Industrial Network Construction 2026 — OT/IT Segmentation Design for Factories

The moment a plant in Thailand tries to start monitoring machine uptime with IoT sensors or automating visual inspection with AI, the same question always surfaces — where does that data go, and how does it get there? The answer is industrial network construction, and it is not a job about pulling new LAN cable. The real work is architecture design, specifically the decision of how you separate the control side (OT) from the information side (IT). This article walks through that design thinking, how to pick an industrial Ethernet standard, how to divide work between wired and wireless, what the effort and cost look like, and what to compare when you select a vendor — all framed for a factory operating in Thailand.

What an Industrial Network Actually Is — How It Differs from an Office LAN

The same Ethernet, but almost opposite requirements

A factory network and an office network look identical from the outside. Both use RJ45 connectors and the same twisted-pair cable. What each one has to guarantee, however, is close to opposite.

An office LAN exists to share adequate bandwidth fairly among many endpoints. Nobody is harmed if an email leaves half a second late. An industrial network exists to make sure that a signal arrives within a defined time window, in a defined order, without exception. If the message from a PLC to a servo amplifier is half a second late, the machine either trips into emergency stop or, in the worst case, two mechanisms collide. Raw bandwidth matters far less than the absence of jitter.

Put simply, an industrial network has to satisfy three conditions.

• Determinism. Latency stays inside a predictable envelope and the cycle does not wander.
• Availability. On a line running around the clock, one failed device or one broken conductor must not stop everything.
• Environmental tolerance. Dust, oil mist, vibration, temperature swings, and the electromagnetic noise thrown off by inverters and servo drives.

Put a cheap office-grade switch inside a control cabinet and it will work — for a while. The trouble arrives when cabinet temperature climbs in the hot season, when the large motor next door starts up, or simply a few months later when the link starts dropping for no visible reason. The price gap between an industrial switch and an office switch is, in practice, what you pay to move the “when does it fail” date far into the future.

From fieldbus to industrial Ethernet

Factories used to connect PLCs and field devices over proprietary fieldbuses, each vendor with its own. Industrial Ethernet has since replaced the fieldbus as the mainstream approach, with EtherCAT, PROFINET and EtherNet/IP as the representative standards.

That shift means more than thinner cable. It means control-side communication now rides on the same technical foundation as the information side. In other words, it has become physically possible to join the control network and the business network with a single cable. Being technically able to connect them and being architecturally allowed to connect them are two different questions, and that gap is exactly what this article is about.

Network construction is not a cabling job

When someone says “we want to build an industrial network,” the conversation usually opens with cable routes and how many drops are needed. But what actually drives both the quoted price and the future operating cost is a design decision — where you draw the boundaries.

Cable can always be re-pulled later. Once you have wired the whole plant as one flat, unsegmented network, however, re-drawing the boundaries later means stopping a line that is currently producing. The correct order is to decide the segmentation first and let the cabling follow. That sequence is the foundation of industrial network construction.

Why Industrial Network Construction Is Being Revisited Now

IoT and AI projects stall at the network layer

Among Japanese-affiliated manufacturers in Thailand, the enquiries that have grown over the past few years share a pattern. One plant wants to visualise equipment utilisation, another wants defects reported in real time, a third wants AI to automate an inspection step. Different goals, but the project stops at the same place — “we can attach the sensor, but we have nowhere to send the data.”

Neither an IoT sensor nor an AI inference server produces value on its own. They only function once shop-floor data reaches a defined destination at a defined frequency. In a plant where the transport path — the network — has not been designed, a pilot may run fine while full deployment always hits a wall. Connecting one sensor with one cable is easy. Connecting a hundred in a form that survives daily operation is a different problem.

The risks carried by a flat network that simply grew

Most factory networks were never designed. They arrived at their present shape by accretion — one more switch each time a line was added, one more access point each time somebody complained that Wi-Fi did not reach. Layer enough of those decisions and you end up with production-line PLCs and the office production-management system sharing one flat network.

