Home / Solutions / Industrial Networking & Datacom / Smart Manufacturing Network (IT-OT)

Smart Manufacturing Network: IT and OT on One Design, Without Betting the Production Line on It

In most factories the office network and the production network were built by different people, in different decades, with different assumptions — and they meet nowhere, until the day they meet by accident and the line stops. We design the two together: a redundant OT ring on industrial switches that re-converges in milliseconds, each shop in its own zone so a broadcast storm stays where it started, mixed field protocols each kept in their own lane, and one policed boundary where MES reaches the line — and nothing reaches back. Sized honestly for a single line, a whole shop or a multi-plant group.

Why Factory Networks Break Differently

Four problems we find in almost every plant that calls us:

OT and IT each maintain their own networkAutomation engineers own the line, IT owns the offices, and neither has a drawing that shows both. When something breaks between them, the first hour goes to arguing about whose problem it is — while the line is down.

One broadcast storm, half a day of lost productionA flat shop-floor network has no firebreak. One misconfigured device, one loop patched in by a contractor, and every PLC on the floor loses its controller at the same time — then somebody has to walk the shop and find the cable.

Mixed field protocols nobody mappedPROFINET on the presses, EtherNet/IP on the robots, Modbus on whatever was bought in 2011. They tolerate each other until they share a link, and the one that breaks first is always the one holding a machine cycle open.

The shop floor eats office equipmentHeat, vibration, welding transients, paint solvent, metal dust and a cabinet with no air conditioning. An office switch in that cabinet is not a cost saving — it is a warranty claim with a delivery date.

Architecture: OT Ring + IT Aggregation + One Policed Boundary

Two networks with different jobs, joined at exactly one place and nowhere else:

Architecture drawn by AtlasCommTech following carrier-grade design practice. Diagram labels are kept in English for engineering clarity.

Why us: our founder spent 13 years inside the Huawei partner ecosystem delivering carrier networks, and the industrial switches in the OT ring are our own product line — rated −40 to +75 °C, DIN-rail mounted, built to IEC 61850-3 class immunity, fanless and fed from redundant DC. That means we answer for the access layer ourselves instead of forwarding your ticket, and it is exactly why we still keep the equipment options below open: the core layer should be whatever suits your country, budget and team, not whatever we happen to make.

Equipment Options

The solution is sized to your requirements and budget first — the same architecture can be delivered on several vendors' product lines. We help you choose by supply availability in your destination country, budget and your team's operating habits.

Huawei — enterprise campus, WAN and security linesMature ecosystem with a global service network.

ZTE Wantong — comparable datacom linesPrice-performance direction; supply runs smoother in some markets.

H3C — campus and data-center linesWidely deployed campus and data-center portfolio.

Zhongxin Shutong industrial switches — our own line, and the reason this page exists−40 to +75 °C, DIN-rail, IEC 61850-3 class immunity, fanless, redundant DC — built for the cabinet, not the comms room. We answer for this layer ourselves. The core above it stays open: mixing our access ring with another brand's core is normal here, not a compromise.

What the Design Delivers

Six things a properly engineered production network does that a flat shop-floor network never will:

A ring that re-converges in millisecondsThe OT ring closes back on itself: cut any one segment and traffic goes the other way round fast enough that the machine cycle never notices. Seconds is not a target on a line — a control packet that arrives late is the same as one that never arrived.

One zone per shopPress, weld, paint, assembly, AGV, cameras and management each get their own zone. A storm in the weld shop stays in the weld shop — the firebreak is the whole point, and it is drawn before any cable is pulled.

Each protocol in its own lanePROFINET, EtherNet/IP and Modbus segments are separated and given their own priority treatment, so cyclic control traffic is never queued behind a firmware download or a camera stream.

One boundary, both directions namedMES reaches the line through the industrial firewall on explicit, named rules; the line does not dial out to the office network at all. Everything that crosses is written down — which is also how you find out what actually crosses.

Hardware that survives the cabinetIndustrial switches rated −40 to +75 °C, DIN-rail mounted, fanless, on redundant DC and built to IEC 61850-3 class immunity — because the failures you cannot afford are the ones that happen at 2 a.m. in a hot cabinet nobody opens.

A drawing both teams acceptOne topology, one naming convention, one management view covering IT and OT — so when something breaks between them, the first hour goes to fixing it instead of establishing whose problem it is.

Three Sizes, One Design Logic

Tell us the line count, the shop layout and what your production window looks like — the tier tells you the shape of the network:

Numbers we design around:

Ring re-convergence is measured in milliseconds, not seconds — the machine cycle sets the target, not the datasheet

One zone per shop, drawn before any cable is pulled — the zone plan is the firebreak

Cabinet conditions, not comms-room conditions: −40 to +75 °C, fanless, DIN-rail, redundant DC

Scale tier	Typical site	What the design includes
Single production line	One line or one cell · a few machine cabinets · a small IT room	A small industrial ring of three or four switches, one zone per function group, a single boundary firewall to the office side. No IT aggregation layer — at this size the office switch is the aggregation, and pretending otherwise is buying a layer to look serious.
Whole shop floor	Multiple lines under one roof · press, weld, paint, assembly · AGVs and shop cameras	A full OT ring across the shop, one zone per shop area with protocol segments inside them, wireless for AGVs and scanners planned as its own zone, an IT aggregation layer on the office side, a boundary firewall pair with named rules both ways, and one management platform showing IT and OT on the same topology.
Multi-plant group	Several plants · shared MES and data platform · central engineering team	The shop design repeated per plant with identical zoning and naming, plant-to-plant interconnect for the shared MES, a boundary firewall per plant rather than one central one, standardised configuration templates so a new plant is a copy and not an invention, and a cutover plan that converts one shop at a time inside each plant's own production windows.

