Not another Industrial (software) Blog

SCADA Security in the Cloud - common sense design considerations

2011-11-22T21:47:00.000-08:00

Inductive Automation just just released this white paper on Cloud Computing and SCADA and hosted an informative webinar on the topic. I wanted to provide my perspective on a few good design practices, when looking through a security prism.

How to plan for the cloud with security in mind
- Consider the tenant of "local control". This may or may not translate to "isolated network". It's better to not even think about implementation at this point. The idea is, "from where do I want to allow my operators to control equipment"?

-Decide what it is that you need to access from anywhere. This is a business decision, not a tech decision.

- In terms of your security planning, cloud hosting is basically the same as making your application accessible via the Internet. Do not confuse this with "public". Both approaches can provide worldwide access. Both can be secured with SSL/TLS and/or even require VPN connectivity. Consider the implications of a "worst case" compromise in the back of your mind.

- "The Cloud" is probably more robust than your server. The gold star for Availability more likely goes to the cloud. Consider that you're not taxing your bandwidth or storage resources and can pay more money to scale on an as needed basis. The whitepaper refers to this as leveraging or outsourcing IT costs. This is a good thing.

- Consider separating your Internet or Cloud services from the rest of your network, including control, business, public web, etc. I am not a fan of your cloud server being able to reach out to your PLC. Why would you do that except in the case of deliberate cloud based control, which is generally not recommended? It's just as easy to have your internal control system write data out to your online (Internet or Cloud) database. You might even log data to a local database then replicate that online. Control the flow of your communication!

Example
The point is, think about your security architecture requirements from a simple perspective. Don't worry about how you will implement it. For example, your thought process might go like this: I want to be able to change setpoints from anywhere within the control network of my 3 sites, I even need a secure way of doing this remotely. If the network goes down, local operators need to be able to control the system without missing a beat. QA needs to examine our realtime process in detail and management wants to be able to access production reports from anywhere. As you come up with this you'll inevitably realize that QA and management systems don't need a path to the PLC - that's the Principal of Least Privilege (POPL) in action! Keep up on defining requirements! Availability really matters at the operator terminals, but not for control between sites - so we don't need redundancy there. Maybe QA has regulatory requirements requiring strict Integrity (prevention of unauthorized data modification). Do we care if the management reports get out? Maybe a lot, maybe not at all. If so, we'll want to protect the confidentiality of the system. Notice that I'm focusing on what and not how?

Get the idea? Now we have our business requirements, driven by operators, management, and our process. Notice that we didn't even consider technical limitations or implementation details? Now it's time to come up with a tech plan, get with IT and let them know what are objectives are.

Your solution may be a complex multi-part system with firewalls, intrusion detection systems (IDS), VPNs, local systems and online ones. It could also be really simple.

Closing Advice

First consider your business/operational requirements in the absence of naysayers who are thinking about implementation/security details.
Keep security in mind as part of your requirements. This can be done without extreme paranoia.
Involve IT early on the design phase. Once you provide the what they should be able to help you out with the how.
Don't forget about upgrades/updates, backups, and other ongoing support requirements.
Follow the good practices that you already know. Use strong passwords, update your systems, etc.
Read this whitepaper.

On water hacking

2011-11-22T20:50:00.000-08:00

There is a lot of ongoing publicity revolving around the recent attacks on water district SCADA systems. These cases were trivial to carry out based on gaping, easily solvable vulnerabilities. Industrial controls folk need to take it upon themselves as professionals practicing due care to step it up. It isn't difficult to adopt good security practices. This isn't much different from the transition business users had to make in going from single user systems (think DOS and Windows 3.x) to networked systems. In this case, the technology exists.

It was interesting to note that an August presentation at the Black Hat conference mentioned water attacks. Coincidence? Not likely. If you work in Industrial Automation you likely know much more vulnerable and potentially dangerous targets. Let's fix this before a tragic event and regulation requires it.

News: CNET,
Forum discussion, and at IA, and PLCTalk.
Blog posts: Tofino II, SCADAHacker

Disclaimer - this post is not affiliated with the Water Hackathon event. The author thought it was funny.

Ignition awarded prestigious Oracle Duke's Choice Award

2011-10-05T09:07:00.000-07:00

Inductive Automation was awarded as one of 10 annual Duke's Choice Awards from Oracle for Ignition as an innovative use of Java technology. Congratulations!!! Press release announcement.

Ignition 7.3 Beta available

2011-09-15T09:01:00.000-07:00

Ignition 7.3 represents a major version increase for the Vision module and may significant changes for the others. If you've never beta tested Inductive Automation software you'll have to request access to the beta forum here. I must say, it's fun to play with the new vector drawing capabilities.

Drawing tools added for vector graphics.
Zooming in the Designer.
Better grouping support for components and shapes.
New Symbol Factory module.
More efficient serialization format for windows.
Better color-choosing UI.
Internationalization in Gateway/Designer.
New compression algorithm for analog SQLHistorian tags.
New ability for SQLHistorian to create preprocessed history tables for better query performance over long time spans.
New query cache in the client to avoid unnecessary repeated querying of the same time span.
Data density histogram on the Easy Chart for SQLHistorian pens.
Improved memory usage for SQLTags in the Gateway.
Automatic SQLTag creation when dragging and dropping OPC items.
Improved performance and scan class settings for SQLTags (one-shot, triggered on-change, subscribed vs polled).
Improved memory usage for ControlLogix driver.
Improved performance and stability for all drivers.
Improved installer allows choosing individual modules on install and upgrade.
New graphical and command-line installer for Linux.
Ignition installation directory structure changed.

Ignition security advisory

2011-09-07T11:12:00.000-07:00

An independent researcher from Reverse Mode disclosed a vulnerability in Ignition from Inductive Automation. Fixes are implemented in version 7.2.8.178 and above. This finding and fix was published by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). The fix - install the latest version of Ignition.

It's a good idea for software companies to be transparent about releasing and fixing their vulnerabilities. Remember to keep up to date with the latest version of your software!

Interesting article - #1 ICS and SCADA Security Myth: Protection by Air Gap

2011-09-02T21:04:00.000-07:00

Eric Byers of Tofino Security (they do SCADA security research and have a security appliance) discusses the concept of relying on air-gapping control networks for security. In a nutshell, a modern control network is unlikely to remain physically separated. Even if it is, malware can be introduced via removable media and the system is hard to keep updated and vulnerable to local (insider) attacks.

A system should be designed with security in mind and kept up to date.

http://www.tofinosecurity.com/blog/1-ics-and-scada-security-myth-protection-air-gap

Interesting article - The Ultimate HMI

2011-09-02T09:10:00.000-07:00

This Control Global article, The Ultimate HMI, provides interesting tips about HMI screen creation. I especially like the comments and examples of the best visual status indications containing: text, shape, and color.

Ignition intro - Rethinking SCADA for modern manufacturing

2010-12-23T00:36:00.001-08:00

An informative 3 minute video of the Ignition concept from Inductive Automation, rethinking SCADA for modern manufacturing.

Industrial Security - a reminder from Stuxnet

2010-12-23T00:36:00.000-08:00

I've refrained from blogging about Stuxnet for the simple reason that I'm no expert on it. You can learn more than I know about Stuxnet from Wikipedia. However, it should reinforce the need for basic security good practices. I hear too many integrators and industrial professionals write off a system as not needing any security applied because the system is on an isolated network. Consider the vector Stuxnet used to attack isolated networks - USB drives to infect the system then peer to peer Windows RPC calls. Even if you're not the target of a large attack, you need to protect yourself from the much more common "insider threat", a disgruntled or malicious employee. Let's consider some easy steps that can make a huge difference in protecting your SCADA system and industrial network.
1. First, get the best "bang for your buck" - take care of your low hanging fruit. Embarrasingly, in industrial systems this means: get rid of shared accounts and no passwords, don't connect the control network to the Internet or harden your business necessary connection point, ensure that you have a working backup, check your backdoors (old modems, etc).

2. The strength of your system lies in a Defense in Depth approach, meaning taking advantage of strengths of overlapping security mechanisms. While adhering to point #1, knock out the really easy and obvious ones. There's no reason to get fancy until you have your basics covered.

3. Architect your system with security in mind. For example, if you decide to start with Windows XP SP 1, you're just asking for trouble. I get it that patching often has negative side effects with industrial/SCADA software, but you need to (minimally) begin with a baseline that isn't hugely vulnerable. Design around industry standard technologies and protocols such as OPC-UA. Don't try to roll your own security solutions!

4. Develop a security policy and train your users. It's important that management understands and accepts the level of risk that the system takes on. It's important that users know what's allowed and that consequences are serious. Require that they sign an Acceptable Use Policy (AUP). A successful security program is as much about users, policy, and procedure than equipment, applications, and configuration.

5. Establish individual accountability (auditing). Ensure that users have individual accounts and that their activity on the system is logged and periodically reviewed. I know this often doesn't happen in manufacturing, but it should.

You have far too much value in your HMI, SCADA, industrial system. Ask yourself, how much does downtime cost? How can you afford to not secure your control system?

Going mobile with industrial computing

2010-12-22T02:21:00.000-08:00

Mobile is hot in manufacturing! The web sites of the major SCADA vendors, industry blogs, and consumer feedback indicates a strong interest in "mobile", be it tablet, PDA or smartphone. Who wouldn't want the capability to see, if not control your process from the palm of your hand? Why deal with text messages, phone calls, or email alerting when you can see, acknowledge, and handle alarms from your mobile device in real time? What about tying this to your MES/ERP system to view production efficiencies?

Sure there are red flags - you will probably have an increased requirement for security including physical access, user accountability (auditing), and all the typical considerations. For most organizations the benefits will most likely outweigh the risk and cost. Security is a mature enough field - if the credit card companies, banks, financial institutions, and even the military can be successful with it, so can you. Apply defense in depth, implement/follow your company policy, adhere to strong practices, hire experts if you need it - nothing new here.

From my perspective, industrial computing has been following the path of commercial computing. Those same basic technologies that have become widespread in your office will usually show up on the plant floor in some form. You can trace industrial controls from relays to PLCs as opposed to vacuum tubes then transistors, but the technologies have been converging and are basically one in the same.

Perhaps a driving force of computing paradigms is the relative shift in local processing power versus the capability of the "network". How thick versus thin is the ideal environment - in other words, do we want to perform the computing locally or remotely? We've seen this shift between centralized and de-centralized SCADA systems - the balance between central administration versus local setup, scalability and performance, and dependence on the network. The models roughly share the considerations we've seen in the migration between: Mainframe, Micro, Mini, and PC.

So where are we going next? Cloud computing or even thinner clients? To me, mobile computing represents an advance in both categories. That's not to say that smart phones won't get more computationally capable - they will continue to shrink and get faster and faster. However, with the increasing reliability of infrastructure, "the network", it makes more sense to centralize your control applications. Why? In one word, ubiquity. For the same reason the web has standardized on HTML. Users will demand access from anywhere they deem appropriate, regardless of the mobile platform. Will they create a separate app for each: iPods/iPads, Blackberry, Droid, Win 7 phones, Palm PDAs, embedded MS OSs, Linux devices, etc, etc? Each of those platforms has a large enough user base to support its own "apps" - Solitare, or a web browser, which turns out to be the common denominator.

I don't think organizations will put up with only supporting one mobile platform. This is somewhat akin to requiring you to buy a Bell phone in order to use the phone network. Nor is it acceptable for a complex installation or configuration. Successful SCADA vendors will need to support feature rich mobile applications that run on most, if not all, mobile devices out of the box. As our networks get more robust, secure, and cheap, we'll be rewarded with new levels of capability that make that transition from novelty to necessity - just like PCs once did. In the end, competitive organizations from all industries will benefit from these incredible mobile technologies.

