What Is the Purdue Model?

The Purdue model is a reference architecture that arranges the computers and networks of an industrial site into numbered levels, from the physical process at the bottom to the enterprise at the top. Its full name is the Purdue Enterprise Reference Architecture (PERA). It came out of work led by Theodore J. Williams and an industry consortium at Purdue University in the late 1980s and early 1990s, and the ISA-95 standard for integrating control and business systems later adopted its hierarchy.

The model was written to describe how manufacturing systems fit together, not as a security standard. It became the common map for industrial network security because each level has a clear job, and traffic between levels can be limited to what that job needs. Security teams use it to decide where to put boundaries, and it is the usual starting point for the zones and conduits described in IEC 62443.

Our FAQ on IT vs OT uses the model to show where business IT ends and operational technology begins. This page goes level by level.

Most diagrams show six levels and an industrial DMZ. The lower levels are the OT zone, the upper levels are the IT or enterprise zone, and the DMZ sits between them.

Some versions merge Levels 4 and 5, and many show safety instrumented systems as a separate zone beside Levels 0 and 1, because a safety system should keep working even if the control network is compromised.

The most important boundary in the model sits between Level 3 and Level 4. An industrial DMZ (demilitarised zone) is a separate network segment, bounded by firewalls on both sides, where IT and OT exchange data without talking to each other directly.

Network segmentation means splitting one flat network into smaller segments and controlling what can pass between them. In a Purdue design, each level, and often each production cell within a level, becomes its own segment.

Inside the OT zone, segments are usually built with VLANs on managed industrial switches, with access control lists or a firewall deciding which protocols may cross between them. Our managed switches almost all list IEEE 802.1Q VLANs, and many list access control lists and IEEE 802.1X port authentication. Between OT and IT, a firewall pair or data diode usually guards the DMZ.

At the edge of a cell, industrial IoT gateways with separate network controllers can read data from the machines on one port and publish selected values upward on another, so the cell network is never bridged to the level above.

The model is more than 30 years old, and modern plants do not always fit it. Sensors that send data straight to the cloud, wireless devices, remote PLC programming and edge AI computers can all cut across the levels. Critics argue that a strict hierarchy does not describe how data really flows.

In practice, most security teams keep the Purdue levels as the map and add newer methods on top: IEC 62443 zones and conduits defined by risk rather than by level, zero trust principles for users and devices, and monitoring of the traffic that does cross a boundary. The model remains the shared language between control engineers, IT and auditors, and it is still the quickest way to explain to a new supplier which network a device will join and what it may talk to.

We supply the panel PCs, industrial computers, gateways and managed switches that sit at Levels 0 to 3, with network interfaces, VLANs and security features configured as standard for the zone each one serves.