That state carries three risks.

• You cannot isolate a fault. When communication becomes unstable, nobody can tell whether the cause sits on the office side or the line side, so recovery takes far longer than it should.
• Unexpected traffic reaches the line. A large file transfer or a backup job running on the office side can disturb the cycle time of control traffic.
• A breach spreads laterally. Compromise one office endpoint and there is a reachable path from it all the way to control equipment.

All three come from the same root cause — there is no boundary. Which also means that designing the boundaries is, by itself, the countermeasure to all three.

The Architecture Decisions to Make First in Industrial Network Construction

In industrial network construction, something has to be settled before anyone selects a part number. That something is the decision of which assets you treat as a single group, and how you restrict communication between groups. Two frameworks are used together in practice to express that design.

The Purdue model — thinking in layers

The Purdue model divides the control hierarchy into levels 0 through 5 and permits communication only between adjacent levels, so that an attack cannot spread horizontally. The usual mapping puts field sensors and actuators at level 0, control devices such as PLCs at level 1, supervisory control (SCADA and HMI) at level 2, manufacturing execution (MES) at level 3, business planning and logistics at level 4, and enterprise systems at level 5.

The value of the model is not the number of layers. It is that it states one principle in a form everybody can understand — do not create a path that runs straight from the top to the bottom. If no route exists from an enterprise system directly to a field sensor, then a problem in the information systems cannot land directly on production equipment.

How the Purdue model is treated in 2026

Applied literally as a strict hierarchy, though, the model collides with what plants are now asked to do. Cloud integration, remote maintenance from outside the company, and edge computing placed on the shop floor — none of these is traffic that climbs the ladder politely, one rung at a time.

For that reason, the practical position in 2026 is to treat the Purdue model not as a rigid hierarchy but as a conceptual guideline for segmentation, and to operate it in combination with the zone and conduit thinking of IEC 62443. Preserving the layers is not the objective; keeping every path from a less trusted side to a more trusted side under explicit control is the objective. That reading is now the mainstream one.

Zones and conduits in IEC 62443

IEC 62443 calls a group of assets sharing a common trust level a zone, and calls a permitted communication path between zones a conduit. With those two words, the design work can be defined precisely.

• Group the assets in the plant according to the trust level each one requires — this defines the zones.
• Enumerate only the communication genuinely needed between groups, and create paths that pass nothing else — this defines the conduits.

The important consequence is that zone boundaries do not have to follow physical boundaries. Inside one building, a machine maintained by an outside vendor and a machine managed in-house can belong to different zones, while two similar lines in two separate buildings can belong to the same zone. What you segment by is trust level and blast radius, not floor plan.

The DMZ between OT and IT

The most concrete expression of zones and conduits is the DMZ placed between OT and IT. The construction is straightforward — the OT side only pushes data up to a collection server sitting in the DMZ, and the IT side only pulls data from that DMZ.

The effect is unambiguous. Because OT and IT are never directly connected, a compromise on the IT side has no direct path onto the OT side. Data passes; the connection itself does not. Creating that condition is what the DMZ is for.

In implementation terms, what lives in the DMZ is the data collection server, the historian, or the edge computing platform discussed later in this article. Seen from the OT side, there is exactly one destination outside the zone, which keeps firewall rules simple and makes the whole thing far easier to audit.

Choosing an Industrial Ethernet Standard — PROFINET, EtherNet/IP and EtherCAT

Three standards with three different design philosophies

The mainstream industrial Ethernet standards each reflect a different set of priorities.

PROFINET was driven by Siemens and spread mainly across Europe. Its notable characteristic is strong affinity with existing Ethernet infrastructure — it mixes readily with standard Ethernet equipment, and connecting it to plant-wide information systems is comparatively painless.

EtherNet/IP is the standard that prioritised compatibility with standard Ethernet. It is widely adopted by North American machine builders, and it is valued for letting engineers apply ordinary Ethernet knowledge and tooling directly.