Computing Without Boundaries

2010-10-08T02:29:00.000-07:00

Steve Hechtman, the President of Inductive Automation, has been busy updating his blog, Computing Without Boundaries. It's a fantastic, albeit biased, prospective on modern technologies, methodologies, and considerations for modern Industrial Software applications. Taken with a vendor neutral approach, his points focus on today's issues and technology on the forefront. He isn't afraid to lay it down with points of frustration, digging into his 26+ years as an Industrial Integrator, which can be quite entertaining as you relate it to common situations. He sometimes relates the approach that Inductive Automation uses, justifying exactly why it makes sense in each case - to the Integrator and end user. Definitely worth a read. In fact, leave a comment or two.

Retro Encabulator interview

2010-10-08T01:52:00.000-07:00

The Retroincabulator video makes me laugh every time I see it. Tim managed to get an interview with actor Mike Kraft about it. Sweet!

Review
Interview

VCP at last, and virtualization in Industry

2010-06-18T06:30:00.000-07:00

I had the opportunity to attend VMWare's Fast Track course last December. It was a good class. The info came fast and furious! After nearly allowing my test voucher to expire, I buckled down and hit the books.On Wednesday I passed the test, so now I'm officially a VMWare Certified Professional!

Virtualization has been an interest of mine for awhile. I live by VMWare Workstation on my desktop and await the day when I get a laptop that's powerful enough to support my too-many VMs at once habit. For the Industrial Integrator/programmer/professional, Virtualization makes too much sense! Check it out if you haven't already! It readily solves problems that Industrial Software vendors have created (you need this version of Windows without a patch, can't run with competing software, older programming tools for some customers, etc, etc). Using multiple Virtual Machines, you can have exactly the right tool for whatever task at hand - without ever needing to make any changes. You get additional benefits of features like "snapshots" and "cloning". The only real issue is that none of the vendors have decided to support PCMCIA/PC Cards, so you'll have to use serial or USB connectors. This should matter less and less as time goes on.

On the server side (which is what the VCP is all about), VMWare may or may not make sense for your Industrial applications. Don't get me wrong - ESX and ESXi are awesome packages, but if you don't have a competent IT department - you're adding another layer of complexity for what might benefit you. For those larger companies that provide a lot of server based services - you're probably already using a virtualized environment. It just doesn't make sense not to.

Web based SCADA - a perspective from the Netherlands

2010-03-05T19:09:00.000-08:00

Web based SCADA article by Eduard van Loenen of Yokogawa’s Global SCADA Center in The Netherlands. Kudos to Dan for pointing it out. He brings many great points to the table of the advantages to the trend of web based SCADA systems.

From a security perspective, I disagree that IT technologies are "more susceptable to cyber attacks" than "rigid proprietary software". The cyber attacks will come since systems are being networked and remotely accessbile, which is a productivity enhancing user requirement in modern manufacturing. Proprietary software tends to be less secure than modern IT technologies, especially as the Internet makes exploits more widely available.

Good article, though!

Databases – The Perfect Complement to PLCs, by Steve Hechtman

2010-02-24T04:12:00.000-08:00

Interesting insight on the role of SQL and databases with PLCs and industrial automation.

Hosted at Automation.com, Reliable Plant, FoodEngineering

Ignition, post release activity and OPC vendors

2010-02-04T07:43:00.000-08:00

I was impressed with the Ignition by Inductive Automation product release webinar. The Inductive Automation team did a first class job introducing the company, Ignition product platform and architecture, and the motivation behind the shift to OPC-UA. In a nutshell, their vision of the future of industrial software is: standards based, IT friendly, and platform independent. Get DCOM out of here! We want a top notch, secure SCADA system that runs equally well on Linux, a mac, or any flavor/service pack of the Windows rainbow. The demonstration included a full server installation, which took about 2 minutes, and highlighted the drag and drop ease of the new SQLTags History feature, which is deceptively simple, yet powerful.

We've been getting a huge number of hits to the new website by a number of companies across the world. We've also been getting a lot of interest in when more drivers will be available, like Siemens, Modbus, and Automation Direct in addition to the existing Allen Bradley suite. I suppose this isn't surprising considering that we're the only cross-platform OPC-UA server available. While it shouldn't be too long before we get those drivers developed, this brings me to my next point...

Where are the other OPC-UA servers? We're really looking forward to a more vibrant marketplace for OPC-UA products. Kepware says they'll be releasing their OPC-UA server soon - we're looking forward to being able to test it with Ignition. This really excites me because it brings their extensive PLC product line to the table via OPC-UA. Unfortunately, I don't think it will be cross platform.

So, how about it? OPC vendors: the gauntlet has been thrown. The industry wants OPC-UA products! And if they're cross platform, all the better. When will we start seeing them?

My thoughts on securing your plant systems

2010-02-04T07:13:00.000-08:00

Security, not your first concern as an industrial integrator or plant manager. Availability ranks numero uno. Got it! Your company loses $30k/hr during plant downtime. Got it! Plant workers are not exactly NSA hacker material. Got it! So why is security important? Look at those reasons again and above all, safety. Consider that your legal liability in court costs more than downtime. Do you want a disgruntled employee to shut down the factory on your watch? It is incumbent upon you as a professional to demonstrate due care. We're not worrying about international hacker rings or bored young college geniuses. Accidents occur and insider attacks are possible.

It's 2010 - many systems end up touching the Internet or outside world somehow, whether you like it or not. Common practices in the 90s, like allowing users to share passwords are unacceptable - that audit trail is a must. Having PLCs on the same network as office computers - professionally irresponsible. Your company uses 25 year old hardware that was never designed for security - it's up to you to isolate that network. Provide access with a "hardened" dual-homed (2 network cards) computer that is patched and protected by a firewall. Utilize VPNs, DMZs, VLANs, SSL, IDSs, and anything else in your IT department's arsenal. They know how to secure a network - it's their job. Gone are the days of operating behind their back, not letting them touch anything for fear that updates will break your system. Pick a vendor that IT will support. Practice Defense in Depth. Let them help you. It's 2010. Embrace positive change!

Introducing Ignition by Inductive Automation - Web-based, cross-platform SCADA Webinar

2010-01-19T21:52:00.000-08:00

From an official Inductive Automation email....

Say goodbye to rationing clients, patchwork control systems and project development constraints caused by oppressive licensing systems.

Ignition by Inductive Automation is being released January 27th. Ignition is a major next step in the evolution of FactorySQL and FactoryPMI.

Join us for this new release webinar to see how the Ignition platform opens up possibilities in the industrial automation industry. The webinar will give an overview and demonstration of Ignition's features and its capabilities, such as:

Web-based clients that enable scalability
Unlimited clients and tags, licensed by the server
A flexible database-centered architecture
OPC-UA support
100% cross platform: Windows and Linux
Simplified software setup and ...

Also accompanying the product launch is Inductive Automation's new website design at http://www.inductiveautomation.com/, which will launch January 27th with details about Ignition.

Title: Introducing Ignition by Inductive Automation - Web-based, cross-platform SCADA
Date: Thursday, January 28, 2010
Time: 9:00 AM - 10:00 AM PST

After registering you will receive a confirmation email containing information about joining the Webinar.

System Requirements
PC-based attendees
Required: Windows® 2000, XP Home, XP Pro, 2003 Server, Vista
Macintosh®-based attendeesRequired: Mac OS® X 10.4 (Tiger®) or newer

Space is limited.
Reserve your Webinar seat now at: https://www2.gotomeeting.com/register/273245266

Ignition preview and a visit to Inductive Automation

2010-01-14T07:09:00.000-08:00

Over the holidays I had the opportunity to visit my good friends, Colby and Carl, who are lead developers at Inductive Automation. They gave me an in depth technical "sneak peak" of what is becoming their next product line, "Ignition".

The plan is a single product platform that replaces the separate functionality of FactorySQL and FactoryPMI. They really went all out with levering technologies! The product is platform independent (Windows 32 or 64 bit, Linux, Mac, etc), fully web based (no client installation), and supports separate "modules" that all have access to the same powerful core technologies. Everything runs from a cluster aware web server similar to the current FactoryPMI Gateway but they had new behind the scene tricks (Non-Blocking IO for multithreading, advanced serialization schemes for saving/storing projects, and a whole slew of security upgrades consistent with the OPC-UA specification).

They showed me an OPC-UA application that securely connected to different PLCs (many AB, Siemens, and AD) via different PCs without an OPC tunneller. All this worked equally well on Windows and Linux systems. Once the data is accessible from the PLC, you get the full visualization spectrum that FactoryPMI already offers (graphics, multimedia, historical trends, reporting, etc).

The coolest part is that development time should be cut down substantially, for both Inductive Automation proper and 3rd parties/end users as the API is released, since the platform performs so much native functionality (network, database, project launching/hosting/editing, clustering, storage, alerting, auditing, authentication, etc, etc.). The Ignition platform should become to controls software what Metasploit is to ethical hackers/penetration testers.

OPC UA info

2009-07-04T01:32:00.000-07:00

I just ran into this article dated May of last year. Simone Massaro of Iconics describes the direction that they went with OPC UA development. It's a bit technical, but a good read.

http://www.plantengineering.com/article/talkback/183110-What_is_OPC_UA_and_how_does_it_affect_your_world_.php

Is anyone buying this? Really...?

2009-06-12T19:34:00.000-07:00

I stumbled across this article that, quite honestly, at first pissed me off. After a little reflection, I can only laugh. It reminds me of someone trying too hard to sell those $150, short gold plated digital Monster audio cables - Oxygen free or whatever. (If the engineer inside you doesn't laugh, then cry for the sake of the suckers, read on).

Maybe I read in to far, but I see snakeskin oil vendors grasping for air! The piece is an obvious response to Steve Hechtman's very different article on the same topic (hosted on Control Engineering) - he should be flattered. You see, the big vendors, GE Faunc in this case, but the exact same applies to Wonderware and Rockwell have been long committed to the concept of Historians, a glorified and expensive datalogger that includes, and is only meant to work with, a custom version of Microsoft SQL Server (of all product choices...). The problem is that now much cheaper products from companies like Inductive Automation and Software Toolbox can do a better job using any RDBMS (database) system. Being vendor-neutral, inexpensive add-on packages also do much better for things like trending, reporting, and data analysis. The biggest mistake of the current generation of Historian is that they tried to implement and include everything themselves - like making a giant Swiss Army knife with a spork, usb memory stick, and a wine glass. Now they're caught with their pants down, desperately scrambling to recovery their enourmous sunk costs (my favorite business term).

You're data is special and requires "plantwide historian" treatment...their example query “What was today’s hourly unit production average compared to where it was a year ago or two years ago?”. I won't even comment...

Your database needs to speak specialized industrial protocols (OPC) - There's separation of function by design and for a reason. Besides - this doesn't even make sense.
Faster speeds and higher data compression - no way! The historian is wasting CPU cycles in both directions, which obfuscates your data (can no longer use external applications), to do something better achieved by a RDBMS system that supports it.
Robust redundancy for high availability - is this a joke? Maybe Amazon.com should migrate their server farms over to GE-flavor SQL Server.
Enhanced data security - another losing battle for the historian. The white paper mentions SQL injection attacks - all platforms in question can use stored procedures, and are all subject to this sort of attack. When it comes to up to date patching, arguably the most common vulnerability, SCADA vendors have the absolute worst track record! IT keeps their servers patched as a matter of practice - they're typically afraid to touch the SCADA machines. Ultimately, the "do everything" approach provides many attack vectors.

I can't blame them for playing their hand. I just wonder - will anyone read this white paper and take it at face value?

SCADA security and cyberspace threats

2009-05-22T20:20:00.000-07:00

I probably sound like a broken record by now, but SCADA security is not going anywhere. This applies to almost anything electronic that is connected to a network.

