PLC Automation
PLC Automation
AUTOMATION
USING
PLC - SCADA
SUBMITTED TO,
KULDEEP GULIA SIR
EEE/11/633
SUBMITTED BY,
GAURAV JAIN
1
Acknowledgement
I would like to thank SOFCON INDIA PVT. LIMITED, DELHI for providing me
exposure to the whole Scada & PLCs Systeam. Id also like to thank Mr. Pushkar
Bajpayee and Mr. Baghwansingh, for their enduring support and guidance throughout
the training. I am very grateful to the whole Control and Instrumentation Department for
their support and guidance.
I am also very thankful to the workers and employees near the machineries and the
library in charge for their support to my training.
Youre sincerely
GAURAVJAIN
EEE/11/633
CERTIFICATE
This training report is a genuine works by Mr. GAURAV JAIN, B-Tech 3rd
yr, Electrical&ElectronicsEngg. The report was made under my supervision,
and I express my delight on it successful completion. I am also very happy to
have offered him guidance whenever it was required.
I wish him success in all his future endeavors.
Contents
1. Introduction
2. Features of PLCs
3. PLC compared with other control systems
4. Digital and analog signals
4.1 Example
5 Programming
6. Ladder Logic
6.1 Example of a Simple Ladder Logic Program
6.2Program for Start/Stop of Motor
7. Meaning of SCADA
8. Architecture
9. Common System Component
9.1 Supervision VS Control
9.2 System Concept
9.3 Human Machine Interface
9.4 Hardware Control
10. Remote Terminal Unit
10.1 Supervisory Station
10.2 Operational Philosophy
10.3 Communication Infrastructure and Methods
11. Trends In SCADA
12. Security Issues
13. Application Development
13.1 Configuration
13.2 Development Tools
14. Evolution
15. Engineering
16. Potential benefits of SCADA
17. Conclusion
18. References
1. Introduction
5
physics experiments.
2. Features of PLCs
6
The main difference from other computers is that PLC is armored for severe condition
(dust, moisture, heat, cold, etc) and has the facility for extensive input/output (I/O)
arrangements. These connect the PLC to sensors and actuators. PLCs read limit switches,
analog process variables (such as temperature and pressure), and the positions of complex
positioning systems. Some even use machine vision. On the actuator side, PLCs operate
electric motors, pneumatic or hydraulic cylinders, magnetic relays or solenoids, or analog
outputs. The input/output arrangements may be built into a simple PLC, or the PLC may
have external I/O modules attached to a computer network that plugs into the PLC.
Many of the earliest PLCs expressed all decision making logic in simple ladder logic
which appeared similar to electrical schematic diagrams. The electricians were quite able
7
to trace out circuit problems with schematic diagrams using ladder logic. This program
notation was chosen to reduce training demands for the existing technicians. Other early
PLCs used a form of instruction list programming, based on a stack-based logic solver.
The functionality of the PLC has evolved over the years to include sequential relay
control, motion control, process control, distributed control systems and networking. The
data handling, storage, processing power and communication capabilities of some
modern PLCs are approximately equivalent to desktop computers.
Wiring In a PLC
Inside the PLC housing, connected between each input terminal and the Common
terminal, is an opto-isolator device (Light-Emitting Diode) that provides an electrically
isolated "high" Logic signal to the computer's circuitry (a photo-transistor interprets
the LED's light) when there is 120 VAC power applied between the respective input
terminal and the Common terminal. An indicating LED on the front panel of the PLC
gives visual indication of an "energized" input
:
Output signals are generated by the PLC's computer circuitry activating a switching
device (transistor, TRIAC, or even an electromechanical relay), connecting the
"Source" terminal to any of the "Y-" labeled output terminals. The "Source" terminal,
correspondingly, is usually connected to the L1 side of the 120 VAC power source. As
with each input, an indicating LED on the front panel of the PLC gives visual indication
of an "energized" output
In this way, the PLC is able to interface with real-world devices such as switches and
solenoids.