EtherCAT is specialised for communication speed and cycle accuracy. It is chosen for applications such as multi-axis motion control, where a large number of axes must stay synchronised on an extremely short cycle.

Arguing in the abstract about which standard is superior is not very productive. What matters far more is that the number of situations in which you actually get to choose is limited.

Your installed PLCs and machine builders have already decided

In a real factory, the industrial Ethernet standard is almost never something you select — it is something already determined. The reason is simple. Whatever the PLC vendor and the connected machine builders support becomes the entire range of available options.

When you add a new sensor to an existing line, matching the standard the installed PLC already supports is both the cheapest and the most certain route. Trying to change the standard at that point sets off a chain reaction — PLC replacement, swapping communication modules on the machine side, and rewriting programs — whose cost bears no comparison to the sensor addition you originally wanted.

The design phase of industrial network construction therefore starts by inventorying the constraints you have inherited. Which line runs on which standard, how old each PLC is, and how far the machine builder’s maintenance contract extends. Skip that inventory and any standards discussion produces a design nobody can execute.

Only new lines give you a free choice

In practice, you can genuinely re-select a standard only when a line is new. A new building, a new line start-up, or the wholesale replacement of aged equipment.

That leads to a clear recommendation. On existing lines, do not set standards unification as a goal — instead, design so that a mixed set of standards can be absorbed at a higher layer. Save the question of which standard the company should converge on for the moment a new line actually appears on the plan. Forcing unification onto existing lines does not just fail the cost-benefit test; it also means touching lines that are currently producing.

Wired Versus Wireless — A Realistic Design for the Shop Floor

Why factory Wi-Fi is unstable

“Cabling work is a pain, can we just do everything wirelessly?” is one of the most common requests. The short answer is that a design replacing the entire plant network with Wi-Fi cannot be recommended.

Factory wireless LAN faces two problems — radio interference from the electromagnetic noise emitted by equipment, and insufficient signal strength caused by obstructions and distance — so it cannot be assumed to deliver the stability of a wired LAN unconditionally. Metal fixtures and racks, moving conveyance equipment, and rows of inverters and servo amplifiers make a hostile environment for radio.

Worse, the instability varies by day, by shift, and by which product is running. That makes it hard to isolate, and the worst pattern of all is “it drops occasionally” dragging on for months. Using wireless for control traffic, or for any data path whose interruption stops production, deserves a very careful decision.

Three things to review on the wired side

The wired side is not automatically fine either. Stable operation requires reviewing three things at once — cable, route, and equipment.

• Cable. Choose shielded STP cable of Cat6A or better, and run it physically separated from power cabling.
• Route. Do not run long parallel stretches alongside power lines. Respect bend radius and pulling tension. Where metal duct is used, verify the earthing.
• Equipment. Use industrial switches and PoE-capable switches. Select models rated for the actual operating temperature range and, where needed, redundant power input.

These three have a property worth noting — fixing only one of them tends to produce no visible improvement. Install expensive industrial switches and the link will still be unstable if the cable runs a hundred metres beside a power line. Replace all the cable and the switch will still drop out in the hot season if it cannot survive the temperature inside the cabinet.

Where wireless genuinely fits

None of this argues for eliminating wireless. There are applications wired connections cannot serve in principle.

• Handheld terminals and tablets carried by workers who move around
• Communication to mobile assets themselves, such as AGVs and automated forklifts
• Temporary line changes, or sensors used for a fixed-duration measurement campaign
• Areas where securing a cable route is physically impractical

A documented deployment at a precision-parts manufacturing plant describes building a Wi-Fi infrastructure that works reliably anywhere in the work area while avoiding interference from machine-generated noise. The point is not that wireless does not work in factories. The point is to design deliberately, assigning to wireless the jobs that suit wireless.

