Utility Campus Network
DOMAIN 02 · INDUSTRIAL NETWORKING

Energy & Utility Campus Network: Production and Office, Cleanly Apart

In a substation, oil-gas plant or power campus, the control system and the office network cannot share one flat wire — regulation and safety demand a hard separation, and the yard itself demands equipment that survives heat, dust and vibration. We engineer energy campus networks from your requirements, with the equipment brand chosen openly at design stage: a dual-plane design that keeps production and office cleanly apart, industrial-grade access rated for the yard, zero-trust admission for inspection robots, drones and sensors, and isolated multi-site interconnect — sized honestly for a single station, a single plant or a multi-plant group.

Why an Energy Site Is a Different Animal

Four realities we see on almost every energy site that calls us:

Production and office must be isolatedGrid and production control cannot share a flat network with enterprise IT — graded-protection regulation and plain safety demand a hard separation between the two.
Robots, drones and sensors need to connectInspection robots, drones and field sensors are multiplying, and each needs reliable access — something the old office network was never built to give.
Harsh environment, weatherproof gearSubstation yards and oil-gas plants swing from deep cold to summer heat, with dust, vibration and electromagnetic interference. Office-grade switches die in a season.
Multiple sites to interconnectStations, plants and control centres spread across a region must be linked — with isolation intact and latency low enough for protection and telemetry traffic.

Architecture: Dual-Plane Separation + Industrial Access + Zero Trust

The same layered discipline as our enterprise campus design, split into two planes and hardened for a site that lives outdoors:

CONTROL CENTRE · WAN SECURITY GATEWAY CORE · TWO PLANES INDUSTRIAL ACCESS · RING FIELD DEVICES Control centre / group WAN · multi-site Border router Security gateway · plane isolation office plane lands here · production plane isolated Production core (OT) Office core (IT) audited crossing only SCADA Historian · protection GW OT servers on the production plane fibre ring uplinks Access · substation yard Access · plant floor Access · office block ERPS ring · tens-of-ms recovery Inspection robot · sensors · RTU Drone dock · cameras roam Office workstations · Wi-Fi Dual-plane zone plan Plane P · Production / OT P1 · SCADA / RTU P2 · Protection / telemetry P3 · Robots / drones Plane O · Office / IT O1 · Office / admin Zone 99 · Management planes cross only via audited gateway — zero trust Management every industrial switch on one dashboard — ring & alarm status per site

Architecture drawn by AtlasCommTech following carrier-grade campus design practice. Diagram labels are kept in English for engineering clarity.

Not the same as our power-plant or oil-gas video security pages. Those cover cameras and perimeter — the surveillance side of a site. This page is the data network the plant itself runs on: the dual-plane production/office design, the industrial access ring and the zero-trust admission for field devices. The two are complementary, and the cameras can ride the office plane or their own zone designed here.

Why us: our founder spent 13 years inside the Huawei partner ecosystem delivering carrier networks. The design discipline is the same — only here, the isolation protects a control system that keeps the lights on, not just traffic. Our own Atlas industrial switch line is built for exactly this yard: rated for roughly -40 to +85°C and hardened to substation and industrial standards such as IEC 61850-3 — while the core layer stays open to any brand you prefer.

Equipment Options

The solution is sized to your requirements and budget first — the same architecture can be delivered on several vendors' product lines. We help you choose by supply availability in your destination country, budget and your team's operating habits.

Huawei — enterprise campus, WAN and security linesMature ecosystem with a global service network.
ZTE & Wantone — comparable datacom linesPrice-performance direction; supply runs smoother in some markets.
H3C — campus and data-center linesWidely deployed campus and data-center portfolio.
Atlas industrial switches — hardened access for the yardOur own industrial line, rated for roughly -40 to +85°C and IEC 61850-3 — a strong fit for substation and oil-gas access, compatible with any brand's core layer.

What the Design Delivers

Six things a properly engineered energy campus network does that an ordinary office network never will:

Production and office on two planesA hard separation between the production/OT plane and the enterprise office plane — traffic crosses only through a controlled, audited gateway.
Industrial-grade access for the yardFanless switches rated for roughly -40 to +85°C, hardened to substation and industrial EMC standards, DIN-rail mounted — the access layer survives a substation yard, not just a comms room.
Robots, drones and sensors admitted safelyInspection robots, drones and RTU/sensor gear each ride their own zone with device admission, so a new field device never becomes an open door.
Zero-trust segmentationNo device is trusted by location — every flow is authenticated and policy-checked, matching the direction of modern OT security practice.
Ring resilience for the production planeAn industrial fibre ring recovers in tens of milliseconds if a link breaks, so a cut cable in the yard does not drop a protection or telemetry stream.
Multi-site interconnect, isolation intactStations and plants linked over an isolated overlay — a group sees everything centrally without merging the security domains of separate sites.