The actual logic of the control system is established inside the PLC by means of a
computer program. This program dictates which output gets energized under which
input conditions. Although the program itself appears to be a ladder logic diagram,
with switch and relay symbols, there are no actual switch contacts or relay coils
operating inside the PLC to create the logical relationships between input and output.
These are imaginary contacts and coils, if you will. The program is entered and viewed
via a personal computer connected to the PLC's programming port.
11
PLCs are well-adapted to a certain range of automation tasks. These are typically industrial
processes in manufacturing where the cost of developing and maintaining the automation
system is high relative to the total cost of the automation, and where changes to the system
would be expected during its operational life. PLCs contain input and output devices
compatible with industrial pilot devices and controls; little electrical design is required, and
the design problem centers on expressing the desired sequence of operations in ladder logic
(or function chart) notation. PLC applications are typically highly customized systems so the
cost of a packaged PLC is low compared to the cost of a specific custom-built controller
design. For high volume or very simple fixed automation tasks, different techniques are used.
A microcontroller-based design would be appropriate where hundreds or thousands of units
will be produced and so the development cost (design of power supplies and input/output
hardware) can be spread over many sales, and where the end-user would not need to alter the
control. Automotive applications are an example; millions of units are built each year, and
very few end-users alter the programming of these controllers. However, some specialty
vehicles such as transit busses economically use PLCs instead of custom-designed controls,
because the volumes are low and the development cost would be uneconomic
PLCs may include logic for single-variable feedback analog control loop, a "proportional,
integral, derivative" or "PID controller." A PID loop could be used to control the temperature
of a manufacturing process, for example. Historically PLCs were usually configured with
only a few analog control loops; where processes required hundreds or thousands of loops, a
distributed control system (DCS) would instead be used. However, as PLCs have become
more powerful, the boundary between DCS and PLC applications has become less clear-cut.
12
Digital or discrete signals behave as binary switches, yielding simply an On or Off signal
(1 or 0, True or False, respectively). Pushbuttons, limit switches, and photoelectric
sensors are examples of devices providing a discrete signal. Discrete signals are sent
using either voltage or current, where a specific range is designated as On and another as
Off. For example, a PLC might use 24 V DC I/O, with values above 22 V DC
representing On, values below 2VDC representing Off, and intermediate values
undefined. Initially, PLCs had only discrete I/O.
Analog signals are like volume controls, with a range of values between zero and fullscale. These are typically interpreted as integer values (counts) by the PLC, with various
ranges of accuracy depending on the device and the number of bits available to store the
data. As PLCs typically use 16-bit signed binary processors, the integer values are limited
between -32,768 and +32,767. Pressure, temperature, flow, and weight are often
represented by analog signals. Analog signals can use voltage or current with a
magnitude proportional to the value of the process signal. For example, an analog 4-20
mA or 0 - 10 V input would be converted into an integer value of 0 - 32767.
Current inputs are less sensitive to electrical noise (i.e. from welders or electric motor
starts) than voltage inputs.
4.1 Example
As an example, say the facility needs to store water in a tank. The water is drawn from
the tank by another system, as needed, and our example system must manage the water
level in the tank.
Using only digital signals, the PLC has two digital inputs from float switches (tank empty
and tank full). The PLC uses a digital output to open and close the inlet valve into the
tank.
If both float switches are off (down) or only the 'tank empty' switch is on, the PLC will
open the valve to let more water in. Once the 'tank full' switch is on, the PLC will
automatically shut the inlet to stop the water from overflowing. If only the 'tank full'
13
switch is on, something is wrong because once the water reaches a float switch, the
switch will stay on because it is floating, thus, when both float switches are on, the tank is
full. Two float switches are used to prevent a 'flutter' (a ripple or a wave) condition where
any water usage activates the pump for a very short time and then deactivates for a short
time, and so on, causing the system to wear out faster.