Private 5G as an option

In Thailand, NBTC’s release of spectrum in the 4800 MHz band has made private 5G one of the options available to a factory. Compared with wireless LAN it is more resilient to interference, covers a wide area with fewer base stations, and makes traffic prioritisation easier to implement.

Initial investment is nonetheless considerably higher than wireless LAN, so it is not the right answer for every plant. The decision has to account for the area you need to cover, how many mobile assets you have, and what is actually going wrong with the existing wireless LAN today. The regulatory and cost detail is covered separately in our article on private 5G deployment in factories and the NBTC spectrum release. At the design stage of industrial network construction, the realistic order is to first separate the areas where wireless LAN is sufficient from the areas where it is not, and consider private 5G only for the latter.

The Fundamentals of OT Security Design — What to Decide Alongside the Network

OT security cannot be bolted on afterwards

Industrial network construction and OT security tend to be handled as two separate projects. In reality, the decision about how you segment the network is the substance of the OT security design. Defining zones and conduits is security design, not a precursor to it.

Put the other way round, once you have already built an unsegmented network, saying “now let us add security measures” leaves very little room. You can introduce monitoring tools and detect anomalies, but you cannot stop lateral movement. Stopping it requires boundaries, and inserting boundaries requires touching lines that are running.

The organisational side of this — how responsibilities are divided between OT and IT, and what obstacles appear when a company tries to bring the two together — is covered in detail in our article on the three barriers to OT and IT convergence and how to work through them. Deciding network boundaries always runs, at some point, into the organisational question of who owns which device, so reading the two together makes the design discussion move faster.

Start by making traffic visible

The first task in OT security design is not writing rules. It is establishing what is actually happening. The accepted practice is to monitor traffic for several weeks before proceeding.

Every factory network carries communication that nobody on the team knows about. A router installed by a machine builder for maintenance access. An inspection machine quietly shipping logs to a vendor cloud. A PC that supposedly nobody uses still talking to something on a schedule. Write firewall rules without surfacing all of that first and the cutover will kill necessary traffic the instant it takes effect.

Monitoring can be done through the mirror port on an existing switch, or by temporarily installing a dedicated sensor. At this stage nothing is blocked — you only record.

Writing the rules that sit on a conduit

Using the traffic inventory produced by monitoring, enumerate the communication that genuinely has to cross zone boundaries. Three principles govern how the rules are written.

• Explicitly permit the required communication and deny everything else.
• In every permit rule, state source, destination, protocol and direction in full.
• Record, together with the rule, who needs that communication and for what purpose.

The third one matters most. After the responsible engineer moves on, nobody dares delete a rule with no recorded justification. Rules accumulate, and a few years later the network is effectively unsegmented again.

Remote access and outside vendors

In factories in Thailand, equipment is frequently maintained remotely by manufacturers based in Japan or elsewhere. This path deserves the most careful design attention of anything in the architecture.

The recommended approach is to prevent external connections from reaching the OT side directly and to route them through a jump host in the DMZ. On top of that, combine operational rules — restrict the time windows in which connections are permitted, require internal approval for each session, and keep a record of what was done. Technical mechanisms alone are not enough; the arrangement has to be consistent with the terms of the maintenance contracts you hold with each machine builder.

Edge Computing and Data Loggers — Where Factory Data Gets Processed

Why factories need edge computing

Edge computing in a factory means processing data close to where it is generated. Rather than shipping everything to the cloud and processing it there, the necessary processing is completed on the shop-floor side.

Three reasons drive that choice in a plant.

• Data volume. Capture vibration or current waveforms at a high sampling rate and the volume becomes impractical almost immediately. Converting to features locally before transmission cuts what you send dramatically.
• Response time. Where an inspection verdict has to return to the equipment within tens of milliseconds, a round trip to the cloud does not fit inside that window.
• Tolerance of link loss. The production line keeps running when the internet link goes down. If the shop-floor side can process and buffer locally, everything can be forwarded once the link comes back.

Architecturally, the edge platform is often placed in the DMZ. Data flows up from OT to the edge, and IT systems or the cloud collect from the edge. That placement lines up naturally with the DMZ concept described earlier.

