Office IT tolerates a little delay. OT (Operational Technology) — PLCs, SCADA, HMIs on the factory floor — does not. Put them on one flat network and a camera firmware download can stall a conveyor.
Control VLAN: PLC/SCADA/HMI only. No office PCs, no cameras.
Camera VLAN: video streams, bandwidth-heavy but not time-critical.
Office VLAN: PCs and printers.
Management VLAN: switch Web/CLI/SSH, isolated from all user traffic.
On the control VLAN, tag PLC/SCADA traffic at the highest 802.1p priority (see What is QoS?) so control commands are never queued behind a video frame. This is the core of deterministic industrial networking.
Different VLANs still need to exchange data (HMI reads PLC, SCADA logs to server). Use a Layer-3 switch or firewall as gateway — exactly the inter-VLAN routing pattern.
Management VLAN carried on a trunk with a non-default native VLAN.
VLAN + QoS turns one industrial switch into a safe, deterministic OT network: isolate control traffic, prioritize it, and keep management out of the way. Rayin industrial switches and Mini OLT support this out of the box — see industrial switch solutions. Full VLAN basics: VLAN definition guide.
