End-to-End OT Delivery for a Greenfield Waste Processing Facility
- GPA
- Jun 30
- 4 min read
A large-scale greenfield waste processing facility needed a secure, scalable Operational Technology (OT) environment to support continuous industrial operations, centralized visibility, and long-term growth.
Because the facility was being built from the ground up, the OT infrastructure had to do more than connect equipment. It needed to provide a reliable foundation for plant-wide control, monitoring, cybersecurity, remote access, Manufacturing Intelligence, and future system expansion.
GPA delivered the complete OT infrastructure foundation, including Cisco-based industrial networking, Rockwell-aligned switching, VMware virtualized compute infrastructure, ThinManager-based HMI delivery, connectivity standards, backup and recovery support, and lifecycle documentation.
Challenge
The facility required modern OT architecture capable of supporting continuous process manufacturing while maintaining secure separation between business systems, control systems, vendor equipment, and plant operations.
Key requirements included:
Operational reliability: The OT environment needed to reduce single points of failure and support reliable plant operations.
Secure IT/OT convergence: The architecture needed to connect virtualized infrastructure, operations systems, and enterprise-adjacent systems while maintaining appropriate separation between IT and OT environments.
Multi-vendor integration: OEM control systems, packaged equipment, PLCs, HMIs, remote I/O, and plant infrastructure needed to work together within a unified OT network.
Long-term maintainability: The facility needed standardized configurations, backup and recovery procedures, clear documentation, and supportable infrastructure for future operations.
Solution
GPA implemented a layered OT architecture combining industrial networking, resilient ring topology, virtualized compute, centralized HMI delivery, and structured lifecycle support.
Industrial Network Architecture
The OT backbone was built using enterprise-grade industrial switching in a structured core/distribution architecture. GPA configured the Layer 2 switching environment to support high-speed uplinks, VLAN distribution, fiber backbone connectivity, and segmented communication across the facility. This improved OT connectivity while relying on the facility-provided high-availability firewall pair for routing and Layer 3 separation.
The design aligned with Purdue Model principles as a functional reference point and incorporated IEC 62443-style segmentation to separate key areas of the plant environment, including:
Control-level devices, including PLCs, controllers, and real-time equipment
Operator access, HMI clients, engineering workstations, and operational tools
Virtualized infrastructure, data services, and authentication systems
Perimeter/DMZ pathways for secure access and monitoring
Vendor/OEM equipment segments using Layer 2 isolated networks
The design used IEC 62443-style segmentation, segregated VLAN and subnetting schemes, dedicated management networks, and separation of routable and non-routable traffic domains. This created a more secure, structured OT environment while supporting reliable control system communication.
Resilient OT Connectivity
To strengthen operational resilience, GPA implemented a hybrid network redundancy model using Cisco Resilient Ethernet Protocol (REP) and Device Level Ring (DLR). Cisco REP supported redundant backbone connectivity across plant-wide networks, while DLR provided fault-tolerant communication for Rockwell/Allen-Bradley EtherNet/IP environments at the machine and control panel level.
GPA also configured industrial ethernet switches across remote I/O panels, control cabinets, and vendor equipment enclosures. Standardized switch configurations, fiber backbone connectivity, VLAN trunking, EtherNet/IP traffic prioritization, and documented recovery methods helped simplify support and reduce downtime risk.
Virtualized OT Compute Platform
GPA deployed a centralized OT compute platform using a fault-tolerant industrial server platform with VMware virtualization.
The platform included VMware ESXi, vCenter Server Appliance, redundant SAN architecture with dual controllers, and hardware-level redundancy including lockstep CPUs and mirrored components. Virtual machines were deployed to support:
Active Directory domain controllers
FactoryTalk-based HMI servers
Data historians for process data collection and storage
Data acquisition and communication servers
Remote Desktop Session Hosts
Engineering workstations
Network monitoring and OT cybersecurity tooling
This virtualized architecture provided high availability, workload isolation, centralized management, and a scalable foundation for future operational systems.
Centralized HMI Delivery and Lifecycle Support
The facility adopted a ThinManager-based thin-client architecture commonly used in Rockwell environments. Thin clients booted through PXE and were centrally managed by redundant ThinManager servers. Session delivery was provided through Microsoft Remote Desktop Services (RDS), with support for VNC connections to panel-level HMIs.
This model improved replacement speed, simplified configuration management, and gave operations, engineering, and management teams more flexible access to the systems they needed.
To support long-term maintainability, GPA also incorporated backup and recovery tooling, automated switch backups, NAS-integrated scheduled backups, virtual machine recovery, SNMP-based monitoring, SD-card-based switch restoration, and lifecycle documentation.
Results
GPA delivered a high-performance, standards-aligned OT infrastructure platform for a modern greenfield waste processing facility.
Improved operational resilience: Redundant core switching, Cisco REP, Device Level Ring, resilient industrial switching, and fault-tolerant compute infrastructure reduced downtime risk across network, compute, and storage layers.
Stronger cybersecurity foundation: Purdue Model alignment, IEC 62443-style segmentation, VLAN structure, Perimeter/DMZ design, dedicated management networks, and OT cybersecurity tooling created a more secure and structured control environment.
Greater scalability: Structured IP addressing, VLAN segmentation, virtualized infrastructure, single-mode fiber backbone, and standardized connectivity created a foundation for future system additions, Manufacturing Intelligence, remote access, advanced analytics, and cybersecurity integration.
Simplified maintenance: ThinManager-based HMI delivery, centralized backups, standardized switch configurations, SD-card recovery, SNMP-based monitoring, and documentation reduced endpoint complexity and improved lifecycle support.
Conclusion
GPA delivered a fully integrated Operational Technology infrastructure platform that gave the facility a reliable foundation for continuous operations, secure IT/OT convergence, Manufacturing Intelligence, remote access, OT cybersecurity, and future plant-wide growth.
By combining Cisco-based industrial networking, Rockwell-aligned EtherNet/IP switching, VMware virtualization, ThinManager-based HMI delivery, backup and recovery support, and lifecycle documentation, GPA helped the facility move from greenfield construction to a secure, scalable, and maintainable OT operating environment.
