Industrial Control System Security

Industrial Control System Security

I booked a vacation several months ago that conflicted with Hannover Messe. I missed the usually chilly and damp north of Germany in favor of the definitely chilly and damp Pacific Northwest.

Many announcements from Hannover reached me anyway, though, so I’ll be going through a few this week. First up concerns using the new CIP Security protocol from ODVA. This one from Rockwell Automation.

This release talks about Rockwell’s developing solutions toward closing a cybersecurity opening within industrial automation communication.

“As the world’s leading company focused on combining industrial automation with digital technology, we’re uniquely positioned to help close security gaps in connected operations,” said Megan Samford, director of product security, Rockwell Automation. “Our new offerings with built-in security deliver the industry’s best available protection of control-level traffic. This can give users confidence that the integrity of their systems and their device-to-device communications are protected from day one.”

The Allen-Bradley ControlLogix EtherNet/IP communication module is among the first industrial devices to use the CIP Security protocol from ODVA. The protocol helps make sure only authorized devices are connected in industrial operations. It also helps prevent tampering or interference with communications between those devices. CIP Security is the first industrial automation protocol to support transport layer security (TLS), the most proven security standard available.

Also, the newly enhanced Allen-Bradley ControlLogix 5580 controller is the world’s first controller to be certified compliant with today’s most robust control system security standard, IEC 62443-4-2. The standard defines the technical security requirements for industrial automation and control system components. This certification builds on the 2018 certification of the Rockwell Automation Security Development Lifecycle (SDL) to the IEC 62443-4-1 standard.

Flow Chart Programming Editor Adds IEC61131

Flow Chart Programming Editor Adds IEC61131

Programmers of machine control in the US still stick with the old Ladder Diagram editor, so Opto 22 adds it to its groov EPIC controller. This is sort of the outlier of the things I learned at last weeks’s ARC Industry Forum in Orlando. Most of my interviews were either cyber security or HMI/SCADA it seems. I had wall-to-wall meetings and then travel. So, I’m just catching up on thoughts.

Somewhere around 25-30 years ago I could program (not proficiently, but turn out work anyway) in BASIC, C, C++, Java, Pascal. Then I ran into Ladder Logic. Why would anyone do this, I exclaimed! In the US all this time later, it’s Ladder or nothing in much of the country. Maybe the millennials can move this forward???

Recognizing this fact of life, the prototypical flow chart programming company, Opto 22 has added a free software upgrade with standard IEC 61131-3 programming methods.

Opto says, “Adding these new programming options to the existing flowchart and custom user-written options in groov EPIC gives control engineers the ability to program using a variety of languages they already know, while taking advantage of the EPIC’s extended capabilities for automation and industrial internet of things (IIoT) applications. All IEC 61131-3 standard languages are supported by groov EPIC, including Function Block Diagram (FBD), Structured Text (ST), Sequential Function Charts (SFC), and Ladder Diagram (LD).”

Engineers can mix and match several software tools to build control and IIoT solutions on one unified platform. Plus companies can continue to leverage existing employee knowledge in IEC 61131-3 programming methods, including decades-old ladder logic.

The PC-based CODESYS® Development System V3 is used to create and compile IEC 61131-3 programs for download to a pre-installed CODESYS Runtime running on groov EPIC. The CODESYS Development System is available at no charge from the CODESYS Store. The CODESYS Runtime on groov EPIC is enabled by a free software license available from Opto 22.

“As the world’s leading manufacturer of independent IEC 61131-3 software,” stated Markus Bachmann, President of the U.S. subsidiary of the CODESYS Group, “we are excited that CODESYS has been chosen to boost Opto 22’s groov EPIC to the next level in industrial automation products, integrating state-of-the-art industrial control with new IIoT and Industry 4.0 applications.”

In addition to IEC 61131-3, groov EPIC can also be programmed using Opto 22’s native PAC Control. Field-proven, flowchart-based PAC Control with optional scripting offers 400+ plain English commands for analog process and digital sequential control, complex math, conditional branching, string handling, and other complex functions.