An analog system might use a load cell (scale) that weighs the tank, and an adjustable
(throttling) valve. The PLC could use a PID feedback loop to control the valve opening.
The load cell is connected to an analog input and the valve is connected to an analog
output. This system fills the tank faster when there is less water in the tank. If the water
level drops rapidly, the valve can be opened wide. If water is only dripping out of the
tank, the valve adjusts to slowly drip water back into the tank.
A real system might combine both approaches, using float switches and simple valves to
prevent spills, and a rate sensor and rate valve to optimize refill rates. Backup and
maintenance methods can make a real system very complicated.
14
5. Programming
Early PLCs, up to the mid-1980s, were programmed using proprietary
programming panels or special-purpose programming terminals, which often
had dedicated function keys representing the various logical elements of PLC
programs. Programs were stored on cassette tape cartridges. Facilities for
printing and documentation were very minimal due to lack of memory
capacity. More recently, PLC programs are typically written in a special
application on a personal computer, then downloaded by a direct-connection
cable or over a network to the PLC. The very oldest PLCs used non-volatile
magnetic core memory but now the program is stored in the PLC either in
battery-backed-up RAM or some other non-volatile flash memory.
Early PLCs were designed to be used by electricians who would learn PLC programming
on the job. These PLCs were programmed in "ladder logic", which strongly resembles a
schematic diagram of relay logic. Modern PLCs can be programmed in a variety of ways,
from ladder logic to more traditional programming languages such as BASIC and C.
Another method is State Logic, a Very High Level Programming Language designed to
program PLCs based on State Transition Diagrams.
15
6. Ladder logic
Ladder logic is a method of drawing electrical logic schematics. It is now a graphical
language very popular for programming Programmable Logic Controllers (PLCs). It was
originally invented to describe logic made from relays. The name is based on the
observation that programs in this language resemble ladders, with two vertical "rails" and
a series of horizontal "rungs" between them.
A program in ladder logic, also called a ladder diagram, is similar to a schematic for a set
of relay circuits. An argument that aided the initial adoption of ladder logic was that a
wide variety of engineers and technicians would be able to understand and use it without
much additional training, because of the resemblance to familiar hardware systems. (This
argument has become less relevant given that most ladder logic programmers have a
software background in more conventional programming languages, and in practice
implementations of ladder logic have characteristics such as sequential execution and
support for control flow features that make the analogy to hardware somewhat
imprecise.)
Ladder logic is widely used to program PLCs, where sequential control of a process or
manufacturing operation is required. Ladder logic is useful for simple but critical control
systems, or for reworking old hardwired relay circuits. As programmable logic
controllers became more sophisticated it has also been used in very complex automation
systems.
Ladder logic can be thought of as a rule-based language, rather than a procedural
language. A "rung" in the ladder represents a rule. When implemented with relays and
other electromechanical devices, the various rules "execute" simultaneously and
immediately. When implemented in a programmable logic controller, the rules are
typically executed sequentially by software, in a loop. By executing the loop fast enough,
typically many times per second, the effect of simultaneous and immediate execution is
obtained. In this way it is similar to other rule-based languages, like spreadsheets or SQL.
However, proper use of programmable controllers requires understanding the limitations
of the execution order of rungs.
16
The language itself can be seen as a set of connections between logical checkers (relay
contacts) and actuators (coils). If a path can be traced between the left side of the rung
and the output, through asserted (true or "closed") contacts, the rung is true and the output
coil storage bit is asserted (1) or true. If no path can be traced, then the output is false (0)
and the "coil" by analogy to electromechanical relays is considered "de-energized". The
analogy between logical propositions and relay contact status is due to Claude Shannon.
Ladder logic has "contacts" that "make" or "break" "circuits" to control "coils." Each coil
or contact corresponds to the status of a single bit in the programmable controller's
memory. Unlike electromechanical relays, a ladder program can refer any number of
times to the status of a single bit, equivalent to a relay with an indefinitely large number
of contacts.