Due to the nature of the systems, and the fact that they most often can't be easily patched, it's becoming increasingly important to choose standards based products/technology and protect your network infastructure. It's imperative to mitigate risk where you can!

In recent news - military arming for cyber warfare. This blog post commenting on hacking infastructure.

Matrikon and Wurldtech Cooperative

2009-05-20T02:49:00.001-07:00

Wurldtech Security Technologies has committed to apply their Achilles testing technology and certification methodology to Matrikon's OPC products. Successful completion will place the Matrikon OPC Tunneller and servers at the top of my recommendation list. This is a big plus for the world of SCADA security! Now, if only we could do something about our legacy systems...

Wurldtech blog announcement and press release.

The Risks Digest

2009-05-17T23:42:00.000-07:00

I stumbled upon the "Risks Digest - Forum On Risks To The Public In Computers And Related Systems" from another blog post. Some of the stories certainly made me laugh - I spent way too much time there!

An interesting conversation with a traveller in Bali

2009-05-15T20:28:00.000-07:00

I had an interesting poolside conversation with "Jeff" at a resort in Bali. He works for Juniper networks, setting up core networks for huge accounts overseas. He told me of the $400 million project in Malaysia that will go on for the next 3 years, and about his project in Brazil. He said that he's gotten used to the long flight back that he takes monthly, but hey, how bad could business class be? More importantly he mentioned that Cisco's IOS is outdated - that engineers left there after being turned away with (then) cutting edge ideas of using ASICS (specialized integrated circuits as opposed to generalized processors) in routers. They maintain a monsterous market share and provide lots of enterprise services (like voice and conferencing over IP). It was weird to hear him refer to enterprise accounts as the small ones (compared to major telecoms and infastructure).

Poking into Jeff's past revealed a masters degree in Electrical Engineering, a CCIE certification about 10 years ago (distinguish youself - don't mess around with the little ones, he said), and "various others". I guess he did some defense contracting at the Pentagon earlier as well. But I got the usual, "certs and education get you in the door...specialize and learn the industry to move up" explanation.

So why mention any of this here? It's all about infrastructure! First, it used to surprise me that I get a 100 megabit Internet connection at home in Korea. That's not fast in terms of network equipment and Korea is on the cutting edge. Heck, I'm getting 700k at the resort in Bali! He was talking about OC768 (40 gigabit) core routing equipment in Malaysia! There's plenty of fiber under the ocean! We, the US, have piles of legacy equipment that we're dealing with. These new countries coming online get to engineer their solutions properly and deal with the latest and greatest! Mr. Obama - if you're reading this, I think investing in our digital infastructure would make a great part of the stimulus package! Our industrial control networks will benefit from such upgrades.

Getting the most out of your SCADA system

2009-05-08T19:49:00.000-07:00

I literally visited Inductive Automation the day before Gary Mintchell did. I didn't get the opportunity to meet him, but I did get a glimpse of his insight. He quoted the company as a "database company" - as a foundation, which is an insightful perspective.

Here's what occurred to me - I've been involved in big projects and small projects, private sector, government, and military running a variety of platforms. Does anybody have issues creating a tinker toy HMI with a few setpoints and graphics that change color? I really doubt it. Which vendor would I recommend for that? Who cares - they all do it. That's what Walt refers to about the commodization of HMIs.

So what's valuable and where are we failing? My top choice, and they are together, are "customizability and interoperability", something we tend to suck at. Suppose I asked, "how much power have we used so far this month". I'd likely get, "I donno - but you can figure it out if you keep a log of readings from that meter". Or - "what's the status on that shipment we sent out last week"? It's available on the Fedex/USPS web site. But why not on our information/SCADA system? Isn't that what web services is all about? Who are we kidding - we have enough issues migrating/tying in our legacy systems. I bundled "customizability and interoperability" together because the point is to be able to tie your system to others easily. Managers shouldn't have to buy hardware and large amounts of integration services to make their systems work for them.

Great! So how does this work? The key is being able to pass data - through standardization. This is where technologies like OPC (UA) and web services come in. But another huge, often overlooked method is using SQL databases. Most applications, and nearly all business systems use them natively. You want to know anything about your process - inventory, QA, for example - past or present. That should be available in your SCADA system. It's a great connection point, provided that it's flexible, which is Inductive Automation's strength. Get that SCADA vendors - hint, hint - step away from the custom Microsoft SQL Server implementations! The royalties are great, but nobody belives that you need them for performance. Besides databases are useful for other reasons than being a historian! It's not hard to support Oracle, MySQL, DB2 and others - just swallow your pride and old company lines.

How do you get your existing or legacy system to interoperate with others? Simple, OPC <-> SQL database bridges exist for that purpose.

OPC Interoperability Conference, UA and Java

2009-05-08T18:56:00.000-07:00

In the spirit of catching up with my backlogged blogging (recent personal Japan trip from January), I'll post about a few topics that I missed.

I had a chance to visit old friends at Inductive Automation. They gave me a demonstration of the working Java OPC UA stack that they unveiled back in the beginning of March, at the North American OPC Interoperability conference. The "test program" was a slick AJAX web page that browsed, read, and wrote tags to an AB SLC with no noticable delay.

The Java UA stack is significant for a number of reasons. First, the UA spec is notional. I'd guess that the OPC Foundation hoped, but didn't really expect, to see it implemented independently - at least not right off. (*a Java stack on their C/C++ implementation is planned with a pure jave stack in the dreamy future) - (*correction again - Randy Armstrong points out in a comment that a Java stack is currently available). This leads to the second point about Java being platform and Operating System independent - everything supports the Java Virtual Machine these days. The point is that we have millions of users across continents and lots of reasons to seek Windows alternatives. I'd bet that there's a dissociated army of programmers in the industrial space who are doing their own thing, but would jump on a standards based bandwagon. That's really what our industry needs for: efficiency, simplicity, and cost savings. The idea being that everything "speaks OPC UA" so historically dissimilar hardware, appliances, and applications can talk with ease - securely.

Which brings me to something I heard about at the conference. Reportedly, the UA guys were asked to go home the first day so that all the legacy apps could be set up. This makes me laugh and wince simultaniously! It's not uncommon for a room full of experts to spend an afternoon getting two nodes to talk to each other - it's all about Windows DCOM security, which is equally painful as it is full of gaping vulnerabilities. At the point where you're communicating with a friend, a third party can't see either.

New standards are a funny thing - everyone knows they're coming, everyone knows they'll benefit from them, but you're not ready to commit until the next guy has. Kudos to Inductive Automation for getting the ball rolling. Kudos to Kepware and Iconics for the same. Siemens has comitted to an entire product line! Wonderware's been talking the talk, as has Rockwell (both in 2006). Here's to them coding away in their secret labs! Don't believe me - here's a video of how great and mature OPC UA really is, complements of Eric Murphy of Matrikon! It's a riot - I promise :)!

Using Open Standards in Water and Wastewater

2009-05-05T15:37:00.000-07:00

I hadn't expected to be blown away by Inductive Automation's Using Open Standards, web-based modern SCADA technology to manage your water operations webinar, but the collection of speakers and content was phonomenial!

Don Pearson, the moderator, opened up with a brief presentation on federal 'relief' monies specific to water and wastewater. Henry Palechek presented trends that he's taken Helix Water District of San Diego through from their $2 mil VAX system, to their $350k Wonderware system, to their existing FactoryPMI system. He had a lot of interesting insight into the decision process and business ramifications of his choices. The transcript can be read here (you can also listen to a recording of the interview from the webinar).

Patrick Callaghan of MCS Integrations then presented a system integrators prospective. He showed off a live system (which, by the way, made me unnecessarily nervous) that he wrote for the City of Largo Vista in Texas. His setup was INCREDIBLE!!! Operators run around with tablet PCs, connected via VPN over the cell network. Everything looked sharp and screens were linked together intuitively. He had screens where he could create groups of operators on the fly that recieve alarms at different intervals until they're acknowledged. He showed generic tanks and valves that would display different values based on their types, but used the same objects/windows. This included animation based on setpoints (levels in a tank), an alarm history, trends, and even a custom note field that would record the operator/date_time and create an overlay icon on the main screen that showed the existence of a note. The trend screen allowed you to create, save, and edit arbitrary groups of pens. He had all sorts of reports autogenerated that operators needed to generate, and had an integrated pdf library of the ones they had to fill out by hand. It's hard to fully describe how sweet his SCADA package is - it seemed more to me like the product of a $1mil well written custom application that was tailored to the client. I've never seen such a thing from Wonderware, Rockwell, GE, or the others.

That webinar was fantastic! I'll keep my eyes open for more.

Cheating in Online Poker

2009-05-04T16:12:00.000-07:00

I just got back from a Las Vegas weekend trip. The poker gods were good on the cheapest ($1/2) tables Bellagio had to offer. My hourly return wasn't impressive, but I had a great time chatting with a variety of gamblers.

One particular story clung. A player said that his "friend" got a chance to witness someone "win" $13k in one night cheating at online poker. I'm not too impressed with the usual tactics, run a background application to gather statistics on opponents or even the recent Absolute Poker cheating scandal. This one caught my attention because it was so simple, yet incomprehensible to catch. You could multiply the benefit with automation/a program, but that's not necessary.

The scam involved playing 5 of 6 simultanious accounts at an online poker table. It shouldn't take a superstar to see that you could easily squeeze out single unsuspecting victims. You could even use a program to obtain more accurate odds since you see 1/5 of the deck. Connection details seemed obvious. I would use proxy services to route via different cities around the world, consistent from each account. The crux of the scam lies in the fact that you can easily create throw away identities - violating the security pricipal of integrity, that you can verify that someone is who they claim. Online gaming sites do monitor IP addresses (defeated with proxies) and users who constantly collaborate. However, you'd be pretty hard to spot with a pool of accounts that get used for short time periods.

What about the penalty if you do get caught? I can't imagine playing multiple online poker accounts getting you in as much trouble as stealing...

The best protection brings inconvenience - closely couple user accounts with real people. That requires you to give up all the personnal info that you don't want to share: valid ID, bank accounts, SSNs, etc. As an online player I'd feel much more safe if the site required heavy verification. Then again, I only play online for "points".

Doesn't Cyber Security Deserve a Stimulus? - Wurldtech

2009-04-28T14:11:00.000-07:00

A perspective worth reading - http://www.wurldtech.com/blog/?p=119

And another - Walt, I don't agree with every detail, but the message is spot on!

http://www.controlglobal.com/articles/2005/397.html

CISSP at last!

2009-04-28T13:19:00.000-07:00

I've had Shon Harris' All-in-One CISSP book on my shelf for years. I've taken it on long drives and flights without so much as cracking the pages of that great volume. It finally took a week long class and the discipline to study before I was ready to commit. I took the six hour plunge in December and recently found out that I'm officially a "Certified Information System Security Professional". Yay!

The real significance is embodied by standards organazations and my new professional community. It's all about the articles, networking, and even the new forum that I already spend too much time on. My goal is to continue to push good security practice in the Industrial (SCADA, HMI, controls) space.

Opinion: Do you need a $60,000 process historian to log data? (Control Engineering)

2009-04-05T13:09:00.000-07:00

Interesting article featured on Control Engineering

-- Control Engineering, 3/26/2009
Steve Hechtman, Inductive Automation

I wish to register a complaint. There is a rumor that has been circulating for years that relational databases are too slow for fast process data and that only process historians are up to the job. Vendors of process historians will cite sluggish performance and the lack of data compression as the reasons standard off-the-shelf relational databases won’t work. Apparently the last time they used a SQL relational database was a few decades ago.

While there may be some specialized domains where process historians have a niche, they are not a practical choice for most industrial applications. In effect, historian vendors are saying your Toyota Camry is inappropriate transportation because it is incapable of going 180 mph or finishing the quarter mile in under 10 seconds.