Where to put a data logger

A factory data logger is a device that continuously records measured values such as temperature, pressure, current and flow at a fixed interval. If edge computing is the “process it” role, the data logger is the “keep capturing it” role.

Three points matter from a network construction perspective.

• It can capture data without modifying installed equipment. Some models record by tapping sensor or analogue signals, with no change to the PLC program. Because measurement can start without intruding on the machine builder’s warranty scope, it is an easy first step for a pilot.
• Where you place it affects zone design. Mounted inside a control cabinet, it belongs to an OT-side zone and needs a defined path up to the DMZ. Decide mounting position and cabling on the assumption that it will be networked.
• Time synchronisation is required. Correlating records from several loggers only works if their clocks agree. Providing a time synchronisation mechanism on the network makes later analysis dramatically easier.

Decide the edge and cloud split before you buy either

The most frequent mistake when introducing edge computing and data loggers is deploying both without deciding which does what. The same data ends up recorded in two places and nobody can say which copy is authoritative.

At design time, put it in a table — which data, at what interval, stored where, retained for how long. That same table feeds directly into bandwidth sizing and storage capacity estimates later.

Practical Points When Building an Industrial Network in Thailand

Confirm the demarcation point with estate infrastructure early

Thailand’s industrial estates come with developed power, water, wastewater treatment and telecommunications infrastructure, and Japanese-affiliated estate operators provide tenant support in Japanese. That is a significant advantage, but from an industrial network construction perspective there is one boundary you need to nail down.

That boundary is between the infrastructure the estate provides and your own in-plant network — the demarcation point. Confirm the following items early.

• The type of circuit the estate provides, its bandwidth, and whether any redundancy exists
• The physical location of the demarcation point and the cable route from there to your own equipment
• The contract contact for the circuit, plus the fault reporting channel and target recovery time
• The lead time required for a bandwidth upgrade or an additional circuit

Leave this too late and you get the situation where the design is finished but nothing can proceed for weeks while a circuit is provisioned. Upgrades and new circuits in particular can take longer than procuring the hardware.

Selecting a local SI or electrical contractor

Candidates for building the network in Thailand typically include Japanese-affiliated system integrators, local system integrators, electrical contractors, and the local subsidiaries of machine builders. Two things need checking during selection.

The first is a track record specifically in industrial networks. Experience with office LAN installation and experience with control-network installation in a running factory call for entirely different capabilities. Confirm whether the contractor has worked inside control cabinets, maintained separation from power cabling, worked alongside a line that is producing, and managed a schedule pinned to a planned shutdown.

The second is the after-sales support structure. When a fault occurs, whether support is available in Thai, Japanese or English translates directly into recovery speed. If a communication fault happens during a night shift, whether your Thai staff on the floor have a contact they can call themselves changes the response time enormously. Before signing, get the target time to first response, the supported languages, and the coverage hours confirmed in writing.

What standard to apply when procuring network equipment

Industrial switches and access points are network equipment, but they are also IoT devices installed in a factory. It is worth putting security requirements into the evaluation criteria alongside features and price.

Concretely, that means the period over which firmware updates will be provided when a vulnerability is found, how initial passwords are handled, access control for the management interface, and whether an end-of-support date is published. Japan’s conformity assessment scheme for IoT product security, JC-STAR, offers a useful systematic framing of exactly this class of requirement. How to apply that framing when procuring from a Thai site is covered in our article on JC-STAR and procurement criteria at a Thailand site. You do not need to make formal conformity a mandatory requirement, but the list of evaluation items is directly usable in practice.

On private 5G, mentioned earlier, the same caution applies — because initial investment is substantial, replacing the entire plant at once is rarely a realistic decision. Limiting the scope to outdoor yards, large warehouses, and AGV traffic routes where wireless LAN would need an excessive number of access points makes for a far more defensible investment case in Thailand.