So-called "contacts" may refer to inputs to the programmable controller from physical
devices such as pushbuttons and limit switches, or may represent the status of internal
storage bits which may be generated elsewhere in the program.
Each rung of ladder language typically has one coil at the far right. Some manufacturers
may allow more than one output coil on a rung.
--( )-- a regular coil, true when its rung is true
--(\)-- a "not" coil, false when its rung is true
--[ ]-- A regular contact, true when its coil is true (normally false)
--[\]-- A "not" contact, false when its coil is true (normally true)
The "coil" (output of a rung) may represent a physical output which operates some device
connected to the programmable controller, or may represent an internal storage bit for use
elsewhere in the program.
17
Input Instruction
--[ ]--
--[\]--
Output Instruction
--( )--
Rung
Rung is a simple line on which instruction are placed and logics are created
E.g.; --------------------------------------------Here is an example of what one rung in a ladder logic program might look like. In real
life, there may be hundreds or thousands of rungs.
18
For example
1. ----[ ]---------|--[ ]--|------( )-X
|
Y
|
S
|
|
|--[ ]--|
Z
The above realises the function: S = X AND (Y OR Z)
Typically, complex ladder logic is 'read' left to right and top to bottom. As each of the
lines (or rungs) are evaluated the output coil of a rung may feed into the next stage of the
ladder as an input. In a complex system there will be many "rungs" on a ladder, which are
numbered in order of evaluation.
1. ----[ ]-----------|---[ ]---|----( )-X
|
Y
|
S
|
|
|---[ ]---|
Z
2. ---- [ ]----[ ] -------------------( )-S
X
T
2. T = S AND X where S is equivalent to #1. above
This represents a slightly more complex system for rung 2. After the first line has been
evaluated, the output coil (S) is fed into rung 2, which is then evaluated and the output
coil T could be fed into an output device (buzzer, light etc..) or into rung 3 on the ladder.
(Note that the contact X on the 2nd rung serves no useful purpose, as X is already a
'AND' function of S from the 1st rung.)
This system allows very complex logic designs to be broken down and evaluated.
19
Example-2
Often we have a little green "start" button to turn on a motor, and we want to turn it off
with a big red "Stop" button.
--+----[ ]--+----[\]----( )--|
start |
stop
run
|
|
+----[ ]--+
run
20
motor
21
It must be understood that the X1 contact, Y1 coil, connecting wires, and "power"
appearing in the personal computer's display are all virtual. They do not exist as
real electrical components. They exist as commands in a computer program -- a
piece of software only -- that just happens to resemble a real relay schematic
diagram.
Equally important to understand is that the personal computer used to display and
edit the PLC's program is not necessary for the PLC's continued operation. Once a
program has been loaded to the PLC from the personal computer, the personal
computer may be unplugged from the PLC, and the PLC will continue to follow the
programmed commands. I include the personal computer display in these
illustrations for your sake only, in aiding to understand the relationship between
real-life conditions (switch closure and lamp status) and the program's status
("power" through virtual contacts and virtual coils).
22
The true power and versatility of a PLC is revealed when we want to alter the
behavior of a control system. Since the PLC is a programmable device, we can alter
its behavior by changing the commands we give it, without having to reconfigure the
electrical components connected to it. For example, suppose we wanted to make
this switch-and-lamp circuit function in an inverted fashion: push the button to
make the lamp turn off, and release it to make it turn on. The "hardware" solution
would require that a normally-closed pushbutton switch be substituted for the
normally-open switch currently in place. The "software" solution is much easier:
just alter the program so that contact X1 is normally-closed rather than normallyopen.
Often we have a little green "start" button to turn on a motor, and we want to turn it off
with a big red "Stop" button.
