01 Opportunity
The plant had grown the way most plants do — one machine at a time, over years. Each new machine arrived as its own little world: its own PLC, its own dedicated SCADA PC bolted to the wall, its own small network, and its own printer for that machine's reports. Fifteen machines later, the control room held fifteen of everything.
The result was a tangle. Network cables ran everywhere with no clear plan, fifteen ageing PCs each had to be patched and nursed separately, and if one of them died, getting the machine running again meant rebuilding a computer from memory. None of the machines could see each other, and there was no single, safe point where the business could read what the whole floor was doing. It worked — but it was fragile, messy, and impossible to secure properly.
The brief had a hard constraint: touch the machines as little as possible, and don't stop production. These were working machines earning their keep every shift. Re-programming them or taking the floor down for a network overhaul was off the table.
02 Solution
We rebuilt the foundation underneath the plant without disturbing the machines on top of it. Four moves, each chosen so the machines themselves barely noticed.
One network, properly segmented. The fifteen separate machine networks were brought onto a single managed network, with each machine given its own isolated lane (a VLAN). The cabling collapsed from a cabinet-full of unplanned runs into one tidy, documented structure — but the machines stay logically separated, so they still can't interfere with one another.
Machines keep their own addresses. Packaged machines almost always ship using the same default network addresses, which clash the moment you put them on one network. Rather than re-program fifteen machines — exactly what we were asked not to do — we used address translation (NAT) at the network edge, on a Siemens industrial firewall. Each machine keeps the addresses it left the factory with; the firewall presents each one to the wider plant under its own unique address. No machine changes.
SCADA, virtualised. Each machine's SCADA PC was moved into a virtual machine — a complete, portable image of the computer that runs on standard hardware. We keep a master image and the SCADA project files under version control, and take a snapshot before any change so it can be rolled straight back. If a PC fails, the same image is restored onto replacement hardware in minutes, instead of someone rebuilding Windows and the application by hand and hoping it matches.
Security in layers. A Siemens industrial firewall sits at the boundary between the plant network and the wider business network, controlling exactly what is allowed across. Behind it, each individual machine sits behind its own industrial firewall — so even inside the plant, one machine can't be used as a way to reach the others. On top of that we put network time synchronisation across the whole fabric (so every record and every clock agrees) and continuous monitoring, so unusual traffic is seen rather than missed.
Finally, the obvious tidy-up: the fifteen separate printers became one shared network printer for the whole floor.
All of it was rolled out one machine at a time, in parallel with normal production. A machine's SCADA was prepared as a virtual image and its network lane set up ahead of time, then cut over in a short, planned window with the old setup kept ready as a fallback — before moving on to the next machine.
03 Outcome
The control room went from fifteen of everything to one of each — one network, one set of virtualised PCs managed as images, one printer — and not a single shift was lost doing it. The cable tangle is gone, replaced by a documented structure anyone can follow.
Day to day, the difference shows up where it matters. A dead SCADA PC is no longer a crisis — its image is restored onto new hardware and the machine is back, fast. The machines were never re-programmed, so there was no risk to proven, running production logic. And for the first time there is one secured point where the business can safely see the whole floor, protected by a firewall at the boundary and a firewall in front of every machine.
It's the same philosophy we bring to every plant: change the foundation, not the machines. Tidy the network, virtualise what's fragile, secure it in layers, and do it without ever stopping the line.
04 Project highlights
- Fifteen separate machine networks brought onto one VLAN-segmented network — order instead of a tangle of cables
- Every SCADA PC virtualised, so a failed machine is restored from a saved image in minutes, not rebuilt from scratch
- Each machine keeps its original IP addresses — no re-programming the machines — using NAT at the network edge
- Two layers of industrial firewall: one at the IT/OT boundary, and one in front of every individual machine
- Shared services done once: a single network printer for all fifteen machines
- Network time synchronisation and continuous monitoring across the whole fabric
- Delivered machine by machine, alongside live production — not a single stoppage