A Model Case — Cost and Effort of Industrial Network Construction

To give a feel for effort and cost, the following walks through an original estimate built around a fictional company. The figures below are not real statistics or survey results — they are TOMAS TECH’s own illustrative estimate based on a fictional company created for this article. Actual amounts vary widely with plant size, the condition of installed equipment, and site conditions.

The company in question is “F” (a pseudonym), a Japanese-affiliated automotive parts manufacturer with a production site in Thailand. The scenario is an upgrade from a starting state where the production-line PLCs and the office production-management system sit on one flat network, with no industrial switches and no segmentation in place.

What changes between before and after

What is worth noticing in this table is that the part numbers are not the only thing that changed. The wireless and fault-response rows both describe differences that arise from a changed design philosophy — buying new hardware alone would not have produced them.

The effort and cost estimate

Breaking the same model case down into the effort required by type of work gives the following.

• Current-state survey and architecture design, covering zoning and conduit design — 5 person-days
• Selection and procurement arrangement of industrial switches, cable and related hardware — 3 person-days
• Cabling installation and equipment mounting — 10 person-days
• OT security configuration, covering DMZ and firewall rule setup plus trial operation in monitoring mode — 5 person-days
• Total — 23 person-days

If the work is outsourced to an external system integrator, the indicative cost, on the assumption of an engineer rate of THB 30000 to 50000 per person-day, comes to THB 690000 to 1150000 as an original estimate. Hardware and cabling materials are billed separately at actual cost.

What we would like you to take from this estimate is the structure of the breakdown rather than the amount. Of the 23 person-days, the work of physically pulling cable accounts for 10 person-days, while the remaining 13 person-days go to survey, design, hardware selection and security configuration. In other words, more than half the cost arises in design and configuration rather than in installation. Order industrial network construction as a cabling job and that portion simply never appears in the quotation — it surfaces later as a change order.

Where existing industrial switches and cable can be partly reused, there is room to compress the installation and procurement effort. The effort for the current-state survey and architecture design, however, is required whether or not anything is reused. The survey is precisely what tells you what can be reused and what cannot, and the segmentation design is determined independently of the condition of the installed hardware.

One caveat on benchmarking. Because the going rate for outsourced factory network construction varies enormously with what is being asked for, the recommended approach is to clarify the objective first and then obtain and compare quotations from several companies. Treat the estimate above strictly as a device for understanding the shape of the breakdown, not as a market rate.

Criteria for Comparing Vendors

Align the scope before you request quotes

Getting quotes from several companies is the right approach, but depending on how you ask, the comparison may not be valid at all. The most common failure is that each company proposes within its own comfort zone, so the quotations do not cover the same scope. Line up a quote that includes design against a quote that covers installation only, and the installation-only quote will of course look cheaper.

The way to avoid this is to specify the scope yourself when you issue the request. Concretely, require each bidder to state explicitly whether each of the following is included or excluded.

• Current-state survey, including whether traffic monitoring is in scope and for how long
• Architecture design, including whether zone definitions and conduit design are delivered as documents
• Hardware selection and procurement handling, including whether hardware cost sits inside or outside the quote
• Cabling installation, including materials, removal of existing cable, and the scope of in-cabinet work
• Security configuration, including firewall rule design and setup, and the duration of trial operation
• Cutover work, including attendance during the planned shutdown and preparation of rollback procedures
• Deliverables, including topology diagrams, IP addressing documents, rule listings, and test reports
• Maintenance, including time to first response, supported languages, coverage hours, and handling of spare parts

Put the comparison into a table

Once the quotes are in, line them up against the following criteria before you look at the numbers.

If the cheapest proposal is also the one that does not deliver a topology diagram, you will pay that difference back every time a change is needed in future. The comparison has to be made on five-year total cost, not initial cost.

Phased Rollout Steps

Because industrial network construction happens in a factory that is producing, switching everything over at once is not an option. The accepted practice is to work through three distinct phases.