The rumor denigrating relational databases for poor throughput is baseless. A standard, off-the-shelf Microsoft SQL Server coupled with FactorySQL can log in excess of 100,000 tags per second using a desktop machine. In all likelihood, other factors such as the industrial network would become bottlenecks before the database does. Furthermore, today’s generation of SQL relational databases are designed to scale gracefully to power high-volume Website traffic, whose load peaks dwarf those of industrial controls applications.

Data compression is an area where process historians do score a point. However, even this consideration can be handled with standard off-the-shelf SQL relational databases. Take a look at the MySQL 5.0 Archive Storage Engine which achieves on average a four to one compression ratio. Proprietary process historians may beat that, but let’s get back to the point of practicality. Hard disk space is so cheap these days that even considering this point is becoming an anachronism. For the rare application that demands it, table compression coupled with intelligent data logging allow databases to compete even in this regard.

One crucial question that process historian vendors omit is: what are IT departments willing to support? When I make initial contact with IT folks, I always ask which relational database they use. Then I assure them we’ll work with that. This generally makes them very happy. Believe me, you want IT on your side or your project will end up on a data island which is useless in an enterprise system. Think of it from their point view; they have the training and tools, generally, to support just one type of database. With these tools and training they can support the database with scheduled backups, tuning and other maintenance.

Okay, we’ve heard process historian rants about relational databases; let’s talk about the downside of process historians. Let’s start with support. Just check the Amazon bookstore for any one of the proprietary process historians and you’re likely to come up empty handed. On the other hand, check for “SQL configuration” and you’ll come up with hundreds of books. How about finding people to support these proprietary systems? Good luck.

Then there is the concern about supporting relational data with a process historian. Frankly, the middleware layer is all about relational data. Time-series data, which is what process historians deal with, is just a fraction of what is needed in the middleware layer. Correlating batches, shifts, inventory, orders, downtime, quality, etc., is purely relational in nature, and these are the features that today’s enterprise integration projects demand.

What about a cost comparison? The process historian is going to be ten to thirty times the cost of a relational database using a driver like FactorySQL depending on the number of tags required. The controls industry is still backwards on this point and prefers to price its software per tag as though the extra tags cost money to manufacture.

In summary, we’re talking about practical choices. The Ferrari may be great fun, but do you need a $500,000 vehicle to drive the kids to school or would the Camry suffice? Likewise, do you need a $60,000 process historian to log data? A relational database makes a great historian, but the reverse isn’t true. A process historian cannot process relational data. For the vast majority of systems, a relational database has more than enough power to service the historical and relational data requirements, making it not just the practical, but the wise choice.

SCADA cyber security

2008-09-03T05:52:00.000-07:00

Wurldtech is all about SCADA security - I'm pretty sure their labs released the Wonderware and Citect exploits. They have a vulnerability database called Achilles Delphi. Not to mention their very cool looking Satellite test device.

http://www.wurldtech.com/

Google Chrome

2008-09-03T05:38:00.000-07:00

Google just released a Beta version of their browser - Chrome. Never thought I'd drop Firefox so quickly. First day and it seems killer.

Wonderware selects Kepware as endorsed partner for expanding device communications offerings

2008-07-25T02:57:00.000-07:00

Wonderware selects Kepware as endorsed partner for expanding device communications offerings. They're offering a branded version of KepServer Ex as "Kepware for Wonderware".

This move leads me to wonder if Kepware plans on supporting Archestra or if Wonderware made the intelligent decision of "3rd partnering" OPC connectivity. The latter makes sense since Kepware supports such a wide variety of devices, and, frankly, is so much better at device drivers than Wonderware.

Rockwell did it, why not Wonderware. I'm a fan of collaboration and standardization. Sounds good to me.

http://www.pandct.com/media/shownews.asp?ID=18531

Java VM on way for the iPhone

2008-07-25T01:07:00.000-07:00

Su-weet! You know what this means!? FactoryPMI on an iPhone or iTouch. What a cool idea! Unfortunately, they're currently only developing the ME (Micro Edition), which may only contain a subset of the necessary JVM.

It's good to see this level of commitment from Sun. Java is moving forward without support from Apple in this arena. It reinforces the applicability that Java is powerful on the cutting edge in the client/UI arena, not just with Servers/web applications!

http://www.infoworld.com/article/08/03/07/sun-iphone-java_1.html

update - Walt Boyes is talking about an SPC application for the IPhone on his blog.

Political Campaign Video

2008-07-18T18:48:00.000-07:00

Couldn't believe that I followed the link on a forum post. This video equitably knocks everyone, and it's damned funny.

Remember to vote in November!

http://sendables.jibjab.com/sendables/1191/time_for_some_campaignin

Free AB Linux data logger

2008-07-18T17:19:00.000-07:00

WebDock has been running a highly capable Linux version (60k transactions/min) in a plant since 2000. It works with Allen Bradley Ethernet PLC 5s and SLCs. I haven't had a chance to try it, so I'd appreciate, and will update this post with, feedback. Be warned, of course, that you get no promises, support, etc. That said, awesome! Maybe someone will put the project on Slashdot and get it moving!

Product Page
Download link
PLCS.net post

Dell Serious About Ubuntu: Launches First Consumer Linux PCs

2008-07-18T16:05:00.000-07:00

From Toms Hardware News. Pretty self explanatory.

As an aside, you get real *interesting results doing a Google image search for Ubuntu Linux - crazy Hot European Computer geek chicks ;-). Link on a blog post covering it (may not want to click at work or with children or the wife around).

http://www.tomshardware.com/news/dell-linux-ubuntu-laptop,5932.html

What does it take to get a PC with XP?

2008-07-18T04:18:00.000-07:00

Industrial software users always seem to dependent on old operating systems. Browse the PLC forums and you'll quickly realize everyone's asking about XP and complaining about Vista. This article provides good info on the Major PC vendor's stances on shipping machines pre-installed with XP.

http://www.pcworld.idg.com.au/index.php/id;1496591483

IT Blogger touches SCADA

2008-07-16T15:36:00.001-07:00

It's interesting to see the shift from nobody knowing what SCADA is to the emphasis of security in the space. IT Blogger Matt Hines comments on SCADA vulnerabilities and tips on keep SCADA systems safe. It's pretty obvious that he has no industrial/controls experience, but his tips and points are sound. These systems are no longer proprietary and often touch public networks. It's time we apply the standard security practices used by corporations and the military to defend our assets from cyber-crime. Chances are if you're reading this blog you have a good idea of the disconnect here.

http://securitywatch.eweek.com/flaws/scada_software_vulnerabilities_to_the_fore.html

http://securitywatch.eweek.com/exploits_and_attacks/tips_on_keeping_scada_safe.html

Java and the future of SCADA systems

2008-07-16T00:02:00.000-07:00

Web based, web launched, AJAX, Java, OPC UA - these terms are commonly thrown around along with HMI, SCADA, and even DCS these days. What's the big deal? More importantly, what's the point and what does it mean for you? The common thread is ubiquity. Yes, I'll say it again, ubiquity. I don't know why there's not a more common word with the same meaning - to be, or appear to be, everywhere at once. It's the perfect word to describe the Internet. So when somebody says, "Web based", think, "That means I can access it anywhere". That means it's firewall and VPN friendly. Nobody said anything about web browsers, static HTML, http, or the likes! Web applications, particularly Java and Macromedia Flash, run and feel just like local applications. They support multimedia, run constantly, and can initiate and receive updates without "refreshing". They're locally running programs with the huge benefit of not requiring a traditional "installation" process!

So where does SCADA come in? An important aspect of a modern SCADA system is to be able to get detailed realtime and historical process information. For most production managers, this is the most important data for their day to day work. It's like checking stock quotes - a 30 second glance should give you an accurate summary and a warm fuzzy feeling that you know what's going on. If something demands action you want to know. How much sense does it make to go to your stock broker every time you want a quick update? Should you fly out to Wall Street? No, it's valuable for you to be able to easily pull this up from your office desk, or home. What does this have to do with SCADA? Same principal applies. Who wants to go to the control room or plant floor every half hour? Ideally, you should get a portal or summary page that provides a high level summary with reports. The idea is that you have access to the same underlying data, but formatted as useful information to you.

What actually happens in an organization that provides "frictionless" data access to their core process is that everyone comes up with separate requirements. QA wants summaries, management gets reports, maintenance looks at long term statistics, etc. All that it really takes is a system that can be run anywhere and easily expanded - "easily" referring to without additional licensing pain.

Say it like it is, Hoff!

2008-07-14T07:59:00.000-07:00

Hoff's one smart dude when it comes to computer and network security - truly top notch. The context of this commentary was his field, but it's scary how spot on he is with respect to Industrial Automation software - particularly the early stages of FactorySQL and FactoryPMI. Sigh...

Ah, the innovator's dilemma...

If you have a product that well and truly does X, Y and Z, where X is a feature that conforms and fits into a defined category but Y and Z -- while truly differentiating and powerful -- do not, you're forced to focus on, develop around and hype X, label your product as being X, and not invest as much in Y and Z.

If you miss the market timing and can't afford to schmooze effectively and don't look forward enough with a business model that allows for flexibility, you may make the world's best X, but when X commoditizes and Y and Z are now the hottest "new" square, chances are you won't matter anymore, even if you've had it for years.

The product managers, marketing directors and salesfolk are forced to fit a product within an analyst's arbitrary product definition or risk not getting traction, miss competitive analysis/comparisons or even get funding; ever try to convince a VC that they should fund you when you're the "only one" in the space and there's no analyst recognition of a "market?"

Yech.

A vendor's excellent solution can simply wither and die on the vine in a battle of market definition attrition because the vendor is forced to conform and neuter a product in order to make a buck and can't actually differentiate or focus on the things that truly make it a better solution.

Who wins here?

Not the vendors. Not the customers. The analysts do.

The vendor pays them a shitload of kowtowing and money for the privilege to show up in a box so they get recognized -- and not necessarily for the things that truly matter -- until the same analyst changes his/her mind and recognizes that perhaps Y and Z are "real" or creates category W, and the vicious cycle starts anew.

So while you're a vendor struggling to make a great solution or a customer trying to solve real business problems, who watches the watchers?

/Hoff

Opto 22 leveraging web 2.0

2008-07-13T06:19:00.000-07:00

Walt reports on Opto22 utilizing web videos "optovideos" and other web technology user education.

http://www.controlglobal.com/soundoff/?p=3481

Superconductors in commercial power

2008-07-13T06:02:00.000-07:00

Pretty cool article about using superconductors for commercial power. In a nutshell, superconductors are materials that have a zero electrical resistance below a threshold temperature. These particular "warm" cables have to be maintained between 65-75 K, which is still pretty cold. Electrical current can flow indefinately without a power source meaning that you don't "lose" any power during transmission (i squared r loss). From a practical perspective in the energy industry, this technology allows great amounts of power to be transferred over physically small lines. Also beneficial for safety, is the fact that superconducting properties are quickly lost during "fault circuits" - reminds me of built in nuclear reactor safety mechanisms where the system can't function when it goes to a certain range out of spec.

http://spectrum.ieee.org/jul08/6428

Top Ten Worst Uses for Windows

2008-07-10T18:01:00.000-07:00

This Top Ten Worst Uses for Windows article is an interesting read. It shows the general outlook on control software that you're going to get from IT geeks - and a part of me totally agrees. I think that the author, while experienced in computer security, has absolutely no idea what he's talking about with the majority of his ten topics. It's about like waking up one morning and going to Asia, then reporting on how odd it is that everyone uses chopsticks. How dare they when metals exist - diners should simply cast a fork.

