The Purdue Model: How ICS Is Organized

Finding Your Way Around a Plant

Imagine your first week at an industrial site you have never seen before. Someone mentions in passing that the HMI is at Level 2. Someone else says the historian sits at Level 3, and that nothing should cross from Level 4 into the control network without going through the DMZ. A drawing on the wall shows a stack of horizontal bands with equipment names in each one. Everyone else in the room seems to know exactly what these levels mean and why they matter, and they talk about them as casually as you might talk about the floors of an office building. What they are using is a shared map called the Purdue Model, and it is the most common way of describing how an industrial environment is organized. The reason a map is needed at all is that industrial control systems are not one thing. A working plant contains very different kinds of equipment, from valves and motors to controllers, operator screens, plant-wide software, and ordinary corporate IT, each with its own job, its own speed, and its own way of communicating. The Purdue Model sorts all of that into levels. Once you understand those levels, you can orient yourself in any industrial facility in the world, because nearly every one of them is described the same way. This chapter walks through the model one level at a time and then explains why it is built the way it is.

Where the Model Comes From

The Purdue Model takes its name from Purdue University, where it originated as part of the Purdue Enterprise Reference Architecture in the 1990s. It was later carried into the international standard for integrating business and control systems, known as ISA-95 (also published as IEC 62264), and it is now the reference framework used across the industrial automation industry. Vendors draw their architecture diagrams with it, engineers design plant networks around it, and security professionals use its levels as the starting point for deciding which systems should be allowed to talk to which. What makes it so durable is that it describes something real rather than imposing an arbitrary structure. Every industrial operation has a physical process at the bottom and a business at the top, and between the two there are layers of control and supervision that work at very different speeds. The model gives each of those layers a number and a clear job description. That is all it is: a set of labels for the layers that already exist. But because everyone uses the same labels, a phrase like "a Level 1 device" carries a great deal of meaning in very few words, and you will see those labels used throughout the rest of this book.

Five Levels, One Map

The Purdue Model divides an industrial control system into five levels, numbered from 0 to 4. At the bottom, Level 0 is the physical process itself: the motors, pumps, valves, and sensors that touch the real world. Level 1 is basic control, the first digital layer, where controllers read sensors and drive equipment automatically. Level 2 is supervisory control, where operators watch the process on screens and give it instructions. Level 3 is site operations, home to the systems that manage and record the plant as a whole. And at the top, Level 4 is enterprise IT, the corporate network with its business systems and email. Reading the stack from bottom to top, the systems become steadily less concerned with the physical process and more concerned with business, and steadily less real-time. Reading it from top to bottom, they become steadily closer to the physical world and steadily faster. The levels in between the process and the business are where control actually happens. As you work through the descriptions that follow, refer back to the figure below, which shows all five levels together with the boundary zone between Levels 3 and 4.

Level 0: The Physical Process

Level 0 is the real world. It is made up of the motors, pumps, valves, sensors, and actuators that physically interact with the process. This is where chlorine enters the water at a treatment plant, where fuel burns in the boiler at a power station, and where the conveyor carries the product along a factory line. Sensors at this level measure conditions such as temperature, pressure, flow, level, and position. Actuators, the devices that act on the physical world, open and close valves, start and stop motors, and move things. Level 0 does not compute anything. It does not decide, store, or analyze. It acts, and it reports what it measures. Everything in the levels above exists, in the end, to monitor and control what happens here, and that is worth keeping in mind whenever you look at the upper levels of the model. A sophisticated business system at Level 4 and a supervisory screen at Level 2 matter only because of the physical events at Level 0 that they ultimately influence. Chapter 8 looks at sensors and actuators in detail, including how their signals travel to the level above.

Level 1: Basic Control

Level 1 is the first digital layer, and it is what makes automated control possible. The main devices here are programmable logic controllers (PLCs), rugged industrial computers built to run a control program reliably for years, which are the subject of Chapter 5. Other controllers live at this level too, including the remote units described in Chapter 8 and the safety instrumented system from Chapter 2. A Level 1 controller reads sensor data from Level 0, applies its logic, and sends control signals back down. The logic can be very simple. A PLC might hold a rule such as: if tank pressure exceeds 90 PSI, close valve V-12. What makes Level 1 special is not the complexity of the rule but the way it is carried out. That logic runs in milliseconds, continuously, around the clock, without a human in the loop. Nobody has to notice the pressure rising, and nobody has to press a button. The controller sees the reading and acts on it, again and again, faster than any person could. If the levels above were switched off, a well-designed Level 1 would keep the process under basic control on its own, which is a good way to understand how central it is.