Step 1 — start with passive monitoring

In the first phase you change nothing on the network and only record the traffic. Monitoring for several weeks before proceeding is the recommended sequence, and that period gives you the full picture of what is currently talking to what.

The deliverables of this phase are a traffic inventory and a proposed zone map. It is not at all unusual to discover communication nobody expected. Going through each discovered flow and confirming who uses it and why is, in itself, the evidence base for the design.

Step 2 — segment non-critical systems first

In the second phase you introduce boundaries starting with the areas whose interruption does not directly affect production. Typical targets are the office network, meeting rooms, guest wireless, and prototype or trial lines.

This phase has two purposes. One is to verify, somewhere low-risk, that the rules you designed actually behave as intended. The other is to establish the cutover procedure and the rollback procedure by physically performing them. Completing both before touching a production line removes most of the uncertainty from the real cutover.

Step 3 — cut over production systems during a planned shutdown

In the final phase you switch over the parts that touch the production line. This work is always aligned to a planned shutdown. Candidates include the year-end and New Year break, the long Songkran holiday, or a monthly scheduled maintenance window.

The value of phasing lies in being able to go back. Switch everything at once and, when something breaks, identifying the cause takes a long time and the rollback scope is enormous. Switch in bounded increments and both the impact and the cause stay bounded too.

In factories in Thailand there is one additional consideration — people move around before and after long holidays, so confirm who will be available for the several days following a cutover. It is worth remembering that being short-staffed during post-cutover stabilisation causes more practical trouble than the cutover itself.

Common Failures in Industrial Network Construction

Ordering it as a cabling job

The most common failure by far. Order it as “pull LAN cable and mount switches” and the quotation will contain no zone design, no security configuration, and no topology diagram as a deliverable. The installation completes successfully, and the network remains entirely unsegmented.

The remedy is to state at the request stage that segmentation design is included. Aligning the quotation scope, as described above, is the countermeasure in itself.

Skipping the current-state survey

Cutting the current-state survey to shorten the schedule produces the classic cutover-day event where traffic that used to work suddenly stops. The few person-days spent on the survey are a small investment against the cost of a line stoppage caused by a failed cutover.

Trying to cover every area with wireless

Some plants consider going fully wireless to hold down cabling cost, but the electromagnetic noise and physical obstructions in a factory are not conditions you can negotiate with. Wired for critical areas, wireless for mobile assets and non-critical areas, is the baseline split.

Accepting handover without drawings and design documents

Sign off without receiving the topology diagram, the IP addressing document and the firewall rule listing, and you will have to call the contractor back even to add a single sensor. The list of deliverables belongs on the pre-contract checklist.

Insisting on unifying the standard

Forcing existing lines onto a single industrial Ethernet standard sets off a chain reaction that reaches PLC replacement and sends the cost through the roof. In most cases, a design that assumes a mixed environment and absorbs the difference at a higher layer is the more rational choice.

Frequently Asked Questions

What does industrial network construction actually involve

It is not a term for cabling work alone. It covers a survey of current traffic, design of zones and conduits, selection and procurement of industrial switches and cable, cabling installation, DMZ and firewall configuration, and a phased cutover. In this article’s model-case estimate, cabling installation accounts for 10 of the 23 person-days, with the remainder allocated to survey, design, hardware selection and security configuration.

How much does industrial network construction cost

Because the going rate varies enormously with what is being asked for, the recommended approach is to clarify the objective and then obtain and compare quotations from several companies. This article presents an original estimate based on a fictional company — 23 person-days, and THB 690000 to 1150000 on an assumed engineer rate of THB 30000 to 50000 per person-day. That is an illustrative figure for understanding the breakdown, not a market rate, and hardware and cabling materials are billed separately.

Where should we start with OT security

Start by monitoring traffic for several weeks to establish the current state. Writing rules comes after that. Next, introduce boundaries beginning with non-critical systems whose interruption does not affect production, and finally cut over production systems during a planned shutdown. The baseline architecture places a DMZ between OT and IT, with the OT side only sending data to the DMZ and the IT side only collecting from it.