There are merits to his examples, but he's totally oblivious to the problems and available tools.
http://www.networkworld.com/community/node/29644

Microsoft to end OEM licensing for Windows 3.11 in 4 months

2008-07-10T17:13:00.000-07:00

Is this going to be a problem for anyone? LOL

http://arstechnica.com/journals/microsoft.ars/2008/07/09/oem-licensing-for-windows-3-11-finally-to-end-in-4-months

Linux for housewives. XP for geeks

2008-07-09T18:37:00.000-07:00

ZDNet article on shifting Linux demographics. (substitute "server" with "sub-$300 PC")

http://blogs.zdnet.com/storage/?p=342

The Google Format

2008-07-08T17:00:00.000-07:00

Google recently released their proprietary storage format, Protocol Buffers, to the Open Source Community. It's a platform independent format to serialize (programmatically store/encode) data and objects. The big advantage is that it is fast and tight - at least an order of magnitude over XML (Extensible Markup Language), which often seems to be touted as the magic bullet. The truth is that, like everything else, there are strengths and weaknesses to each - it really depends on your application. Need to be human readable - go XML. Don't know who you'll be talking to on the distant end - XML. But if you want to use a small, fast format for large data transfers, Protocol Buffers may be for you!

I'm not sure how I feel about this one. On one hand new formats and technologies are beneficial, particularly open source ones like this. On the other, standardization is king. "Don't reinvent the wheel" seems particularly relevant here. Ultimately, it's unlikely that you'll ever deal with this directly. Hopefully you reap the benefits inside an application that you didn't even realize was using the technology!

http://google-opensource.blogspot.com/2008/07/protocol-buffers-googles-data.html

http://www.betanews.com/article/Google_releases_its_data_encoding_format_to_compete_with_XML/1215530589

Business is booming for Wonderware

2008-06-22T06:28:00.000-07:00

Wonderware hired another 200 employees this year for a total of around 500. I'm no expert, but this still seems "small" for a software company and big for "nitch" software. They're developing and marketing toward specific industries and growing worldwide. They're fighting for legitimacy in the "Enterprise", even while companies like their "partner" SAP tries to compete directly, and powering the olympics. They even recently started selling Panelview style hardware to run Intouch 10 on. Great job from the leading SCADA company.

Read more here.

OPC UA Coming to life!

2008-06-14T08:56:00.001-07:00

Lots more OPC UA buzz - looks like it'll be really materializing soon - hopefully later this year. I personally can't wait! Remember, Iconics and Kepware already pledged to bring an end to end UA solution soon.

http://www.controleng.com/article/CA6559411.html?rssid=129

Edit - more contributions pointed out by Eric Murphy of Matrikon
http://www.ceasiamag.com/article-3936-theyearofopcua-LogisticsAsia.html
Automation.com OPC portal

Another SCADA security vulnerability

2008-06-14T03:23:00.000-07:00

What a great day - another SCADA security vulnerability uncovered! I don't want to see any industrial software fail, but I know the nitch products were written in a vacuum without security in mind. HMI packages are buggy and susceptible to attack - particularly the older ones still in use! We need to get over it, confront the issue, and fix it! Hopefully vendors have the integrity to self-test and release patches on their own, but this won't solve the problem. A developer simply can't find all of his own bugs in a test environment. The more computer security research groups start looking into these "little" but significant applications the better.

This time it was Citect, Wonderware had the last one. SCADA vendors be ready - you're next! That's you: Rockwell, GE, and Inductive Automation!

FireFox Download Day announced

2008-06-13T04:32:00.000-07:00

Tuesday, 17JUN is Download Day (FireFox 3 if you havn't been paying attention)! Check out a graphical world pledge map here.

Rockwell Automation selects Matrikon OPC for FactoryTalk Suite

2008-06-12T03:06:00.000-07:00

Press release from Matrikon and Rockwell Automation submitted to automation.com.

It looks like Rockwell is finally learning not to try to reinvent the wheel with every product (ie homecooked remote DCOM via RSLinx Gateway) in favor of getting professional support from those that know best. Customers will be getting the benefit of OPC Tunneller (very important now for most remote cases, they could have already used but probably didn't know it, should become obsolete with OPC UA). They also get the benefit of various DCS, telemetry, and PLC drivers. I'm not sure what "IT" drivers are but it sounds good. New (and highly promoted) are building automation drivers such as: BACnet, Johnson Controls, and LonWorks, which is a welcome natural fit to HMI and SCADA systems.

I believe Rockwell has been working with Kepware's KepServer EX for RSView. Correct me if I'm wrong - I don't think it would help with programming tools (read RSLogix) or the FactoryTalk versions of their software (read RSView SE series).

It's nice to see more collaboration between industrial software companies.

http://www.automation.com/content/rockwell-automation-selects-matrikonopc-for-3rd-party-connectivity-to-their-factorytalk-suite

The significance of updates

2008-06-08T10:35:00.000-07:00

Software updates - What a sticky topic! Do you pay? Are they free? How frequently should you install them? Should they be installed automatically? In some cases you find yourself vulnerable to exploits by not upgrading. In this case, you might "brick" your home router. Yes, we're talking about Windows XP Service Pack 3. Changes to the network stack manage to send Billion "BiPAC 5200-series routers to go into a constant crash and reboot cycle".

Here's my take. In general, it's good practice to stay updated. I'd hold off on critical systems, especially in closed environments (not on the Internet). For those cases you might consider a policy of first upgrading a test environment. At the very least, schedule upgrades during times that will minimize downtime impact. And - have a backup!

http://apcmag.com/router_crashes_blamed_on_windows_xp_sp3.htm

The power of the people

2008-06-08T10:31:00.000-07:00

I find myself frequently trying to convince industrial professionals to be active in their communities! Besides trade shows, I'm referring to forums. Specifically, MrPLC and PLCTalk. If you're not registered, go there! If you're not active - post a few. Try it, it's addictive!

In this case a member got a little voting help for a free home makeover. His place looked pretty bad and he deserved it, but it was the PLCTalk folks that made it happen.

http://www.plctalk.net/qanda/showthread.php?t=38863

Building Automation and OPC

2008-06-02T05:11:00.000-07:00

An AutomatedBuildings.com interview with Tom Burke of the OPC Foundation and Sean Leonard of Matrikon.

http://www.automatedbuildings.com/news/jun08/interviews/080527031642opc.htm

The interesting thing to me is how similar building automation is to industrial automation, yet how "stove piped" their respective products have been. Even the protocols, Leonard mentions "BACnet, Johnson Controls, and LonWorks", are totally different.

The interview rolls the grandiose OPC UA ambition into our sister industries, in addition to the direction you're used to, "up", namely Enterprise Integration. It focuses on OPC campaigning, providing interesting insight on what The Foundation is focusing on.

Good to see things moving forward. Early OPC UA buy in is going to be important.

Do your part!

2008-05-29T09:14:00.000-07:00

Mozilla aims to set a one day world Download record with the official release of Firefox 3. The date isn't set, but you can sign up to pledge to download it on day one here. I for one, love Firefox and have been running the beta for some time now.

SCADA Security unnoticed

2008-05-17T17:55:00.000-07:00

Core Security released an advisory on a Denial of Service attack where an unauthenticated user can take down a Wonderware system running Suitelink with a malformed packet. This was first brought to Wonderware's attention at the end of January. They acknowledged the bug by late March and provided a fix by late April. The advisory published in June.

Is it just me? A lot of people talk the talk about how important stability is with industrial control software. But nobody really cares. Trivial bugs (by comparison) get much more press. Could you imagine if a simple program could send a packet to crash a Windows server application? The press would go nuts! By Wonderware's account, they've sold 500 thousand copies that are running in 100,000 plants worldwide in virtually every industry. These plants are not all on closed networks! Good thing terrorists don't have access to Google, like I do.

Besides not wanting to share details with the public and not recognizing the problem in a timely manner, Wonderware did their part. It's a learning process that will hopefully go more smoothly next time. What astounds me is the fact that you don't see or hear about this except in a few very specific sites and blogs. I bet there will be a significant percentage of vulnerable systems several years from now - a combination of the weak promulgation of information and the reluctance of industrial users to upgrade unless forced. The latter caused by vendors releasing patches that haven't been adequately QA'd. This is one point where Inductive Automation is ahead of the power curve. Since FactorySQL and FactoryPMI upgrades nearly always come with free feature additions, IA users have created a culture of frequently upgrading their software.

But I digress. SCADA security is a huge bomb waiting to go off. There's a little talk on the subject, but the industry fails to take it seriously. I hope we can figure things out before the next 9/11 forces government intervention - how would you like your plant to operation like an airport? I'd like to think that level of regulation is unnecessary. We should each do our part in tightening down industrial security.

http://www.coresecurity.com/?action=item&id=2187
http://isc.sans.org/diary.html?storyid=4390

Inductive Automation Videos

2008-05-17T17:44:00.000-07:00

Between traveling to New Zealand and Japan I've been pretty busy. I'll try to keep up with small blog posts. I've had lots of great ideas that haven't come to fruition.

I've been working on training videos for Inductive Automation. I'd love to hear your feedback. Once I finish a few more basic series I'll be taking requests.

Some OPC UA links

2008-04-18T04:37:00.000-07:00

Great insight on the transition and future of OPC-UA from John Weber and Nathan Pocock of Software Toolbox. I hope he's wrong about the slow death of DCOM, but I wouldn't put a wager on it!

OPC-UA vendor perspective from Tom Burke of the OPC Foundation. It's a rather high level vision description of the architecture and commitment of the foundation. You're the man, Tom!

There are other good links. They came from here.

Linux obsession on the forums

2008-04-17T03:47:00.001-07:00

Lately the usual PLC forums have been unusually chatty about Linux. Perhaps it's the recent Windows update that installed the new version of the .NET Frameworks 2.0, the trend toward Open Office and Star Office, or the successful home experimentation with Ubuntu and Fedora. There's also been more complaints than ever about the complicated and equally crappy DCOM basis of OPC, which gets (probably unfairly) pinned on Microsoft. The OPC Foundation gets to be the knight in shining armor with UA. General users are correctly getting the sense that configuration, specifically security, need not be complicated and that getting rid of the old also brings the freedom ditching the entire (Windows) platform.

The consensus seems to be that programming software will remain Windows based for some time. Until users put the pressure on - and they're complaining, but not applying diddly-squat, nothing will change in that area. So it's a 90% solution - control systems can be chosen on a platform independent decision, but integrators will still be running around with Windows laptops to program the PLCs. That doesn't bother me too much. First, they break the things every couple of years - about as often as Windows seems to fail. Second, there's always virtualization, which has been getting easier and cooler over time.

I welcome the simplicity of the newer Linux build frondends and their (always) powerful backend. I remember when the thrill of playing with a new Linux system came to an abrupt halt when you realized that your devices weren't supported and the user interface sucked! It's great to see "normal users" have such a positive experience with installing such a new, foreign, system. If only they knew the complexity of the innards! Thank god they don't - they're users.

A Red Team strikes!

2008-03-09T23:59:00.001-07:00

Talk about an eye-opening experience! We invited a Red Team to do penetration testing on our network. A group of ubergeeks brought their laptops, tools, and toys and left with astonishing results! It's one thing to hear someone say that your server isn't up to date so "go patch it", but quite another to have someone steal a copy of your most valuable data in a short period of time, in a manner that's difficult to detect after they revealed how they did it!

The takeaway is that, if you expect to protect your data, you had better implement, maintain, and enforce Draconian policies on your network. Engineer the system from the ground up with security in mind. Implement IDS systems, baseline your network, track your user group memberships, and above all, train the heck out of all privileged users, then all users - they should be doing things like never logging in with their admin accounts, only using "run as" when necessary, like the Linux "su" mentality, and logging off of or locking their workstation when leaving for a moment. Keep updated with patches on all systems - servers, clients, printers, appliances, routers, whatever. Minimize where you can actually perform administrative tasks from. Apply your same password policy to everything that uses a password. Then: monitor, monitor, monitor. This is one of those "weakest link" deals. Powerful "server" applications like SQL databases (and many, many others) are great launching points - consider running them on "member servers" instead of domain controllers. Technically savy malicious users don't need much of a launching point. This doesn't even take "social engineering" into account, and users tend to behave stupidly from a security perspective.