24
Starting of Motor
If we were to press the "Start" button, input X1 would energize, thus
"closing" the X1 contact in the program, sending "power" to the Y1 "coil,"
energizing the Y1 output and applying 120 volt AC power to the real motor
contactor coil. The parallel Y1 contact will also "close," thus latching the
"circuit" in an energized state:
25
26
7. Meaning of SCADA
SCADA stands for Supervisory Control and Data Acquisition. As the name indicates, it is
not a full control system, but rather focuses on the supervisory level. As such, it is a
purely software package that is positioned on top of hardware to which it is interfaced, in
27
8. Architecture
This section describes the common features of the SCADA products that have been
evaluated at CERN in view of their possible application to the control systems of the
LHC detectors [1], [2].
28
8.2 Communications
Internal Communication
Server-client and server-server communication is in general on a publish-subscribe and
event-driven basis and uses a TCP/IP protocol, i.e., a client application subscribes to a
parameter which is owned by a particular server application and only changes to that
parameter are then communicated to the client application.
Access to Devices
The data servers poll the controllers at a user defined polling rate. The polling rate may
be different for different parameters. The controllers pass the requested parameters to the
data servers. Time stamping of the process parameters is typically performed in the
controllers and this time-stamp is taken over by the data server. If the controller and
communication protocol used support unsolicited data transfer then the products will
support this too.
The products provide communication drivers for most of the common PLCs and widely
used field-buses, e.g., Modbus. Of the three fieldbuses that are recommended at CERN,
both Profibus and World flip are supported but CANbus often not [3]. Some of the
drivers are based on third party products (e.g., Applicom cards) and therefore have
additional cost associated with them. VME on the other hand is generally not supported.
A single data server can support multiple communications protocols: it can generally
support as many such protocols as it has slots for interface cards.
The effort required to develop new drivers is typically in the range of 2-6 weeks
depending on the complexity and similarity with existing drivers, and a driver
development toolkit is provided for this.
29
8.3 Interfacing
The provision of OPC client functionality for SCADA to access devices in an open and
standard manner is developing. There still seems to be a lack of devices/controllers,
which provide OPC server software, but this improves rapidly as most of the producers of
controllers are actively involved in the development of this standard. OPC has been
evaluated by the CERN-IT-CO group [4].
The products also provide
An Open Data Base Connectivity (ODBC) interface to the data in the archive/logs,
but not to the configuration database,
An ASCII import/export facility for configuration data,
A library of APIs supporting C, C++, and Visual Basic (VB) to access data in the
RTDB, logs and archive. The API often does not provide access to the product's
internal features such as alarm handling, reporting, trending, etc.
The PC products provide support for the Microsoft standards such as Dynamic Data
Exchange (DDE) which allows e.g. to visualize data dynamically in an EXCEL
spreadsheet, Dynamic Link Library (DLL) and Object Linking and Embedding (OLE).
The configuration data are stored in a database that is logically centralized but physically
distributed and that is generally of a proprietary format.
For performance reasons, the RTDB resides in the memory of the servers and is also of
proprietary format.
The archive and logging format is usually also proprietary for performance reasons, but
some products do support logging to a Relational Data Base Management System
(RDBMS) at a slower rate either directly or via an ODBC interface.
8.4 Scalability
Scalability is understood as the possibility to extend the SCADA based control system by
adding more process variables, more specialized servers (e.g. for alarm handling) or more
clients. The products achieve scalability by having multiple data servers connected to
multiple controllers. Each data server has its own configuration database and RTDB and
is responsible for the handling of a sub-set of the process variables (acquisition, alarm
handling, archiving).
8.5 Redundancy
30
The products often have built in software redundancy at a server level, which is normally
transparent to the user. Many of the products also provide more complete redundancy
solutions if required.