Does a factory always need edge computing

No. It becomes necessary when data volumes are large, when response-time requirements are tight, or when processing has to continue through a link outage. For something like collecting machine status once every few minutes, sending directly to the cloud without an edge platform works fine. That said, if there is any chance of adding an edge platform later, designing in a DMZ from the start makes the migration much easier.

What is the difference between a factory data logger and a PLC

A PLC is a control device that drives machinery, while a data logger is a device for recording measured values. Some data loggers can record sensor signals without any modification to the installed PLC program, which makes them an easy first step when you want to start measuring without touching the machine builder’s warranty scope. From a network design perspective, you need to decide in advance which zone the data logger belongs to and by what path its data reaches the DMZ.

Summary

Here are the key points of this article.

Industrial network construction is architecture design, not cabling work. At its centre sits the decision of where to separate control systems from information systems and which traffic is permitted to cross that boundary. Cabling and hardware selection follow from that decision. Reverse the order and re-segmenting later will mean stopping lines that are producing.

As a design framework, the practical position in 2026 is to treat the Purdue model as a conceptual guideline for segmentation rather than a rigid hierarchy, and to combine it with the zone and conduit thinking of IEC 62443. The most concrete expression is a DMZ between OT and IT, where the OT side only sends and the IT side only collects.

The industrial Ethernet standard is effectively already decided by your installed PLCs and machine builders. Because a free choice exists only on new lines, a design that assumes mixed standards is the more rational approach for existing lines. Wired and wireless are likewise not in opposition — you assign each by area and by application. Wired for critical areas, wireless for mobile assets and non-critical areas, with the wired side reviewed across cable, route and equipment simultaneously.

In the model-case estimate, current-state survey and design took 5 person-days, hardware selection and procurement 3 person-days, cabling installation 10 person-days, and OT security configuration 5 person-days, for a total of 23 person-days, coming to THB 690000 to 1150000 on an assumed engineer rate of THB 30000 to 50000 per person-day. Cabling installation is less than half the total, and design and configuration carry the larger share of the cost. This is TOMAS TECH’s own illustrative estimate based on a fictional company, not real statistics.

For a build in Thailand, the practical points are to confirm the demarcation point with estate infrastructure early, to check both the industrial-network track record and the support languages of your local integrator, to make the private 5G investment decision area by area, and to bring IoT security evaluation criteria into network equipment procurement as well. Roll out starting from passive monitoring, segment non-critical systems next, and cut over production systems during a planned shutdown. The value of phasing is that you can go back.

Where to Turn While You Are Still Considering This

A network review usually surfaces sideways — someone starts looking at IoT or AI and then asks, almost as an afterthought, what shape the underlying infrastructure is actually in. At TOMAS TECH we work with plants run by Japanese-affiliated manufacturers in Thailand, and we are happy to start from the earliest stage, whether that is taking an inventory of the current network or simply working out which boundary is realistic to draw first. There is no need for a fixed budget or timeline before you get in touch — feel free to reach us through our contact page.

References

• NXP Tech Blog / An explanation of industrial Ethernet protocols covering EtherCAT, PROFINET and EtherNet/IP
• HELUKABEL / An explanation of the differences between PROFINET and standard Ethernet
• IoT Worlds / The Purdue Model Revisited – Modern OT Network Architecture 2026 Guide
• Fortinet / What Is the Purdue Model for ICS Security
• MON5 / OT Network Segmentation
• NTT East Business Portal / How wireless LAN expands factory DX
• Panduit / A commentary on stable operation of factory networks
• Buffalo / A wireless LAN deployment case study at a precision parts manufacturing plant
• Hacchu Navi / The cost of factory network construction and how to choose a vendor
• BigBeat ASEAN / A guide to Thailand’s industrial estates and the characteristics of its manufacturing sector