ALearning Material
Industrial automation organises a factory's control and information systems into layers, the automation pyramid. Each layer talks mainly to the ones directly above and below it, with slower, more "business" timescales as you go up.
A factory isn't one system but a stack of them, and the automation pyramid is the map of how they relate. Each layer talks mostly to its immediate neighbours, and the timescale stretches as you climb: milliseconds of real-time control at the bottom, seconds of supervision above that, and hours-to-weeks of operations and business planning at the top. Seeing a plant as these layers is what lets you place any device, protocol, or requirement in context.
The principle that makes the pyramid more than a diagram is that time and trust decrease as you go up. The bottom must react instantly and must never fail; the top plans at leisure. So the architecture deliberately decouples them. A hiccup in the business network at the top must never be able to stall a motor at the bottom. That separation isn't just tidy organisation; it is a safety and security boundary, and it's the lens for the whole automation topic.
┌─────────────────────┐
L4 │ ERP (business) │ days/weeks: orders, inventory, planning
├─────────────────────┤
L3 │ MES (operations) │ hours/shifts: scheduling, quality, tracking
├─────────────────────┤
L2 │ SCADA / HMI │ seconds: supervise, visualise, alarms
├─────────────────────┤
L1 │ PLC / DCS (control)│ milliseconds: real-time control logic
├─────────────────────┤
L0 │ Field devices │ physical: sensors & actuators
└─────────────────────┘
- L0 Field: sensors (measure) and actuators (act): the physical edge.
- L1 Control: PLCs/DCS executing real-time logic (the scan cycle you learned).
- L2 Supervisory: SCADA/HMI: screens operators watch, set setpoints, see alarms and trends. Supervises, doesn't do the fast control itself.
- L3 MES (Manufacturing Execution System): turns production orders into work, tracks what was actually made, quality, downtime.
- L4 ERP (Enterprise Resource Planning): business: orders, inventory, finance.
Key principle: time and trust decrease as you go up. The bottom reacts in milliseconds and must never fail; the top plans in days. A network glitch at L4 shouldn't stop a motor at L1. This separation is also a safety and security boundary.
SCADA vs HMI:
- HMI (Human-Machine Interface): the local screen/panel on a machine.
- SCADA (Supervisory Control And Data Acquisition): the wider system that collects data from many PLCs/sites, displays it centrally, logs history, and raises alarms.
Why it exists. A factory has thousands of devices and decisions spanning milliseconds to weeks; without a clear structure it becomes an unmanageable, unsafe tangle. The automation pyramid is the map (which layer does what, how fast, and who talks to whom) so control, supervision, and business each stay in their lane.
Mental model. A restaurant. L0 = ingredients and the stove. L1 = the line cooks following recipes precisely and fast. L2 = the head chef watching all stations. L3 = the shift manager scheduling orders. L4 = the owner deciding what's on the menu and ordering supplies. Each layer trusts the one below to execute.
Common misunderstandings.
- "Higher layers control the machines." Higher layers supervise and plan; the fast, must-never-fail control happens at L1. A glitch up at ERP must never stop a motor.
- "SCADA and HMI are the same thing." An HMI is the local panel on one machine; SCADA is the wider system gathering data from many PLCs/sites, logging history and alarms.
- "Every layer reacts in real time." Timescales grow up the pyramid. Milliseconds at the field, days at the top; only the bottom is hard real-time.
Connections. This layering frames the whole industrial half of the course: the PLC/DCS scan cycle is L1, SCADA/HMI is L2 (and the HMI+PLC+SCADA capstone), and the separation principle becomes the IT/OT security boundary (Turn 2's industrial-networks lesson) and the independence of safety systems (the functional-safety lesson).
BImmediate Active Recall
QUERYName the layers of the automation pyramid from bottom to top.
REVEAL
L0 Field devices (sensors/actuators) → L1 Control (PLC/DCS) → L2 Supervisory (SCADA/HMI) → L3 MES → L4 ERP.
QUERYHow do timescale and criticality change as you move up the pyramid?
REVEAL
Lower layers act in milliseconds and are safety-critical/real-time; higher layers act over hours-to-weeks and are about operations/business. Speed and real-time criticality decrease upward.