31
functions are usually restricted to basic overriding or supervisory level intervention. For
example, a PLC may control the flow of cooling water through part of an industrial
process, but the SCADA system may allow operators to change the set points for the
flow,and enable alarm conditions, such as loss of flow and high temperature, to be
displayed and recorded. The feedback control loop passes through the RTU or PLC,
while the SCADA system monitors the overall performance of the loop.
Data acquisition begins at the RTU or PLC level and includes meter readings and
equipment status reports that are communicated to SCADA as required. Data is then
compiled and formatted in such a way that a control room operator using the HMI can
make supervisory decisions to adjust or override normal RTU (PLC) controls. Data may
also be fed to a Historian, often built on a commodity Database Management System, to
allow trending and other analytical auditing.
SCADA systems typically implement a distributed database, commonly referred to as
a tag database, which contains data elements called tags or points. A point represents a
single input or output value monitored or controlled by the system. Points can be either
"hard" or "soft". A hard point represents an actual input or output within the system,
while a soft point results from logic and math operations applied to other points. (Most
implementations conceptually remove the distinction by making every property a "soft"
point expression, which may, in the simplest case, equal a single hard point.) Points are
32
normally stored as value-timestamp pairs: a value, and the timestamp when it was
recorded or calculated. A series of value-timestamp pairs gives the history of that point.
It's also common to store additional metadata with tags, such as the path to a field device
or PLC register, design time comments, and alarm information.
33
The HMI package for the SCADA system typically includes a drawing program that the
operators or system maintenance personnel use to change the way these points are
represented in the interface. These representations can be as simple as an on-screen traffic
light, which represents the state of an actual traffic light in the field, or as complex as a
multi-projector display representing the position of all of the elevators in a skyscraper or
all of the trains on a railway.
An important part of most SCADA implementations are alarms. An alarm is a digital
status point that has either the value NORMAL or ALARM. Alarms can be created in
such a way that when their requirements are met, they are activated. An example of an
alarm is the "fuel tank empty" light in a car. The SCADA operator's attention is drawn to
the part of the system requiring attention by the alarm. Emails and text messages are
often sent along with an alarm activation alerting managers along with the SCADA
operator.
34
engineers, electrical engineers and technicians to configure HMIs themselves, without the
need for a custom-made program written by a software developer.
The term "Supervisory Station" refers to the servers and software responsible for
communicating with the field equipment (RTUs, PLCs, etc), and then to the HMI
software running on workstations in the control room, or elsewhere. In smaller SCADA
systems, the master station may be composed of a single PC. In larger SCADA systems,
the master station may include multiple servers, distributed software applications, and
disaster recovery sites. To increase the integrity of the system the multiple servers will
often be configured in a dual-redundant or hot-standby formation providing continuous
control and monitoring in the event of a server failure.
Initially, more "open" platforms such as Linux were not as widely used due to the highly
dynamic development environment and because a SCADA customer that was able to
afford the field hardware and devices to be controlled could usually also
purchase UNIX or OpenVMS licenses. Today, all major operating systems are used for
both master station servers and HMI workstations.
For some installations, the costs that would result from the control system failing are
extremely high. Possibly even lives could be lost. Hardware for some SCADA systems is
ruggedized to withstand temperature, vibration, and voltage extremes, but in most critical
installations reliability is enhanced by having redundant hardware and communications
channels, up to the point of having multiple fully equipped control centres. A failing part
can be quickly identified and its functionality automatically taken over by backup
hardware. A failed part can often be replaced without interrupting the process. The
reliability of such systems can be calculated statistically and is stated as the mean time to
35
failure, which is a variant of mean time between failures. The calculated mean time to
failure of such high reliability systems can be on the order of centuries.
SCADA systems have traditionally used combinations of radio and direct serial or
modem connections to meet communication requirements, although Ethernet and IP
over SONET / SDH is also frequently used at large sites such as railways and power
stations. The remote management or monitoring function of a SCADA system is often
referred to as telemetry.