Other programming options include using software languages supported on the Linux operating system through secure shell. This access—along with toolchains and interpreters for Java, C/C++, Python, JavaScript/Node.js and more—allows developers to create custom applications. In addition, groov EPIC includes Node-RED as another programming option. Node-RED uses a flow-based development environment optimized for edge data processing and communications.

Integrated HMI

groov EPIC integrates the easy-to-use HMI software groov View with its control programs. Once an IEC-61131-3, PAC Control, or custom software application is developed, the control program’s tags and I/O are available for building a groov View HMI. Data from other systems and equipment on premises, at remote locations, and in the cloud can also be included in the HMI. The drag-drop-tag HMI construction is quick, security is built in, and trending and user notifications are included.

Authorized users can view this HMI to see data and control processes on the integral, industrial-grade color touchscreen display on the front of the EPIC processor. They can also view the HMI on an external HDMI monitor, and from any web browser or mobile device.

Free Product Upgrade

To take advantage of this new programming option, current groov EPIC owners can simply install a free upgrade. As with all quarterly upgrades to groov EPIC since its introduction in February 2018, this upgrade requires only a software download. Unlike all other industrial automation products and platforms, groov EPIC is improved quarterly based on user feedback, with no need to replace existing hardware. These software upgrades provide significant performance improvements and protect user hardware investments, all at little or no cost. The groov EPIC system can change with you as your application grows or changes.

groov EPIC System

Based on Opto 22’s 45 years of experience as an automation manufacturer, the groov EPIC system merges tough industrial hardware with open protocols and standards to provide an ideal system for both automation and IIoT applications. Built to withstand conditions at the edge of networks in factories and remote locations, EPIC is approved for use by UL in hazardous locations and is ATEX compliant. EPIC can be used to collect, process, view and exchange data where it is produced, and this data can then be securely shared among databases, cloud services, PLC systems and other components. In recognition of its unique capabilities, groov EPIC won the 2019 Control Engineering Engineers’ Choice Award in the Industrial Internet of Things Connectivity category.

Long Delayed Beckhoff Automation News from SPS

Long Delayed Beckhoff Automation News from SPS

I’m finally catching up on news from past trips. I stopped by the Beckhoff Automation booth at SPS in Nuremberg last November and chatted for about an hour over all the displays. Here is a sampling.

TwinSAFE: modular, scalable and distributed safety applications

The ability to distribute the intelligence of an entire safety application across multiple TwinSAFE Logic-capable I/O modules enables the flexible implementation of increasingly modular architectures that can be adapted to given system requirements even more effectively than before.

It is possible to adapt the TwinSAFE system even more specifically to the individual requirements of a machine concept as well as to a broader spectrum of safety applications. The new I/O components include:

– TwinSAFE EtherCAT Terminal EL1918: digital terminal with eight safe inputs

– TwinSAFE EtherCAT Terminal EL2911: safe potential supply terminal with four safe inputs and one safe output

– TwinSAFE EtherCAT Box EP1957-0022: IP 67-protected digital combi module with eight safe inputs and four safe outputs

System-integrated and inexpensive precision measurement technology for efficient machines and test benches

ELM314x economy line of the EtherCAT measurement modules supplements the established ELM3x0x line with a lower cost 1 ksps class. This simplifies the use of the system-integrated precision measurement technology, which taps significant optimisation and efficiency potentials both in production machines and in inline test benches.

The new ELM314x measurement modules are available in 2, 4, 6 and 8-channel versions. High-precision measurements with an accuracy of 100 ppm are possible – and in a wide temperature range from 10 to 40 °C at that. Each channel of the measurement modules can be set to current or voltage measurements with a sampling rate of up to 1 ksps per channel. Analog signals in the ranges from ±1.25 to ±10 V, 0 to10 V, ±20 mA or 0/4 to 20 mA can be processed.

Typical application examples include part geometry measurement on the fly, as well as fast, but highly precise weighing procedures, e.g. in bottling plants. In general, the ELM314x EtherCAT measurement modules are ideal for recording data from 10 V/20 mA sensors and forfeeding real-time information directly back into the process.