After seeing what these guys did, I'd have a hard time imagining a network that wouldn't be vulnerable to that kind of crew - unless it's physically isolated, physically protected, and assured that malicious users can't get physically near it or trick actual users into inadvertently assisting them - an unrealistic network utopia. However, that said, there's a lot that you can do for network security. Don't look for a "magic bullet" - attack the low hanging fruit and take it from there.

VoIP - more than you bargained for?

2008-03-09T23:26:00.000-07:00

Thanks for the inspiration Carl - your objective viewpoint often sheds light on absurdities that I might otherwise fail to notice. In this case I'm referring to Cisco flavored VoIP. It's an amazing concept that truly delivers next generation communication capabilities. Who wouldn't want: virtually unlimited directory numbers, multi-line capability, much more wide open conference call ability, a centralized web based interface to administer/log the system, the ability to tie into POTS lines at the gateway or use a truly cheap international carrier, and much more?

I had always thought that the key selling point to VoIP is that it works on your existing infrastructure. You already have Ethernet. You're connected to the Internet on a relatively wide pipe. Why not plug phones into your system?

What if I told you that my Cisco rep pointed out that they made half of their income - yes, literally half one recent year on VoIP related sales? Holy Cow! You know how much Cisco equipment costs! How much could a phone possibly run!?!? This surprised me even after hearing that they wanted nearly $20k for call manager software for one switch that we already owned. How could that be?

Lets jump to my recent VoIP experience. We rapidly deployed about 20 VoIP phones on a network that was also to become busier than usual. Without getting into the specifics too much, the system was very sensitive to being properly configured. If the separate VLAN wasn't set up just so phones would randomly reboot and exhibit strange behavior. Some of the switches with a slightly older version of IOS had to be configured differently than the newer ones. Phones plugged into switches without PoE needed power cubes. Gateways, call managers, and phones needed to be configured and coordinated between sites. Bottom line - I love what VoIP brings to the table and am eager to learn more, but it's not a simple matter of plugging a phone into your network.

OK, back to Cisco sales dollars. In light of what I just presented my earlier statements should make more sense. How would you like to save money by purchasing some new VoIP equipment that will work with your existing infrastructure? Yes, great. Well, you may need to replace all your switches. Update your routers, (maybe?), buy some call managers and gateways while you're at it. Hey - at least you'll have a modern network. Your cabling should still be good.

Given all that, I still can't say that I'm opposed to VoIP. In fact, I'll call it progress. But you sure as heck better figure out what you're getting yourself into prior to making the big plunge! You don't want to make yourself that guy at your organization!

The future is...Linux?

2008-02-19T02:22:00.000-08:00

I just finished reading this year old article entitled, "Windows Vista, The best thing that ever happened to Linux?". Like many other pro-Linux (read anti-Microsoft) papers, it offers compelling arguments that I find myself agreeing with. In fact, my specific Vista complaints were very similar to theirs (all the hardware intensive eye candy that OS X does better, dropping important announced features: WinFS (relational database based file system), PowerShell (advanced scripting), SecurID (authentication for network resources), and PC to PC synchronization). They continue to enumerate Microsoft attrocities and go on to how Linux will dominate the future - think OLPC "One Child Per Laptop", the $100 PC.

I can't say what the future holds. I do know that every time I install Linux on one of my laptops (for anything other than when I used to program school projects), it ends up being too pesky to reasonably use. I get wireless networking/printing, DVD playback, a word processor, and everything else that I "need" straight - then never end up using it. But Linux always wins the theoretical argument - what could be better? I also know that well written Linux "appliances" work well. My M0n0wall router served me so well up until I bought a QoS enabled "gaming" router. We've been tossing around the idea of a CD bootable, lightweight Linux image designed to run a FactoryPMI client. Like Knoppix - maybe based on it.

In the end I always find myself going back to Microsoft - it's disgusting! They ultimately steal, buy, or reinvent the better technology, and it works well for them. Remember when SQL Server used to suck? I do - but SQL Server 2005 is a great product, thanks Sybase! They're getting into virtualization. It sucks now, but mark my words, they'll be giving VMWare a run for their money in a couple of years. What about Microsoft Office - do you really ever want to use anything else?

So this gets me to the recent official release of FactoryPMI Linux support. My first reaction was, "Who cares? You can already run FactoryPMI clients on Linux - they're Java based"! After thinking about it - it's the direction and comittment that matter. I align much better with Linux ideology, and the community is rapidly growing. Who else is tired of problems with every new major Microsoft release? Also, the Open Source community has a lot of software developed to bring to the table that's very powerful, but still a little rough around the edges. Microsoft makes good products that I like to use, but would rather not be stuck with. The percentage of HMI/SCADA vendors in bed with them makes me sick. Entrapment, not standardization becomes a predicament for end users.

In the end will it be Linux? Microsoft? Who knows - let the greater community decide. For me, the most useful products win. I'd like to see Microsoft include the power features that they've been advertising since 2004, and Linux to get progressively easier to use for all levels of user. Kudos to the companies that let users decide on what platform they prefer.

Industry news update

2008-02-08T15:17:00.000-08:00

Quick summary of industry news, compliments of InTech Editor Greg Hale's Blog. Thanks for the great info!

Wonderware - Predicting growth in Africa. Still working on India, China and Eastern Europe, but Africa's where it's at in the next 30 years or sooner. Full entry here.

Kepware - Partnering with Oracle and adding an OPC Client to their flagship OPC Server KepServer Ex to all pass through support for 3rd party OPC servers including diagnostics. Exciting! Full entry here.

Rockwell/Cisco partnership - release Rockwell branded Cisco Catalyst switches that offer easier configuration, configuration via RSLogix 5000, and pre-canned support for common (Rockwell Centric) Industrial Networking protocols as CIP and Ethernet/IP (Industrial Protocol). It's about DAMNED TIME! I've always said that AB makes good PLCs. They're finally leveraging developed technology for industrial applications instead of reinventing the wheel over and over! That said, I'd fear the price tag! Full entry here.

Virtualization and SCADA, mini-SCADAs

2008-02-01T08:33:00.000-08:00

Ever feel like a broken record? I get that feeling when "my" last 2 good post ideas came from following the crowd. Looking back, I haven't yet posted on SCADA security in response to the flurry of blog activity on the topic and the alleged "SCADA Internet attacks on the power grid" where the CIA keeps coming up - again and again. I've seen how the media quotes "the government", my 19 year old Seaman recruit sailor was "A Navy Spokesperson". The reporter was attractive - he didn't stand a chance.

Well, this post is supposed to be about Virtualization, an old topic in computing with renewed vigor! Other bloggers are talkin' about it, so why shouldn't I? The basic idea behind virtualization in this context is to work on logical hardware in a bit of a sandbox. Another nice feature is working from images (snapshots) instead of entire hard drives and machines. Imagine building your HMI exactly how you want, then taking a snapshot. With virtualization, you can run multiple instances of this. Your SCADA installation is an image file that can be run on any computer! Maybe you want to consolidate hardware, or maybe you want a similar environment for your QA department, or for development. The concept of "create once, use many" applies here.

Unless you're a software developer or running a computer lab, it's probably your servers that have the most to gain from virtualization. Servers are notorious for being resource underutilized, and are often fickle - how many of you would be comfortable "cutting over" most of the services that any one of your servers provide to another machine? You might not mind installing something new on a server, but I doubt that you nonchalantly move things around on production machines.

Let me paint a picture. You're starting a sizable new plant from scratch. You decide to buy a single $50k server from Dell as the main workhorse. It will be running "8 servers", (domain controller, database, web, email, etc) each with their own: memory, IP address(es), etc. Once the system is up, you decide that you don't want to install anything without testing it first. Fine, you use the same image on a different machine, install and test the software, then copy that image onto 'ol beefy. Suppose your email server needs more memory - you simply assign 4 gigs of the 32 total to that "instance" instead of 2. Now suppose that you're supporting something that's architecturally heavy, like Wonderware or RSView via thin clients on a Terminal Server. All of a sudden you need most of the processing power of your beast. Well, you can "move" instances to other servers. If we take this one step farther, you can actually have a virtualized infrastructure that would allow you to add hardware without changing anything. This type of setup can be cheaper, more flexible, and efficient than its traditional counterpart.

So we've covered how virtualization helps with servers in general. It can be a big help in supporting legacy HMI/SCADA technologies. It's really good for programs that are tough to configure (ah choo-Linux setups-oo). It seems less important for FactorySQL and FactoryPMI - they're already pretty good about being easy to install or move and having a lightweight footprint - especially on the client end with Java Web Start. You could set up a virtualized "production" and "testing" environment, both on the same computer, but this is pretty pointless since each installation would be better separate, and each could support the entire network on a desktop PC. I could see bigger setups greatly benefit from running virtualized instances.

Oh my - FDA 21CFR11

2008-01-20T03:33:00.000-08:00

Read the reg!

I don't know whether to laugh or cry at Title 21 of the Food and Drug Administration's Code of Federal Regulation Part 11. It dictates requirements for Electronic Documents and Signatures. It seems to written on technical topics by non-technical people. It's well intended, but deliberately vague on implementation standards - over the top in many cases. The funny thing is that most vendors tout a "Certified 21CFR11 compliant" stamp on their hardware or software. The sad thing is that end users fail to realize that 80% or so of the requirements have to do with their: processes, training, documentation, etc.

I was getting so frustrated by a couple of users asking specifically how to implement a 21CFR11 application in FactoryPMI. They wanted point by point descriptions all the way down the list. I was first approached in 2005, but don't know of any users who have actually attempted a fully compliant project. I've had other users working in a 21CFR11 "compliant" facility that just wanted to use FactorySQL or FactoryPMI beside the application. I had to bite my tongue when one said that a hardware datalogger satisfied that requirement. Did anyone there actually read the regulation? Oh gosh! Maybe a good integrator helped them make their whole process compliant. I know for a fact that you can't throw any single piece of hardware or software and make it happen. Things like 11.300(e):

Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner.

Carl made me feel better when he pointed out that 21CFR11 isn't a compliance standard for HMI/SCADA design software. Its a compliance standard for HMI/SCADA project implementations, which are two totally separate things. So, I wrote a white paper on creating a compliant 21CFR11 application with Inductive Automation software and didn't feel so bad about all the, "it is the responsibility of the designer..." answers. I might add that the "big vendors" white papers have similar responses.

I'd like to see someone actually do this - but it'd take planning on the front end and someone with experience. It would be absurd for an Integrator or end user to take this on from scratch, without help, as a first project.

Fascinating interview with Sun CEO

2008-01-20T03:11:00.000-08:00

I was recently directed to read an interview with Sun Microsystem's CEO/COO, Jonathan Schwartz regarding his Open Source business strategy. This is particularly relevant given their new MySQL acquisition.

http://blogs.cnet.com/8301-13505_1-9757417-16.html

Jon stressed the necessity of driving adoption to generate revenue. He claims that seemingly competing products like Red Hat and Solaris complement each other because both are going for the same goal - look out M$! He makes a distinction between his "community" (users) and "market" (paying customers), insisting that one leads to the other. A casual user or developer shouldn't pay for his software, while that same individual might recommend purchasing it with a hefty support plan for a mission critical operation.

Sounds good to me! Establish a solid brand. Sell "systems" and "the experience" instead of hardware or software (think Apple). Provide an abundance of value without squeezing pennies from your customers - this also acts as free advertising. We'll see to what extent a certain industrial software company with killer products can follow suit.

Enterprise HMI Systems: Is the cost too high?

2008-01-19T00:34:00.000-08:00

Another article by Steve Hechtman. He takes an interesting approach at the role of the industrial integrator in Enterprise Integration.