This has also come under threat with some customers wanting SCADA data to travel over
their pre-established corporate networks or to share the network with other applications.
The legacy of the early low-bandwidth protocols remains, though. SCADA protocols are
designed to be very compact and many are designed to send information to the master
station only when the master station polls the RTU. Typical legacy SCADA protocols
include Modbus RTU, RP-570, Profibus and Conitel. These communication protocols are
all SCADA-vendor specific but are widely adopted and used. Standard protocols are IEC
60870-5-101 or 104, IEC 61850 and DNP3. These communication protocols are
standardized and recognized by all major SCADA vendors. Many of these protocols now
contain extensions to operate over TCP/IP. It is good security engineering practice to
avoid connecting SCADA systems to the Internet so the attack surface is reduced.
RTUs and other automatic controller devices were being developed before the advent of
industry wide standards for interoperability. The result is that developers and their
management created a multitude of control protocols. Among the larger vendors, there
was also the incentive to create their own protocol to "lock in" their customer base. A list
of automation protocols is being compiled here.
Recently, OLE for Process Control (OPC) has become a widely accepted solution for
intercommunicating different hardware and software, allowing communication even
between devices originally not intended to be part of an industrial network.
36
37
the lack of concern about security and authentication in the design, deployment
and operation of existing SCADA networks
the mistaken belief that SCADA systems have the benefit of security through
obscurity through the use of specialized protocols and proprietary interfaces
the mistaken belief that SCADA networks are secure because they are purportedly
physically secured
the mistaken belief that SCADA networks are secure because they are supposedly
disconnected from the Internet
SCADA systems are used to control and monitor physical processes, examples of which
are transmission of electricity, transportation of gas and oil in pipelines, water
distribution, traffic lights, and other systems used as the basis of modern society. The
security of these SCADA systems is important because compromise or destruction of
these systems would impact multiple areas of society far removed from the original
compromise. For example, a blackout caused by a compromised electrical SCADA
system would cause financial losses to all the customers that received electricity from
that source. How security will affect legacy SCADA and new deployments remains to be
seen.
There are two distinct threats to a modern SCADA system. First is the threat of
unauthorized access to the control software, whether it be human access or changes
induced intentionally or accidentally by virus infections and other software threats
residing on the control host machine. Second is the threat of packet access to the network
segments hosting SCADA devices. In many cases, there is rudimentary or no security on
the actual packet control protocol, so anyone who can send packets to the SCADA device
can control it. In many cases SCADA users assume that a VPN is sufficient protection
and are unaware that physical access to SCADA-related network jacks and switches
38
provides the ability to totally bypass all security on the control software and fully control
those SCADA networks. These kinds of physical access attacks bypass firewall and VPN
security and are best addressed by endpoint-to-endpoint authentication and authorization
such as are commonly provided in the non-SCADA world by in-device SSL or other
cryptographic techniques.
Many vendors of SCADA and control products have begun to address these risks in a
basic sense by developing lines of specialized industrial firewall and VPN solutions for
TCP/IP-based SCADA networks. Additionally, application white listing solutions are
being implemented because of their ability to prevent malware and unauthorized
application changes without the performance impacts of traditional antivirus scans Also,
the ISA Security Compliance Institute (ISCI) is emerging to formalize SCADA security
testing starting as soon as 2009. ISCI is conceptually similar to private testing and
certification that has been performed by vendors since 2007. Eventually, standards being
defined by ISA99 WG4 will supersede the initial industry consortia efforts, but probably
not before 2011 .
The increased interest in SCADA vulnerabilities has resulted in vulnerability researchers
discovering vulnerabilities in commercial SCADA software and more general offensive
SCADA techniques presented to the general security community. In electric and gas
utility SCADA systems, the vulnerability of the large installed base of wired and wireless
serial communications links is addressed in some cases by applying bump-in-the-wire
devices that employ authentication and Advanced Encryption Standard encryption rather
than replacing all existing nodes.