CX7000 Embedded PC

The CX7000 Embedded PC opens up the convenience and efficiency of the TwinCAT 3 software environment to compact controllers. This enhances the scalability of PC-based control technology from Beckhoff – ranging from mini-PLCs to many-core Industrial PCs. An advanced 400 MHz processor and built-in configurable I/Os mean the Embedded PC delivers an optimum price/performance ratio.

Equipped with an ARM Cortex-M7 processor (32 bit, 400 MHz), the CX7000 Embedded PC makes considerably higher processing power available in the low-cost, compact controller segment. Furthermore, all the advantages of the TwinCAT 3 software generation can be utilised, while an extremely compact design with dimensions of just 49 x 100 x 72 mm ensures optimum scalability of PC-based control for small controller applications that typically require minimum footprint.

With multi-functional I/O channels directly integrated, the CX7000 assures excellent value for money:

  • 8 digital inputs, 24 V DC, 3 ms filter, type 3
  • 4 digital outputs, 24 V DC, 0.5 A, 1-wire technology

These integrated multi-functional I/Os can be configured for other operating modes via TwinCAT 3, enabling the option to use fast counting or processing of analog values:

  • counter mode: 1 x 100 kHz digital counter input, 1 x digital input as up/down counter, 2 x digital counter outputs
  • incremental encoder mode: 2 x digital inputs for 100 kHz encoder signal, 2 x digital encoder outputs
  • analog signal mode: 2 x digital inputs configured as analog inputs 0…10 V, 12 bit
  • PWM signal mode: 2 x digital outputs configured for PWM signal

EtherCAT G

The technology expansion EtherCAT G takes the high EtherCAT performance to the next level by delivering the Gigabit Ethernet speeds needed to support highly data-intensive applications. The latest technology expansion is not only compatible with the globally established 100 Mbit/s EtherCAT standard, but also provides the same familiar ease of use. In addition, the new branch controller model for EtherCAT G enables efficient operation of multiple network segments in parallel.

EtherCAT G supports standard Ethernet transmission rates of 1 Gbit/s; its EtherCAT G10 counterpart, already introduced as a proof-of-concept technology study, is even faster with data rates of 10 Gbit/s. The sharp increase in transmission rates beyond the standard 100 Mbit/s provided by EtherCAT significantly increases the possible data throughput. With propagation delay times through devices as a limiting factor on the one hand, but boosted by the newly introduced branch model on the other, EtherCAT G can deliver a two-to-sevenfold performance increase, depending on the application.

Hans Beckhoff, the company’s Managing Director comments: “EtherCAT G and G10 raise performance to entirely new levels that will enable our customers to build the best, highest-performing machinery in the world! EtherCAT G and G10 are not meant to replace the highly successful EtherCAT standard based on 100 Mbit/s Ethernet. The new performance levels are intended as system-compatible expansions.”

XPlanar: Flying Motion

Beckhoff is opening up new avenues in machine design with XPlanar. This is made possible by planar movers that float freely above arbitrarily arranged planar tiles and enable extremely flexible, precise and highly dynamic positioning. For machine builders this results in maximum flexibility and simplification in the design of machines and plants.

The XPlanar system combines the individual arrangement of planar tiles with the multi-dimensional positioning capability of the planar movers floating above them. The movers can be moved jerk-freeand contact-free in two dimensions at up to 4 m/s with 2 g acceleration and 50 µm positioning repeatability – and noiselessly and without abrasion.

The planar motor system is highly scalable to suit individual needs and considerably simplifies the design of machines and plants. Due to the maximum flexibility in mover positioning and the very high dynamics it is possible, for example, to divide product flows very simply and individually, so that previously necessary robots or inflexible mechanical devices can be efficiently replaced. The contact-free mover travel also eliminates wear, emissions and the carryover of contaminations.