Modern Manufacturing

One hears so much about Enterprise HMI and Manufacturing Execution Systems (MES) that it's easy to suppose these systems are everywhere. A visit to almost any manufacturing facility will show the contrary. A recent article in InTech magazine confirms this with a discussion about “the promise of tomorrow's systems” as having “a global view of all processes within the plant via the corporate intranet/ portal ...” Why is this a promise of tomorrow? Does the IT sector not have the tools and standards to accomplish this right now?

Let's get down to basics. Production orders need to go to the production floor and production results need to come back to management. The information flow should be instantaneous so that real time corrections can be made. Relevant historical information should be available to management at all times. When these mechanics are in place management can do its job. Without them, management is likely to be loose and error prone at the plant floor level.

The real question here is why, when the rest of the world is getting along with inexpensive and standardized IT tools, do plant floor islands of information still exist? The technology is there and the need is recognized. So why the disconnection?

Square Peg in a Round Hole

Most control system manufacturers have implemented and defended highly proprietary protocols in their controllers in an effort to lock-in end-users. This has been the game since controllers first hit the plant floor and the inevitable result has been high prices due to lack of competition. So it's not surprising HMI systems offered by these same vendors are priced an order of magnitude higher than comparable IT technologies. One thing that all HMI vendors seem to agree on is the pricing model and none dare violate it.

It's doubtful though that price alone would discourage broad deployment of Enterprise HMI systems since in a production environment the ROI should easily pay for the systems. But the more likely reason for lack of full adoption is that such systems are out of tune with mainstream technology. It is certainly evident that IT departments are resistant to deploying and maintaining these systems on their networks.

Two Different Worlds

The manufacturing sector is about five years behind where it should be when it comes to integrating enterprise to the plant floor. Nearly every other part of the manufacturing enterprise has been integrated with the latest technology and this has pushed right down almost to the plant floor where it stops short.

We have a picture where controls manufacturers seeking new profit opportunities have pressed up into the IT arena but their offerings aren't standard, are overly complex, are difficult to maintain and the pricing model unduly discourages full realization of what these systems could be . Conversely, IT departments and ERP vendors have tried to press down into the plant floor but this usually fails because plant floor control systems are highly specialized and aren't well understood. A lack of knowledge in this area can be a dangerous thing. A humorous example is when one IT department decided to “ping” all of the PLCs in a plant and automatically re-download non-responders. These are two different worlds and neither is likely to deliver a workable solution.

The Controls System Integrator is the Key

Today, with OPC standards and with inexpensive OPC servers for practically any control system available, the only thing preventing successful integration of control systems and enterprise systems is a lack of knowledge. The control system integrator is in the fortuitous position of already having controls knowledge (the most difficult part) and only needs to arm himself with IT knowledge. A controls system integrator will find this technology rather easy to master. He might be surprised at the support and assistance IT departments will extend to him now that he is dealing in “their technology.”

The controls system integrator is well poised to be the fence mender, the gap bridger and the builder of workable Enterprise HMI and MES systems for at least the next ten years.

***

This article was written and provided by Steven A. Hechtman, President of Calmetrics Company. Calmetrics is a control system integrator who specialize in efficiency issues and the development of simple, powerful, connected systems. They offer the following services:

Design and programming of PLC control systems.

Connecting PLCs to Powerful WebApps and databases.

Producing clear and concise control system documentation.

Emergency troubleshooting and support.

Delivering PLC control and troubleshooting training.

Advising on potential areas for efficiency improvement.

For more information on Calmetrics, please visit www.calmetrics.com

Web-based HMI: An emerging trend?

2008-01-19T00:26:00.000-08:00

I just dug up an article on web based HMIs by Steve Hechtman from automation.com. It is a little dated, but still very relevant. I was even quoted in it :-).

Realization of Web-based Control

Once considered impractical for applications requiring responsive animation and real-time control, a new breed of web-based HMI system is starting to appear on plant floors and in manufacturing enterprises. “Java (web) based systems can now deliver sub-second response, rich animation and natural integration with other parts of the corporate information infrastructure,” touts Nathan Boeger of Inductive Automation. Unlike traditional systems, these web-based systems can economically be extended to every aspect of a business such as QC, maintenance, logistics, plant manager, and so forth. Now every participant in the manufacturing cycle can have unprecedented access to vital plant production information.

It's easy to see why web-based systems are gaining popularity. Web-based systems install and run client applications from any web-browser and when users login they always get the most recent version of an application. There are no client licenses manage, no tedious software installations, no application files to copy over and no communication configurations to setup. IT departments are willing to embrace technology they understand. All this is in sharp contrast to traditional systems. The economic advantages of using web-based systems are compelling. The bottom line is, web-based HMIs systems fit well with the rest of the enterprise and facilitate the smooth flow of information throughout an organization without unnecessary difficulty and expense.

Security Issues

When potential users first consider using web-based technology they usually ask about security. Just how secure are web-based systems? The question is especially valid now that post 9/11 committees have deemed HMI and SCADA security “one of the most serious risks to our national security.” Traditional vendors rely heavily on “security by obfuscation” which has never been considered a safe practice. Web-based systems, on the other hand, are already positioned to leverage standard and proven web security techniques as administered by IT departments.

It’s only be a matter of time before legislation mandating minimum HMI and SCADA security requirements will surface. Traditional providers will likely have to overhaul their products to come into compliance. They will welcome this day since they will sell lots of mandated security upgrades.

Seeing What's Next

Functionally speaking, HMIs haven't changed much over the past five years. “HMIs that just do operator interface tasks are a commodity, and you can buy them dirt cheap off the Internet…The real action is in HMIs that provide web access, interface to higher-level enterprise software, perform MES functions”, says Rich Merritt, Senior Technical Editor of Control Global, in his article, “HMI Software is disappearing”.

The book Seeing What’s Next by Christensen, Anthony and Roth, introduces theories to predict major industry changes. These theories are supported with interesting historical examples. Applying these predictive theories to this industry suggests incumbent HMI vendors will continue to service their large existing market without much change. They will probably not compete with their own model. On the other hand, web-based vendors will find success selling where traditional vendors have failed; to those companies who refuse to spend big bucks on systems perceived as being unnecessarily complex, cumbersome and overshooting needs. This is likely to lead to explosive growth for web-based systems in market segments which have been unfulfilled by traditional systems.

Anyone familiar with manufacturing knows the majority of factories barely implement information technology at the plant floor level. There are exceptions, but when you see clipboards being used to record schedules, downtime and production, when you envision how things should be done, you finally come to realize this is a vast untapped market.

There is an accelerating pace of web-based systems being installed in what was essentially a non-consuming market. Users are finally getting what they want – the functionality of an HMI with the economics of a web browser. The real question is not whether web based control systems are an emerging trend – they cannot be stopped, but rather which vendors are poised to jump on the bandwagon and deliver the technology.

***

Design and programming of PLC control systems.

Connecting PLCs to Powerful WebApps and databases.

Producing clear and concise control system documentation.

Emergency troubleshooting and support.

Delivering PLC control and troubleshooting training.

Advising on potential areas for efficiency improvement.

For more information on Calmetrics, please visit www.calmetrics.com

SCADA 2.0 - Present and Future: SCADA on the Web

2008-01-17T14:34:00.000-08:00

SCADA 2.0 - Present and Future: SCADA on the Web

edit - Don't know how it took me over 2 years to find this blog. His early posts are particularly insightful:

http://scada2.blogspot.com/2005/08/so-what-is-scada-anyway.html
http://scada2.blogspot.com/2005/08/distributed-scada.html
http://scada2.blogspot.com/2005/08/opc-promise-of-connectivity.html

Sunny day for MySQL

2008-01-17T04:55:00.001-08:00

Forgive the crappy title - and the plagiarized ideas. It seems everyone's recycling the same info. Sun recently announced plans to acquire MySQL for nearly $1 Billion. The companies should work well together. Sun is the biggest proponent of open source software - think: Open Office, Java, Netbeans, and Open Solaris.

I don't understand the economics or motivation behind the move. Does Sun intend on shifting the demographics of the server side scripted web site scene from the, oh-so-popular LAMP (Linux, Apache, MySQL, PHP) to some form of SAMP? Solaris was the first platform that MySQL ran on. Perhaps Sun is making a move at the mighty Oracle. Historically, supporting open source was justified as a means to promote hardware platforms. It certainly makes them the "good guy" in my book. Look how far that philosophy carried Google ;-).

The real question is how this affects the little guys. It's premature to make specific predictions. My gut feeling is that end users will benefit. Sun knows Open Source. They're committed to maintain the same "mission", staff, and direction. Hopefully they throw development resources to MySQL and make the platform more capable.

This looks to be a win-win for users. It makes me nervous that it's sitting on the shoulders of a baffling billion dollar move. Am I missing the obvious? It screams sellout to me - yet I can't think of a better company for MySQL to sell out to than Sun. So, I remain optimistic that this acquisition will drive a better, free product for all.

Web based SCADA - what's the big idea?

2008-01-04T14:25:00.000-08:00

My control system isn't on the Internet! Why should I care about web based HMI or SCADA systems? I've been discussing these points for 5 years now, which is at least 10 years behind the corporate world. My ultimate goal is to educate end users on the pros and cons of a technology that may be very relevant to them.

"You'll sail upwind by a fire under your deck - I don't have time for such nonsense", my recollection of a quote from a Civilization video game. The point is that the application of new technologies isn't always immediately obvious. It helps to take a step back to consider what you're trying to accomplish.

Let's break down your SCADA system. Visibility into your process is probably the single most important aspect, which may come in the form of numbers, pretty graphics, etc. You need to be able to see the realtime and historical status of your operation. Next comes control. The ability to adjust setpoints, start and stop things, etc. After that it probably branches into: data input, reporting, alarming, interfacing with other systems, specialized applications, etc.

Sound like things a stand alone computer software package can do? Yes, that's an ideal version of the HMI that you're used to. Sound like something an HTML web page can do? Absolutely not! The first thing to realize is that "web based" is referring to a technology set that's prevalent on the Internet.

Now think of all the cool animated web sites you've been to. Java, Flash, ActiveX, DHTML and AJAX, and other technologies enable rich multimedia content. The big advantage is that the framework exists to run such applications with only a web browser. Instead of dragging CDs along to each HMI seat to install the software, then necessarily configuring: projects, data connections, PLC connections, server connections, etc, a new "web based" client need only the URL and permissions to access the system.

The next advantage has to do with routing and existing infastructure. How easy is it to connect a new computer on the other side of the plant to your legacy (non-ethernet) PLC network? It can get pretty tough! You probably already have an IP network throughout your plant to ride. What about realtime connections to your other locations? Again, our existing transport infastructure simplifies things with a "web based" approach. Does this mean that it has to be on the Internet? No, but it can. Or you can establish secure tunnels over a public network (Internet).

OK - so a "web based" approach brings nearly the same capabilities to the table, and can be easily launched from anywhere without the "traditional" lengthy installation and configuration process. What about safety, responsiveness, stability, and security?

It's true that the Industrial arena has considerations that don't exist elsewhere. This is why it's important to deal with people and companies that specialize in your trade. However, dealing with proven standards and technologies on the scale of decades of development and millions of users makes more sense than blindly trusting the "big" industrial software companies homebrewed nightmares. They are small as software companies go, and began with single terminal requirements that were much simpler. It's in their best interst to stretch their legacy junk in favor of backward compatibility, but even they are slowly turning to standards based approaches.

Remember that the Internet didn't grow out of the necessity to email grandma - it was the evolution of a hardened system designed for C2 (command and control), specifically launching missiles. Keep in mind that standard encryption based security schemes keep your investments safe from hackers. Web based SCADA provides a very capable, centrally managable, scalable and secure, IT supportable system. Wow!