Three Sizes, One Design Logic

Tell us your site type and how many sites — the tier tells you the shape of the network:

Numbers we design around:
Production and office are two planes, not two VLANs — the crossing point is a single audited gateway, and it is designed first
Access gear is specified to the yard — temperature range, IEC 61850-3 / IEC 61000 and ingress rating are checked against your actual site
Ring recovery target: tens of milliseconds — a protection or telemetry stream must not notice a single broken link
Scale tierTypical siteWhat the design includes
Single stationSubstation · well-site · small pumping or metering stationOne security gateway, an industrial switch ring, production/office separation, hardened access rated for the yard, UPS in the cabinet — remotely manageable over the group WAN.
Single plant / campusPower plant · oil-gas plant · one fenced industrial campusDual-plane core, industrial access rings per area, zero-trust segmentation, device admission for robots/drones/sensors, dual-homed SCADA/historian zone on the production plane, an audited plane-crossing gateway and full management.
Multi-plant groupUtility or energy group across many sites and a control centreDual-plane core per site linked over an isolated overlay, central management with per-site ring and alarm status, standardized security zoning, IPv6 evolution — and a staged rollout site by site, with a compliance sign-off at each step.

Equipment Roles (Categories, Not Models)

The solution is built from these equipment categories — the brand is chosen with you at design stage. Exact models depend on your site conditions, port counts and country — so we spec models after your requirements list, not before.

RoleWhat it does
Industrial access switchesFanless, DIN-rail, rated for the yard — connect RTUs, robots, drones, sensors and cameras in a ring; the layer that must survive heat, dust and vibration.
Dual-plane core switchesTwo cores — one for production/OT, one for office/IT — routing within each plane on fibre rings, with no path between them except the audited gateway.
Security gateway (plane crossing)The single controlled point where production and office traffic may cross, with inspection, policy and audit logging — designed to your grid cyber-security requirements.
Border / interconnect routerTerminates the WAN to the control centre and links sites over an isolated overlay, keeping each site's security domain separate.
WLAN access points (rugged)Outdoor and indoor APs for roaming inspection robots, drones and handheld terminals — planned per area, with device admission on the production plane.
Management platformCloud or on-premises — topology, ring and alarm status per site, configuration backup and audit logs, so the network and its compliance evidence survive staff turnover.

Send us your requirements list — site type, environmental conditions, device counts, compliance regime — and the model list follows. That order keeps the design honest.

Design Notes & Honest Limits

Read this before you commit:
  • Power secondary systems fall under grid cyber-security regulation — in many countries a security protection provision for the electric-power monitoring system, together with a graded-protection scheme. The design phase begins by aligning to those compliance requirements, then we choose equipment — not the other way round.
  • Industrial-grade is a spec, not a slogan. We confirm the temperature range, IEC 61850-3 / IEC 61000 and ingress rating against your actual site conditions — a switch rated for an office does not belong in a substation yard.
  • Zero trust is an architecture and a process, not a product you buy once. We build the segmentation and admission groundwork; the policy has to be owned and maintained by your OT and security teams.
  • Licensing policy and product availability differ by brand and destination country. We check and confirm both for your country at the design stage — before you commit to anything.
  • A single well-site or small station does not need the multi-plant design. A security gateway, one hardened switch ring and clean production/office separation serve a small site fine — we will tell you so if that is your case.

FAQ

Why must production and office networks be separated?
Grid and production control systems fall under cyber-security regulation and safety practice that require them to be isolated from enterprise IT. We build two planes that cross only through an audited gateway, so an office incident cannot reach the control system.
Can your equipment survive a substation yard or oil-gas plant?
The access layer is industrial-grade: fanless switches rated for roughly -40 to +85°C, hardened to substation and industrial EMC standards such as IEC 61850-3 and IEC 61000, and DIN-rail mounted. We confirm the exact ratings against your site conditions before specifying anything.
How do inspection robots, drones and sensors connect safely?
Each rides its own zone with device admission, on the production plane, under zero-trust policy. A new sensor is authenticated and policy-checked, so adding field devices never opens a hole in the control network.
What about compliance for power monitoring systems?
Power secondary systems fall under grid cyber-security regulation and a graded-protection scheme. Our design phase starts by aligning to those requirements, then selects equipment — compliance first, hardware second.
Can several plants be managed centrally without merging their security domains?
Yes. Sites are linked over an isolated overlay and rolled up to one dashboard for ring and alarm status, while each site keeps its own security zoning. You see everything centrally without collapsing the isolation.

Send us your site list and compliance requirements

An engineer replies with a dual-plane design and the equipment-category list. Send us your requirements list — the model list follows.

WhatsApp an engineer →

Related Solutions