The collision-free and synchronised movement of several movers with automatic path optimisation are further features provided by the TwinCAT automation software. The movement of several movers together in a group, for example, allows the maximum payload to be increased.

Advantech Quietly an Internet of Things Leader

Advantech Quietly an Internet of Things Leader

Advantech has been appearing on a variety of lists of prominent Internet of Things suppliers. The Taiwanese computer company with a US office in Cincinnati, OH and intellectual leadership, supplies intelligent I/O, a variety of computing devices, and HMI devices.

Several years ago I was privileged to be invited to Suzhou, China to attend Advantech’s user conference. It was an impressive event. This year they called it the “first IoT Co-Creation Summit.”

More than five thousand Advantech clients and partners from around the world attended the summit. Here Advantech introduced its newest IoT platform structure WISE-PaaS 3.0 and 32 IoT solution ready packages (SRPs) co-created with software and industry partners.

The event in itself will aid in the software/hardware integration for various industries, connect and build a complete industrial IoT ecosystem and value chain, and allow Advantech and partners to officially step into the next IoT stage.

Advantech Chairman KC Liu stated that in view of IoT application characteristic’s diversity and fragmented market, Advantech has assisted industries in integrating and connecting existing hardware and software and regards creating a complete industry value chain as its primary task in IoT industry development.

Advantech is introducing new features for its WISE-PaaS 3.0 and sharing a number of IoT solution ready packages (SRPs), based on WISE-PaaS, developed with numerous co-creation partners. The company is also outlining future co-creation strategies and schedules for the upcoming year.

Allan Yang, Chief Technology Officer at Advantech said, “While IoT is currently flourishing and many companies have invested in connectivity and data collection equipment, we are still in the early stages of generating value from IoT data. Since WISE-PaaS launched in 2014, Advantech has continued its integration and improved connectivity with open source communities. Our IoT software modules are developed to create operational cloud platform services oriented around the commercial value generated by data acquisition. Data-driven innovation has thus become the main target for our WISE-PaaS evolution.

WISE-PaaS 3.0 offers four main function modules:

  • WISE-PaaS/SaaS Composer: a cloud configuration tool with visible workflow. WISE-PaaS/SaaS Composer supports customized component plotting for simple and intuitive 3D modeling application and interaction. It updates views at millisecond rates and, together with WISE-PaaS/Dashboard, presents critical management data in a visually intuitive display to help extract valuable data and improve operational efficiency.
  • WISE-PaaS/AFS (AI Framework Service): an artificial intelligence training model and deployment service framework. The WISE-PaaS/AFS provides a simple drag and drop interface that allows developers to quickly input industrial data. When combined with AI algorithms, the service builds an effective inference engine with automatic deployment to edge computing platforms. AFS offers model accuracy management, model retraining, and automated redeployment. It simultaneously controls multiple AI models in the application field; offering automated model accuracy improvements and life-cycle management services.
  • WISE-PaaS/APM (Asset Performance Management): an equipment network connection remote maintenance service framework. WISE-PaaS/APM connects to a wide array of on-site industrial equipment controls and communication protocols. It supports the latest edge computing open standard, EdgeX Foundry, and includes built-in equipment management and workflow integration templates. Jointly with the AFS, APM accelerates Machine to Intelligence (M2I) application development.
  • Microservice development framework: WISE-PaaS contains a micro service development framework to help developers rapidly create program design frameworks while reducing development requisites. Micro service functions, such as service finding, load balancing, service administration, and configuration center, all offer built-in flexible support mechanisms.

Advantech recently established a water treatment system, jointly developed with GSD (China) Co., Ltd., and a CNC equipment remote operation service, jointly developed with Yeong Chin Machinery Industries Co. Ltd. Both partnerships demonstrate how industrial digital transformations, led by Advantech and its partners through the co-creation model, offer innovative win-win IoT solutions.