39
13.1 Configuration
The development of the applications is typically done in two stages. First the process
parameters and associated information (e.g. relating to alarm conditions) are defined
through some sort of parameter definition template and then the graphics, including
trending and alarm displays are developed, and linked where appropriate to the process
parameters. The products also provide an ASCII Export/Import facility for the
configuration data (parameter definitions), which enables large numbers of parameters to
be configured in a more efficient manner using an external editor such as Excel and then
importing the data into the configuration database.
40
However, many of the PC tools now have a Windows Explorer type development studio.
The developer then works with a number of folders, which each contains a different
aspect of the configuration, including the graphics.
The facilities provided by the products for configuring very large numbers of parameters
are not very strong. However, this has not really been an issue so far for most of the
products to-date, as large applications are typically about 50K I/O points and database
population from within an ASCII editor such as Excel is still a workable option.
On-line modifications to the configuration database and the graphics are generally
possible with the appropriate level of privileges.
14. Evolution
SCADA vendors release one major version and one to two additional minor versions
once per year. These products evolve thus very rapidly so as to take advantage of new
market opportunities, to meet new requirements of their customers and to take advantage
of new technologies.
As was already mentioned, most of the SCADA products that were evaluated decompose
the process in "atomic" parameters to which a Tag-name is associated. This is impractical
in the case of very large processes when very large sets of Tags need to be configured. As
the industrial applications are increasing in size, new SCADA versions are now being
designed to handle devices and even entire systems as full entities (classes) that
encapsulate all their specific attributes and functionality. In addition, they will also
support multi-team development.
41
As far as new technologies are concerned, the SCADA products are now adopting:
15. Engineering
Whilst one should rightly anticipate significant development and maintenance savings by
adopting a SCADA product for the implementation of a control system, it does not mean
a "no effort" operation. The need for proper engineering can not be sufficiently
emphasized to reduce development effort and to reach a system that complies with the
requirements, that is economical in development and maintenance and that is reliable and
robust. Examples of engineering activities specific to the use of a SCADA system are the
definition of:
42
a mechanism to prevent conflicting controls (if not provided with the SCADA),
alarm levels, behavior to be adopted in case of specific alarms.
43
Reliability and robustness. These systems are used for mission critical industrial
processes where reliability and performance are paramount. In addition, specific
development is performed within a well-established framework that enhances
reliability and robustness.
Technical support and maintenance by the vendor.
44
17. CONCLUSION
SCADA is used for the constructive working not for the destructive work
using a SCADA system for their controls ensures a common framework not only
for the development of the specific applications but also for operating the
detectors. Operators experience the same "look and feel" whatever part of the
experiment they control. However, this aspect also depends to a
significant extent on proper engineering.
45
18. REFERENCES
Note: this article is based on a very similar one that has been published in the
Proceedings of the 7th International Conference on Accelerator and Large
Experimental Physics Control Systems, held in Trieste, Italy, 4 - 8 Oct. 1999.
[1] A.Daneels, W.Salter, "Technology Survey Summary of Study Report", ITCO/98-08-09, CERN, Geneva 26th Aug 1998.
[2] A.Daneels, W.Salter, "Selection and Evaluation of Commercial SCADA
Systems for the Controls of the CERN LHC Experiments", Proceedings of the
1999 International Conference on Accelerator and Large Experimental Physics
Control Systems, Trieste, 1999, p.353.
[3] G.Baribaud et al., "Recommendations for the Use of Fieldbuses at CERN in
the LHC Era", Proceedings of the 1997 International Conference on Accelerator
and Large Experimental Physics Control Systems, Beijing, 1997, p.285.
[4] R.Barillere et al., "Results of the OPC Evaluation done within the JCOP for the
Control of the LHC Experiments", Proceedings of the 1999 International
Conference on Accelerator and Large Experimental Physics Control Systems,
Trieste, 1999, p.511.
46
47