The Purdue Enterprise Reference Architecture - often just called the Purdue model - organizes industrial networks into levels from the physical process up to the enterprise. It is not a law, but it is the clearest mental model for deciding where firewalls, DMZs, and data flows belong.
The Levels at a Glance
- Level 0 - physical process: sensors, actuators, motors.
- Level 1 - basic control: PLCs, RTUs, drives, safety controllers.
- Level 2 - supervisory: HMIs, engineering workstations, SCADA servers.
- Level 3 - site operations: historians, batch management, asset management, OT monitoring.
- Level 3.5 (DMZ) - the demilitarized zone: shared services such as patch repositories, remote access jump hosts, and data mirrors.
- Level 4 - enterprise IT: ERP, office networks, cloud services.
Why the DMZ Matters
Direct connections between Level 3 and Level 4 are the single most common architectural mistake in older plants. The DMZ breaks that path: enterprise users reach only mirrored, read-only services, and OT systems never accept inbound connections from IT. This is the pattern IEC 62443 and most vendors recommend.
Common Pitfalls
- Placing the historian on the IT side and letting IT poll OT devices directly - keep acquisition on OT, mirror to the DMZ.
- Flat networks where a compromised HMI can reach every PLC - segment by cell or process area.
- Treating the model as a checklist - smaller plants legitimately collapse levels, but the security boundaries between process, operations, and enterprise should remain.