IT in Manufacturing: Where Office IT Ends

No, standard office IT is usually not enough on a shop floor. A network built for laptops, printers and email meets very different requirements in manufacturing: machines that have run the same operating system for ten years, dust and temperature swings that wear down electronics, and a shift that stops dead the moment the network goes down instead of just slowing down. Planning production IT like office IT means building past the actual requirements.

Planning works best when IT and production management sit at the table together from the start: IT knows the network technology, production knows the machines, their cycles, and the points where a failure hurts most. Ask only one side, and the information that actually makes the difference is usually the piece that's missing.

Why should the production network and the office network be separated?

In an office, one shared network for workstations, printers and Wi-Fi is usually enough. In production, the consequences of a problem on a shared network are far more serious: an infected laptop share in the office must not be able to reach the same broadcast domain as the controller of a CNC machine. Separation happens through dedicated VLANs or, for higher requirements, physically separate networks with a firewall in between that defines exactly which traffic is allowed in which direction.

• A dedicated VLAN or physically separate network for production equipment, separate from office and guest Wi-Fi
• Firewall rules that permit only the connections actually needed, not 'everything open between the networks'
• A separate view of which devices are actually active on the production network — transparency before trust

How do you deal with machines running legacy operating systems?

In most production halls, machines run on control computers whose operating system hasn't received a security update in years — often because the manufacturer certified the machine for a specific Windows Embedded release, and updating would void that certification or the warranty. Replacement is rarely possible on short notice; the machine, after all, still works. The practical approach isn't the update, it's isolation: the machine gets its own strictly separated network segment, without internet access and without direct reachability from the rest of the network. Whatever communication it actually needs — a connection to a control system, for instance — is enabled deliberately; everything else stays closed.

• Put legacy machine controllers into their own isolated segment without internet access
• Enable only the connections actually needed, not the whole network by default
• Keep an inventory of which machine runs which operating system — the basis for every later decision

What does availability during a shift actually mean?

In an office, a ten-minute network outage is annoying. In production, the same outage can stop an entire line if machines rely on the network for orders, bills of materials or release approvals. Availability is therefore not an abstract requirement but a very concrete one: which network component is allowed to fail without stopping the shift? Redundant uplinks between the core switches, a spare unit for critical components kept on site instead of ordered after the fact, and monitoring that reports a failure before the shop floor does — that's what makes the difference here.

• Redundant links between the core network components in production
• Keep spare hardware for critical switches on site instead of ordering it after a failure
• Active monitoring with alerting, instead of waiting for a report from the shop floor

What should network equipment on a shop floor be built to withstand?

Standard office-grade network equipment isn't built for a hall with dust, metal shavings, vibration and temperature swings between summer and winter. Industrial switches rated at least IP54, often IP65, withstand dust and splash water, operate across a much wider temperature range than office equipment, and are usually fanless so no fan clogs up with dust. Cabling deserves the same attention to the environment: shielded cables and rugged connectors hold up to the mechanical stress of a production hall far longer than office-grade material.

How are remote maintenance connections from machine manufacturers integrated safely?

Many machine manufacturers insist on remote access for maintenance, diagnostics or software updates — understandable, but a permanently open external connection into the production network is a risk out of proportion to the benefit. A better approach is access that's only active when needed, limited to the specific machine, and logged so it's clear who connected and when. Each manufacturer gets its own access instead of one shared gateway for all remote maintenance — so it stays traceable which access belongs to which purpose if something needs to be clarified later.

• Activate remote maintenance access only for a limited time, not permanently
• A separate, clearly scoped access per machine manufacturer instead of one shared access for all
• Logging of who connected when and which machine was accessed

Why does clean documentation of production cabling pay off?

A production hall gets rebuilt, expanded and reassigned again and again over the years — new machines arrive, old ones get moved, lines get reconfigured. Without documentation of which cable goes where and which switch port belongs to which machine, every later change turns into a search. A clean cabling plan, consistent labeling at both ends, and an up-to-date overview of active devices save time at exactly the moment a machine is down and nobody immediately knows why.

• Document the cabling plan and port assignments, and keep them current with every change
• Label both ends of every cable, not just the switch end
• Keep an overview of which device sits on which port — the basis for fast troubleshooting during a fault