OT
Define the access boundary of an OT AI pilot
A starting architecture that separates reading, recommendations and control authority.
What is the Purdue model and what are its levels?
Short answer
The Purdue model splits industrial networks into functional levels: 0 field devices, 1 basic control (PLCs, RTUs), 2 area supervision (HMI, SCADA), 3 site operations (MES, historian). Level 3.5, an industrial DMZ, is often added. Levels 4 and 5 are business and enterprise. The model helps plan network segmentation.
What each level holds
The Purdue Enterprise Reference Architecture divides a plant's control and enterprise networks by function. Level 0 holds process equipment and field devices such as sensors and actuators. Level 1 holds basic control devices like PLCs and RTUs. Level 2 is area supervision, including HMIs and SCADA servers. Level 3 is site operations, where MES and historians sit. Level 4 covers business planning, and Level 5 is the enterprise.
Most implementations add a Level 3.5, the industrial DMZ, between the plant levels and the business network. It hosts the systems that exchange data across that boundary.
The model is usually presented together with the ISA-95 functional levels, and it is often used to plan network segmentation.
Worked example: classifying one filling line
Hypothetical filling line. Level 0 has 14 sensors and valves. Level 1 has 2 PLCs and 1 drive. Level 2 has 1 HMI and 1 SCADA server. Level 3 has 1 MES and 1 historian. Level 3.5 has 1 DMZ server holding historian copies for outside consumers. Level 4 has an ERP system.
The line's systems from Level 0 to Level 3.5 add up to 14 + 3 + 2 + 2 + 1 = 22 assets; the ERP is not counted. Each device sits on exactly one level, so the count can be checked against the asset inventory.
A cloud connection reaches neither the ERP nor the historian directly. It passes only through the DMZ, so a flow from Level 3 to the cloud should appear only on the DMZ.
Common mistakes
The first mistake is reading the model as a strict law. An IIoT gateway or a cloud link may need a path that the strict hierarchy does not foresee. The architecture should handle that through a DMZ, brokers and explicit data contracts.
The second mistake is treating levels as network segments, one for one. Levels are functional. Zones and conduits define the security boundaries, and the two ideas do not replace each other.
The third mistake is skipping Level 3.5 as unnecessary. If the historian or remote maintenance reaches the business network directly, the boundary between Level 3 and Level 4 disappears.
Follow-up questions
Is the Purdue model a standard?
No. It is a reference architecture. ISA-95 is the standard for enterprise-control system integration and uses similar functional levels. Both are used as a design vocabulary, not as a certificate.
Is the DMZ a single device?
No. A DMZ is a controlled zone between two security boundaries rather than one box. It may hold a data transfer server, a jump host or a historian replica. Its rules define which systems may talk, and in which direction.
Sources
- Purdue Enterprise Reference Architecture (Wikipedia) ↗
- ISA-95 Standard: Enterprise-Control System Integration ↗
Example numbers are hypothetical, not measured field results.