Advantech’s IIoT iAutomation Group has launched a broad selection of rackmount GPU Servers from 1U to 4U. The SKY-6000 GPU server series are powered by Intel Xeon scalable processors and each of these highly scalable GPU-optimized servers support up to five NVIDIA Tesla P4 GPUs. IPMI management functions and smart fan control ensure better temperature control and thermal management environments. Every GPU pair includes one high-speed PCIe slot for highly parallel applications like artificial intelligence (AI), deep learning, self-driving cars, smart city applications, health care, high performance computing, virtual reality, and much more.

AI Deep Learning GPU Solution

With support for up to five pcs of half-length half-height (HHHL) GPU cards or one full-height full-length (FHFL) double deck card, plus one full-height half-length (FHHL) GPU card, the SKY-6100 series are designed for NVidia Tesla P4 HHHL GPU cards, making it the best choice for deep learning applications.

IPMI Server Management

With IPMI 2.0 support, the SKY-6000 series allows users to monitor, manage, and control servers remotely and receive alerts if any sensors detect device or component faults. In addition, event logs record important information about the server which can be controlled remotely using the IPMI KVM.

Smart Fan Control

The optimized thermal design separates the CPU and GPU fan zones, making sure the GPU card is not preheated or thermally affected by any other heat source. Also, with the smart fan control mechanism, fan speeds are controlled based on different CPU and GPU workloads and ambient temperature. This feature lowers the acoustic noise of GPUs that have heavy loading but not CPUs. Advantech’s SKY-6000 server series are available for order now.

IMTS 2018 Features Variety of Manufacturing Technologies

IMTS 2018 Features Variety of Manufacturing Technologies

IMTS has been a huge show for many years. As you might expect from a trade show, the theme is broad. Exhibitors are a diverse lot. Things I saw indicating a new wave of technologies including machines designed to work with humans (so-called “cobots”) and various aspects of Industrial Internet of Things. Following are a few specifics.

Formerly the International Machine Tool Show and now the International Manufacturing Technology Show, the South Hall of Chicago’s McCormick Place is still filled with huge machining centers. The North Hall was packed with robotics, components, and other automation products. Much of this flows over to the East Hall where several aisles were devoted to Hannover Messe automation companies—my sweet spot. Even the West Hall was packed.

Beckhoff proclaimed, “Solve the IoT hardware, software and networking puzzle.”

The company introduced ultra-compact Industrial PCs (IPCs). These IPCs are Microsoft Azure Certified and can work just as easily with other major cloud platforms such as Amazon Web Services (AWS) and SAP HANA.

Significant updates will span three key areas of the TwinCAT software suite: new HTML5-enabled TwinCAT HMI for industrial displays and mobile devices, important data processing expansions in the TwinCAT Analytics offering, and TwinCAT 3 Motion Designer, which adds a deep set of valuable tools to commission entire motor, drive and mechanical systems in software. Motion Designer can be integrated into the standard TwinCAT 3 software platform or it can be used as a stand-alone motion system engineering tool.

EK1000 EtherCAT TSN Coupler expands the industrial Ethernet capabilities of the EtherCAT I/O system to utilize TSN (Time-Sensitive Networking) technology. The EK1000 enables communication among high-performance EtherCAT segments with remote EtherCAT controllers via heterogeneous Ethernet networks.

Ideagen plc, the UK-based software firm, announced the acquisition of American quality inspection software provider, InspectionXpert. Based in Raleigh, North Carolina, InspectionXpert currently generates $2.8 million in revenue and will bring more than 1,000 clients including Boeing, Kohler and Pratt & Whitney to Ideagen’s existing customer base.

Speaking at IMTS, Chicago, Ideagen CEO, Ben Dorks, said: “As well as significantly enhancing our manufacturing supply chain product suite, the acquisition of InspectionXpert provides Ideagen with a fantastic opportunity for growth by broadening upsell and cross-selling opportunities, increasing our customer footprint and expanding our geographical reach.”

InspectionXpert’s products, InspectionXpert and QualityXpert, enable organizations in the precision manufacturing industry and associated supply chains to simplify inspection planning, execution and reporting and general quality through digitalization of paper-based processes.