Equipment Roles (Categories, Not Models)

The solution is built from these equipment categories — the brand is chosen with you at design stage. Exact models depend on your port counts, cabinet temperatures, protocol mix and country — so we spec models after your requirements list, not before.

Role	What it does
Industrial switches (OT ring)	Live in the machine cabinet, close the redundant ring and carry the field protocols. Rated for the shop floor, not the comms room: wide temperature range, fanless, DIN-rail, redundant DC input. This is our own product line, so this layer is ours to answer for.
Aggregation switches (IT side)	Collect the office, engineering and MES side of the plant and hand it to the boundary. Ordinary datacom equipment in an ordinary room — this is the layer where the brand choice is genuinely free.
Industrial boundary firewall	The single crossing point between IT and OT. Holds the named, explicit rules for what MES may poll and what the line may never initiate, and logs both. If there is a second path between IT and OT anywhere in the plant, the design has failed — and finding those second paths is part of the survey.
Industrial wireless (AGV & handheld)	Coverage for AGVs, scanners and tablets, planned as its own zone with roaming designed for a moving vehicle rather than a walking person. Metal racking and moving machinery change coverage hour by hour — this is a site-survey item, always.
Edge gateways (protocol conversion)	Where machines older than the network speak serial or a vendor protocol, a gateway translates them into something the data platform can read — without giving the machine an IP path to the office. Needed far more often than plant IT expects.
Management platform (IT + OT)	One topology showing both sides, with alarms, configuration backup and change history. The value is not the dashboard — it is that automation and IT are finally arguing about the same picture instead of two different ones.

Send us your shop layout, your machine and protocol list, your cabinet conditions and your production calendar — and the model list follows. That order keeps the design honest.

Design Notes & Honest Limits

Read this before you commit:

The production window costs more than the equipment — so we plan the cutover first and talk hardware second. Tell us when the line can stop and for how long, and the design follows that constraint. Any plan that needs a longer stop than you have is not a cheaper plan, it is a more expensive one wearing a disguise.
Machines older than the network will not simply be re-addressed. Many are supported by their builder under a contract that voids if you touch the controller, and some genuinely cannot be changed at all. We survey the machine list with your automation team and the machine builders before we draw a zone plan — and where a machine cannot move, the design moves around it.
Shop-floor wireless is a survey question, always. Metal racking, moving cranes, welding interference and a layout that changes with the product mix make coverage a moving target. We ask to walk the floor during a production shift — not during a quiet Saturday, because a quiet Saturday tells you nothing about how the plant actually behaves.
Licensing policy and product availability differ by brand and destination country. This applies to the IT side and the firewall in particular; our own industrial line we can speak for directly, but the rest we check and confirm for your country at the design stage — before you commit to anything.
The network will not make a badly run line run well. A redundant ring protects connectivity; it does not fix a machine that jams, a schedule nobody follows or data nobody reads. If your downtime log says the network was never the cause, we will tell you to spend the money elsewhere — that conversation is cheaper for both of us than the alternative.

FAQ

Why not just put the shop floor on the office network?

Because the two have opposite requirements. The office network is patched on a schedule, tolerates a reboot and cares about throughput. The production network cannot be rebooted during a shift, cares about a packet arriving on time far more than about bandwidth, and has to survive a cabinet at 60 °C. Put them on one flat network and every office change becomes a production risk — which is why the first outage always happens on the morning after a routine maintenance window.

Can PROFINET, EtherNet/IP and Modbus really share one infrastructure?

Yes, on properly zoned industrial switches — that is exactly what the zone plan is for. Each protocol gets its own segment and its own priority treatment, so cyclic control traffic is never sitting in a queue behind a firmware push or a camera stream. What they cannot do is share a flat network and hope: the moment one of them floods, the one holding a machine cycle open is the one that fails, and it will fail during production, not during a test.

How long does the line have to stop for a cutover?

You tell us, and we design to it. That is the honest answer and the whole order of work here: the new ring is built alongside the running one while production continues, and the actual switchover of a zone is a short, rehearsed window — typically one shop area at a time, at whatever hour your production calendar allows. What we will not do is quote you a schedule that assumes a stop you never agreed to. If your window is genuinely too short for the design, that is a finding we give you before you order equipment, not after.

Do we really need industrial switches, or will office switches do?

It depends entirely on where the box lives. In a clean, air-conditioned comms room, an office switch is fine and we will happily spec one — spending industrial money on a rack in a cool room is waste. In a machine cabinet next to a welding station, at 60 °C, with vibration and no airflow, an office switch is not a saving: it is a failure with a date on it, and the failure will land in the middle of a shift. The rule we use is simple — what are the conditions where this box is actually mounted? Answer that and the choice makes itself.

You make industrial switches — why are other brands still on this page?

Because our line covers the OT access layer, and a plant is more than its access layer. The IT aggregation, the boundary firewall and the wireless are layers where the right answer depends on your country's supply situation, your budget and what your team already knows how to run — and on some of those, another brand is simply the better fit. Mixing our access ring under someone else's core is normal engineering, not a compromise. We would rather deliver a plant network that works than one where every box has our name on it.

Send us your shop layout and your production window

An engineer replies with a zoned OT design, a cutover outline and the equipment-category list. Send us your requirements list — the model list follows.

WhatsApp an engineer →