QUERYDifference between HMI and SCADA?
REVEAL
HMI is the local operator screen on a machine; SCADA is the broader supervisory system gathering data from many controllers/sites, with central display, historical logging, and alarms.
QUERYWhy is separating the layers good for safety and security?
REVEAL
A failure or attack at a higher/business layer shouldn't be able to disrupt fast, safety-critical control at the bottom. The boundary limits how problems propagate.
CConceptual Questions
Answer each in your own words in the box, then reveal the model answer to compare. These ask why, not how, and your answers are saved.
Why must a network glitch at L4 (the business/ERP layer) never be able to stop a motor at L1 (control)?
REVEAL MODEL ANSWER
Control is hard real-time and safety-critical; the business layer is slow and best-effort. If the two were tightly coupled, a non-critical IT problem (a slow database, a network storm) could halt production or even create a hazard. The layered separation isolates the fast, must-never-fail control edge from the slower upper layers, which is a safety and security boundary as much as an organisational one.
Distinguish SCADA from HMI.
REVEAL MODEL ANSWER
An HMI (Human-Machine Interface) is the local screen or panel on a specific machine, where an operator sees its state and enters setpoints. SCADA (Supervisory Control and Data Acquisition) is the wider system that gathers data from many PLCs or sites, displays it centrally, logs history/trends, and raises alarms. HMI is the local view; SCADA is plant- or enterprise-wide supervision.
Why does 'time and trust decrease as you go up' the pyramid?
REVEAL MODEL ANSWER
The bottom layers react in milliseconds and must never fail (they get the highest trust and hardest real-time requirements) while the top plans in days and tolerates delay. Because the control edge is the most critical, the architecture is built to protect it from the slower, less-critical upper layers, never the other way around.
DPractice Problems
P1 (easy). Which layer does a temperature transmitter belong to? A production schedule?
P2 (medium). An operator changes a tank's target level on a screen and watches a trend graph. Which layer are they at, and which layer actually holds the level?
P3 (harder). You are reviewing a plant's network drawing and find that the Level 1 controllers are on the same flat network as the office PCs, with no firewall between them.
List the specific consequences, in order of likelihood rather than severity. For each, name the mechanism. Then give the minimum remediation that could be done without a plant outage, and the part that requires one.
Solutionsclick to reveal
P1. Temperature transmitter → L0 (field device). Production schedule → L3 (MES).
P2. The operator is at L2 (SCADA/HMI), supervising and setting the setpoint. The L1 controller (PLC/DCS) actually executes the real-time loop that holds the level.
P3. The consequences, most likely first.
1. Broadcast and multicast traffic degrading control communications. A flat network carries every broadcast to every node. Office networks produce a great deal of it: name resolution, discovery protocols, printer announcements, backup agents. A controller's network interface has a small buffer and a real-time task; a broadcast storm from a misconfigured office switch fills that buffer and delays or drops cyclic control traffic.
Mechanism: ordinary traffic, no malice required. This is the one that happens first and happens repeatedly, and it presents as intermittent I/O faults and comms timeouts that nobody can reproduce.
2. An address conflict. Someone on the office side connects a device with a static address that duplicates a controller's. The controller loses communication with its I/O.
Mechanism: a person doing something ordinary on a network they did not know was shared.
3. Accidental discovery and connection. An engineering tool, a network scanner, a vulnerability scanner run by IT as a matter of routine policy. Many industrial protocols respond to scans badly: a scan that is harmless to a server can put a controller into a fault state, because the protocol stack was never designed to receive malformed or unexpected traffic.
Mechanism: IT doing its job on what it believes is an IT network.
4. Unauthorised change. The engineering software can reach every controller from any office PC. Anyone with the software and the network can go online, force an output, or download a program. There is no technical control preventing it, only the fact that most people do not know how.
5. Malware reaching the controllers. An office PC is infected by the ordinary route (email, a web page, a USB stick). Commodity ransomware does not target controllers, but it does scan and encrypt everything reachable, and it will find the HMI PCs and the engineering workstation, which are ordinary Windows machines.
Mechanism: the same infection that would be an IT incident becomes a plant outage, because the plant is inside the blast radius.