InspectionXpert and QualityXpert will be integrated into Ideagen’s existing software suite, which will enhance Software as a Service (SaaS) revenues and provide excellent opportunities for future growth.

Energid released Actin 5, an update to its robot software development kit (SDK). Called the industry’s only real-time adaptive motion control software, it allows robotic system developers to focus on the robot’s task rather than joint movement and paths. It responds in real time to sensory input and directs the robot on the most efficient path while avoiding collisions. The robot motion is updated dynamically without requiring reprogramming, even in dynamic, mission-critical environments.

Forcam develops software solutions in the area of MES, IIoT, and OEE. It leans into the trend of developing platforms. Its platform is built with open APIs with the latest programming languages and tools. It supports Microsoft Azure Cloud, SAP ERP, Maximo maintenance/asset applications, and Apple iPads for input. The platform helps reduce integration time and expense.

I came across the Dell Technologies booth in the automation hall. The big news was a collaboration with Tridium and Intel for IIoT solutions.

The IIoT solution is built on the Niagara Framework, Tridium’s open technology platform, and combines software and consulting services to help customers begin the digital transformation of their businesses.

The Niagara-based IIoT solution built with Dell and Intel technology will comprise a complete hardware and software stack delivered as a finished solution for ease of adoption, and will encompass consulting services from subject matter experts to support implementation. The application layer of the IIoT solution is being developed and supported by Tridium and will expand over time with solutions designed for the telecom and energy sectors.

HPE Commits to IoT and the Edge

HPE Commits to IoT and the Edge

Hewlett Packard Enterprise (HPE) held its annual Discover conference in Las Vegas last week. It has made a sizable commitment to Internet of Things (IoT) and the Edge—areas central to my writing for the past few years. I am floating a number of ideas looking for feedback as I travel, and I’ll bounce some of those here later.

There is so much I learned last week beyond even what I wrote Monday about the new Edgeline computer. Perhaps the best place to start is with my latest discussion with Lin Nease, Chief Technologist IoT at HPE. This was a continuation of a discussion we began in Madrid last November and resumed at Industry of Things World in San Diego in February.

HPE’s power of compute at the Edge fascinates me. Even though my being in Las Vegas precluded being in Boston for LiveWorx, ThingWorx came up in many conversations at Discover. Nease said that ThingWorx (product and division of PTC) has been a good partner. Back to compute power at the edge Nease mentioned this power combined with TSN—Time Sensitive Networking, a new extension of Ethernet promulgated by IEEE.

Indeed, there is sufficient power in Edgeline that an enterprising developer could, for instance, accomplish the software defined DCS that seems to be the dream of some of the engineers at ExxonMobil and the Open Process Automation folks. Anyone out there have time and money?

Speaking of Edge, evidently the enterprise IT bloggers I hung out with during the event try to avoid the term. CEO Antonio Neri had said, “Edge is everything outside the data center.” In the blogger round table that I posted Monday, blogger Alastair Cooke noted, “Gary, we consider everything you do as edge.” Back to Neri who stated 94% of data is wasted; 75% of data comes from the edge.

Following are some points I gleaned from a session called “Harness the Power of Digital Platforms”:

  • HPE is a huge fan of open source & open platforms
  • Digital natives build platforms-e.g. Uber, Google, Amazon, etc.
  • An internal team built an open API platform to solve a problem in supply chain
  • Biggest problem was selling the system internally so that people would actually use the system (never seen that before—said no one anywhere)
  • Traditional—>Digital; everything is a frictionless stream of data
  • Platform always on, always looking for exceptions — sense/respond

HPE has an OEM Solutions group. Following are some points from a session discussing them:

  • OEM Solutions can be Embedded, Integrated, Private Label
  • Everything as a Service — Green Lake is the service offering that OEMs can resell the service
  • Shift to software defined
  • From storage to flash
  • Example—Konica Minolta embedded an Edgeline computing device in a printer called workplace hub that makes it easier to set up and install a new remote office

HPE has momentum in IoT and edge devices—and an organization supporting manufacturing.

Follow this blog

Get every new post delivered right to your inbox.