Level 2: Supervisory Control

Level 2 is where people interact with the system. The operator's screens are here, known as HMIs (human-machine interfaces), which display the live process and accept the operator's commands. So is SCADA (supervisory control and data acquisition) software, which supervises equipment at many sites from a single location. Both are explained in full in Chapter 6. The important idea at this level is the division of labor between supervision and execution. An operator at Level 2 decides what the process should do: set a pump to run, or raise a temperature setpoint, the target value a controller works to hold. The PLC at Level 1 then does it, making the moment-by-moment adjustments needed to reach and hold that target. Level 2 handles supervision. Level 1 handles execution. This is also the level where familiar computing starts to appear. The operator workstations and servers here commonly run ordinary Windows-based operating systems, which is a noticeable change from the specialized controllers below. And the pace slows down. Where Level 1 thinks in milliseconds, Level 2 works on a scale of seconds to hours, matching the rhythm of a person watching and adjusting a process.

Levels 3 and 4: Operations and Enterprise

Level 3 covers site operations, the systems that look after the plant as a whole rather than any single piece of equipment. Here you find engineering workstations, the computers engineers use to program and configure controllers, and data historians, software that logs process values over time, both described in Chapter 8. You also find the manufacturing execution system (MES), plant-wide software that manages and tracks production: what is being made, on which line, and to what standard. Level 3 works on a time scale of shifts and days. Level 4 is enterprise IT: the corporate network, email, analytics, and ERP (enterprise resource planning) systems, the business software that handles orders, inventory, and finance. Its time scale is weeks to years. Levels 3 and 4 are often discussed together because they share the most important boundary in any industrial control system. Below that line is the OT world, where systems exist to run the physical process. Above it is the IT world, where systems exist to run the business. Everything at Level 3 and below is part of operations, even when it looks like ordinary computing. Everything at Level 4 is corporate IT, even when its job is to plan what the plant will produce.

The Boundary Between OT and IT

Because the line between Level 3 and Level 4 separates two worlds with very different priorities, it is rarely left as a simple line. In most modern architectures it is widened into a buffer zone of its own, called the DMZ (a term borrowed from the military "demilitarized zone") and often labeled Level 3.5. The DMZ was not part of the original Purdue Model. It was added later, as plants and corporate networks became more connected and a direct link between them came to be seen as too risky. Its purpose is to make sure that the IT network and the OT network never talk to each other directly. Data that the business needs from the plant, such as production figures, is passed up into the DMZ, and the business collects it from there. Instructions and files that need to reach the plant arrive in the DMZ first and are passed down under control. Nothing travels straight through. You may also see diagrams that add a Level 5 at the very top, representing the internet and other external connections. That level is a common addition by security practitioners rather than part of the formal model, which defines Levels 0 to 4. When people describe the Level 3 to Level 4 boundary as the critical line in any industrial control system, this is what they mean: it is where the world of physical consequence meets the world of business data.

Why the Model Is Built This Way

The Purdue Model separates systems by function and by criticality, and both reasons come straight from the priorities in Chapter 2. A change at Level 0 or Level 1 has immediate physical consequences: alter a controller's logic or the position of a valve and the process responds within seconds. A change at Level 4 affects business systems, not the physical process. Grouping systems by how directly they touch the process keeps the most dangerous changes confined to the levels where they are expected and controlled. Time is the other reason. A valve that needs to respond in milliseconds cannot wait for a business database query to finish, so separating the levels lets each one run at its own tempo without the slowness of business IT bleeding into the speed of physical control. Keeping the levels separate is therefore an engineering requirement, not a preference. Safety-critical control systems need to be isolated from business network traffic, because that isolation is part of what keeps a running process stable. The model was designed first as an operational architecture for exactly these reasons, and only later did security professionals adopt it as their guide for dividing networks into protected zones, a use Chapter 13 returns to.

You Have the Map Now

Go back to that first week at an unfamiliar site. When someone says the HMI is at Level 2, you now know what that means: it is a supervisory screen where operators watch the process and give instructions that the Level 1 controllers carry out. When someone says the historian is at Level 3, you know it belongs to site operations, recording the plant over time. And when someone says the Level 3 to Level 4 boundary is the critical line in any industrial control system, you know why: it divides systems that run a physical process from systems that run a business, and the DMZ exists so that nothing crosses that line directly. The Purdue Model is not just an academic diagram. It is the reference structure for nearly every industrial facility you will encounter, and the levels it defines will be used throughout the rest of this book as a shorthand for where things live. When Part 2 introduces each component, the first question worth asking is which level it sits on, because the answer already tells you a great deal about how fast it works, what it talks to, and what happens if it fails.

What's Next

The Purdue Model shows you how an industrial environment is organized on paper. Chapter 4 takes you inside it, to the place where the levels meet a human being: the control room. You will see what an operator actually looks at, what they do during a shift, and why the way operators think matters to anyone who wants to work with industrial systems.

Reflect

• For a facility you know, which pieces of equipment or software would you place at each of the five levels, and which ones are you unsure about?
• Where in your organization does the boundary between the plant network and the corporate network actually sit, and is there a DMZ between them?
• What would change if a business system at Level 4 could send instructions directly to a controller at Level 1?
• When you next see an architecture diagram of an industrial system, how quickly could you identify which level each component belongs to?