6. A targeted attack. Least likely, and the only one people think of first. Its consequence is the most severe, and it is worth noting that every one of the five above can stop the plant without anyone intending to.
What can be remediated without a plant outage.
Put a firewall in, in transparent or bridge mode, at the boundary. A transparent firewall does not require re-addressing anything: it sits in the path, learns the traffic, and can be placed in monitor mode first. Once the legitimate traffic is known, the rules are tightened. This is the single highest-value change and it can usually be done live, or with a few seconds of interruption when the cable is moved.
VLAN the switches. If the switches are managed, separating the control devices into their own VLAN is a configuration change per port, done one port at a time.
Remove the engineering software from general office PCs, and restrict it to a named machine with individual accounts. Administrative, immediate, free.
Disable unused switch ports, and turn on port security so an unknown device cannot simply be plugged in.
Stop IT's automated scanning from reaching the control range, which is usually a one-line exclusion in their scanner's configuration and which nobody has asked for because nobody told IT the range existed.
What requires an outage.
Re-addressing. If the control devices sit in the same subnet as the office, proper segmentation eventually means giving them their own range, and every controller, HMI, I/O node and drive has to be changed, along with every hard-coded address inside the PLC programs. That last part is what makes it an outage rather than an evening's work: addresses appear inside message instructions, in HMI tag definitions, and in third-party machine configurations that the vendor has to change.
Inserting a routed firewall rather than a transparent one, because that changes the path and the addressing.
Separating the physical network, if the control traffic must leave the shared cabling entirely.
Adding a DMZ, with the historian mirror and a jump host, which means moving servers and re-pointing the clients that read from them.
The sequencing advice that follows: do the no-outage items now, this week, because they remove the five most likely consequences. Then plan the re-addressing for the next scheduled shutdown, with the programs audited for hard-coded addresses beforehand. The common failure is the opposite: the full segmentation is designed, it requires an outage, the outage is deferred, and the plant runs flat for another two years while a perfect design sits in a folder.
EFeynman Exercise
Explain the automation pyramid to a beginner with the restaurant analogy. Match each kitchen role to a layer and say what timescale it works on. Then explain why "the owner deciding the menu" should never be able to directly burn the food. I.e., why the layers are kept separate.
REVEAL MODEL ANSWER
The pyramid is like a company's org chart. The people on the shop floor react to what's happening this very second. A part jams, they stop the line. Their supervisors watch several machines over the shift. Managers plan the week's production, and executives think in quarters. Information and instructions pass mostly between adjacent levels, and if the executives' email goes down, the shop floor keeps running. The fast, vital work at the bottom never waits on the slow planning at the top.
FError Analysis Framework
- Flattening the layers. Why: convenience. Recognise: business systems wired straight to controllers. Avoid: segment networks; respect the hierarchy.
- Confusing SCADA with control. Why: both "control rooms." Recognise: expecting SCADA to do millisecond loops. Avoid: SCADA supervises; PLC/DCS controls.
- HMI vs SCADA mix-up. Why: both are screens. Recognise: scoping a single panel as a plant-wide system. Avoid: HMI = local, SCADA = system-wide.
- Ignoring timescale. Why: treating all data as urgent. Recognise: overloading control networks with reporting traffic. Avoid: match data flow to layer timescale.
GMini Challenge
For a packaging line, place each on the pyramid and name its layer: a proximity sensor, a PLC running the fill sequence, an operator screen showing alarms, and the system that schedules today's production orders. Then say why the bottom must not depend on the top.
REVEAL MODEL ANSWER
Proximity sensor -> L0 (field). PLC running the fill sequence -> L1 (control), millisecond real-time. Operator alarm screen -> L2 (SCADA/HMI), supervisory, seconds. Production-order scheduling -> L3 (MES) (or L4 ERP for the business order itself). The bottom must not depend on the top because L0/L1 are real-time and safety-critical: a slow or failed business/IT layer must never be able to stall the machine or compromise safety. Control has to keep running even if everything above it is down.
Quiz Check
A quick auto-graded check, separate from the recall cards above. Your score is pooled with the recall cards into this module's Mastery score, and completing this lesson requires the quiz submitted with pooled mastery at 80% or above.