700Mhz to Freedom

2007-12-14T05:14:00.000-08:00

In case you've been living in a cave, the FCC will be auctioning bands of the 700 Mhz spectrum by 2008 - television broadcasts will finally be exclusively digital. Google's pledged to meet the starting bid of $4.6B. The EM Spectrum is incredibly valuable, but the 700 band is particularly useful because of its range and penetration properties - think of where you've been able to get TV reception! In general, higher freqs are more directional and lower ones don't carry as much data. The ranges have their own properties in terms of the materials that make them scatter (foliage for example).
The real question will be in the spectrum usage and policy. Google's pushing for (read: I believe has successfully lobbied for) open standards for wireless Internet connectivity - the big telcos want to be able to lock in their own service and access devices - think Cingular and the iPhone. As far as I know nobody's saying this has to be used for 'net access.

My hopes - abundant cheap high speed Internet everywhere in the US to include portable and handheld devices. Oh yeah!

Lots of talk here - I'll post when something eventful comes out.

New version of FactoryPMI released

2007-12-14T04:47:00.000-08:00

FactoryPMI 3.1.1 now supports Java 5 and 6 and includes its own SSL support - I still promote the use of VPNs! As Carl points out, it's ironic that the current release of Java 6 has a known SSL bug - doww! The "standalone mode" option should help (non-clustering) users by detecting network settings in various environments.

I got a chance to play with the free FactoryPMI ActiveX plugin. It's pretty sweet! Lemme preface this with, "I hate ActiveX, Microsoft's failed attempt at Java applets that they've since dropped in favor of .NET". The cool thing is that ActiveX controls have access to Windows APIs and let you do cool things like embed IE, Adobe Acrobat, and MS Office instances in other apps - namely FactoryPMI! All the HMIs have been doing the ActiveX thing for years. IMO, embed an ActiveX control in IE that controls a physical device = bad. Use an embedded ActiveX control to read a pdf or Excel spreadsheet...fine. I'm going to cry if I see too many FactoryPMI users embed Software Toolbox-esque ActiveX controls in their applications. We can do better with native Javabeans!

Dec 12, 2007 - FactoryPMI 3.1.1 released. See full changelog here:
Release Notes Java 6 + SSL The main features of this release are SSL support and Java 6 support. Ironically, Java 6 (as of "Update 3") has a bug in its support for SSL. You can prevent Java 6 from being used for Clients and Designers by setting the Gateway System Settings property Allowed JREs to "1.5+". Sun tells us that this will be fixed in Java 6 update 4, to be released later in December.
ActiveX Plugin - This release also makes available a new free plugin, the ActiveX Plugin. This plugin adds new components to embed common Windows controls into FactoryPMI windows, such as Adobe Acrobat Reader, Internet Explorer, etc. You can find this plugin here.

What makes a SAN?

2007-12-14T04:34:00.001-08:00

I'm sure others share my burning question, the one that keeps me up at night - WTF is a SAN? Dude, the data's in the network. Kinda reminds me of Owen Wilson in Zoolander.

By definition the SAN is accessed over it's own network - 4 Gbps fiber channel in the case of the EMC equipment I've dealt with.

In simple terms, you get this thing with hard drives in it that you plug your servers into. It's very flexible in terms of logically defining volumes that span these drives. You can then decide which computers get to access which volumes - they become local drives to the host through a combination of drivers and software. Suppose the host dies - it's easy enough to "cut over" the volume to another computer.

So it's flexible - what other advantages do you get? For starters it's on it's own fast network. You can do normal backups over the SAN without saturating your network like you would using a NAS. The gear is also engineered to be very reliable (read expensive). Everything can be redundant. Each host and storage processor is wired into 2 separate star topology fiber channel switches. Everything has redundant power supplies that can be plugged into 2 sources. The storage processor deals with things like read/write requests and all the typical RAID operations. It can do cool things like resizing LUNs on the fly, but those operations make the system grind for awhile. You have many levels of flexible configuration. Terminology probably varies between vendors. I'll give a broad overview, but not get into detail. Array enclosures fit on a rack and hold disks. Zones are basically VLANs for fibre channel - storage processors see all. Raid Groups have disks as members that share a common RAID type. LUNs are logical volumes that are typically subsets of Raid Groups, but could probably span them to make things confusing. Storage Groups are sets of LUN->Host mappings.

Nothing magical here. It's just like anything you've ever done with hard drives or RAID arrays, except that you get more logical levels to work with. You still don't want to let multiple computers control a LUN - lack of Cache Synchronization would corrupt data between them. It's possible by running clustering services to synch up the computers. In my experience the additional complexity for that type of solution often outweighs its purpose. We have a copy of that software but don't use it - just like we have a plugin for Backup Exec that reads from the SAN directly but we now just read from it as a logical volume - our ethernet backbone is sufficient for backups in the middle of the night. It's all about the simplest solution that meets your requirements.

Cool story - the contractor that introduced me to SANs used to sell them for EMC. Their big feature was a SAN automatic data replication scheme that sounded conceptually like offsite mirroring. I forget the exact numbers, but he was saying that some percentage, maybe half of the twenty something big customers of theirs residing in the Twin Towers on 9/11 that had that feature were back up quickly. All the companies without that feature couldn't come back up in a timely manner - bad juju for financial institutions and went out of business shortly thereafter. The only exception was a company that didn't go out of business - it was bought out for cheap.

RSDoran, you'll be missed

2007-12-09T01:48:00.000-08:00

Ron Doran, a longtime automation expert and friend to many in the field, passed away on December 2nd 2007 from a stroke. Despite his retired status, RSDoran enjoyed helping the newer generation with automation support as evident by his final post count of 7380 since 2002 on plctalk.net.

Ron was a good guy. Sometimes we agreed, other times we argued, but he was always helpful and never one to flame. Phil Melore, the owner of Plctalk, is collecting money for Ron's family. Here are participation details if you're interested. We'll miss you, my friend.

Flattery - Kind of...

2007-12-09T01:19:00.000-08:00

I was quoted out of context and without permission on a Tofino sales brochure. I found out when a member of the Inductive Automation Integrator Program contacted me about the device. It really annoys me that I interested enough to contact the company to volunteer to beta test/review a unit and they tried to sell me one and blew me off. Then they come back quoting me in their sales brochure regarding a device I've never seen.

In a control.com thread, Walt Boyes and I were dueling over network security in the industrial arena and the role of IT. Walt busts out with this "revolutionary edge peripheral firewall ", the Tofino device. I come back expressing interest in the idea, noting that IT should still be involved in such matters since they understand the technologies.

I emailed Walt about giving permission for his quote (which is located above mine). His response, "As a public figure I don't have a choice about being quoted, but I'd prefer that they say what I actually did, especially when it is written down (like in my blog)."

My quote was a little farther off - see transcription below. Walt emailed the company. I haven't decided on my next move yet. I really should have said "idea" instead of "thing".

(Walt)> Then he put the Tofino firewall in the line between the network and the PLC, and the PLC absolutely disappeared to the blackhat software.

That's what a firewall does. I think the Tofino device is a cool thing - it allows a PLC type who has no idea what he's doing with networking or security to provide some amount of protection to the plant floor - an innovative idea. However, a good IT department would do better. Worst case they could work with you on configuring that device, and actually understand what's going on. "

became:
"The TofinoTM device is a cool thing - it allows a PLC type who has no idea what he's doing with networking or security to provide protection to the plant floor - an innovative idea."

Head First SQL

2007-12-09T00:52:00.000-08:00

Simply put, Head First SQL is the bomb! A Slashdot review prompted me to order a copy from Amazon. This is one of few technical books on my shelf that will likely get put to use more than once! Perhaps it takes a creative female author to spark interest into an otherwise boring topic. Don't let the large fonts, pictures, and seemingly handwritten annotations fool you - Beighley leads you through some technical introductory SQL. The great thing is that her examples are about as simple as they could be given the topics she's teaching. It's not a reference, but good for anyone who isn't already a professional database admin/developer.

Head First SQL is uses MySQL in its examples, but is fairly vendor neutral. It does a great job explaining the basic rules of good database design. I have some level of appreciation for these concepts, but couldn't lay a finger on describing them in general. Her description of using atomic data in tables, particularly in discussing: one->one, one->many, and many->many relationships were informative and thought provoking. These concepts become VERY IMPORTANT as you try to update, edit, and query your data later. The book covered all the very basics up through things like: normal form, left inner joins, and using foreign keys.

Take the time to follow the examples in Head First SQL and you'll be a proficient SQL user in no time.

Death of a computer

2007-12-08T18:35:00.000-08:00

I should be happy. This only proves how right I really am. Windows PCs are fragile - period. I've participated in countless debates over three separate industrial control forums regarding this. My stance remains that PC based controls has unlimited potential, but off the shelf PCs running windows are too clunky to be the (dependent) "brain" of the operation. Their cheap price and huge computing power makes them ideal as a replaceable interface terminal. I received numerous counter arguments that if you treat a PC like "valuable business equipment" there won't be any problems. These were supported by factory examples where a PC has been "running for years". Forum posters downplayed my MTBF argument of electromechanical devices, particularly power supply and CPU fans. They claimed that Windows is perfectly stable - the exact same years after installed if dealt with properly. YEAH, RIGHT!

I want the PCs they're using. Better yet, I want a hit of whatever they're smoking! I've worked several IT jobs, and have done plenty of consulting - both at the desktop and server level. The helpdesk at my current job constantly has to Ghost (re-image) desktop clients. Ever dealt at a site with a large number of servers? You're constantly replacing shit!

In any event, my poor computer suffered a terrible hard lock up and Windows is toast. I've gone through all the usual troubleshooting. This one is difficult since it boots off of a RAID array whose drivers aren't included with the XP (or Vista) CD. It doesn't matter - it's been a couple of years and the box has been heading downhill. I didn't loose any data (will have to look at my iTunes library). I hope there wasn't an underlying hardware problem. Installing on my new hard drive should bring that to light.

The biggest pain is all the program installations. I wish that more of my applications were lightweight like FactoryPMI clients. I'm considering installing Ubuntu and virtualizing Windows. At least then I could create a baseline image as a point to revert.

update - after buying a and installing a new hard drive my computer fixed itself. Well, kind of. A full Checkdisk fixed drive index errors on some important .dlls. The problem was substantial enough to prevent me from booting into any version of Safe Mode or Last Known Good Configuration. If my drive controller wasn't so quirky, I would have been able to fix it with the console (DOS prompt with a few apps) by booting from the XP CD. I also could have used Knoppix to troubleshoot the issue. It was only after a reboot after attempting to format the new drive with a Vista CD that XP decided to run scandisk. Baffling, but I won't worry about it - black smoke.

The first thing I did was a recent iTunes backup, the second was update this post. Take this time to BACK UP YOUR DATA. If you've got a workable backup solution for your home PC, you're smarter and more on top of the game than I. My "backup plan", if you could call it one, is copying my important work to an external hard drive, occasionally (rarely) burning DVDs, and sometimes copying files to remote machines online. I'll check into online remote backup plans and post how it goes.

A little more on QoS

2007-12-07T17:42:00.000-08:00

In response to Lrac's question about how QoS works...

First a few relevant definitions from here and info provided by wikipedia:

Packet Delay or Latency: is the difference in time between when the signal is transmitted, and when it is received. Delay is typically broken down into two components, a fixed delay and a variable delay.
Packet Jitter: measures the variation in arrival rates between individual packets.
Packet Loss: is a measure of the number of packets from the original data stream that do not find their way to the destination.

Quality of Service, QoS is a subset of traffic/packet shaping that addresses Packet Jitter and the variable latency delay. Early approaches reserved fixed amounts of bandwidth for certain applications. Modern QoS enabled routers/layer 3 switches can prioritize their queues based on DSCP markings - a 6 bit designation in the IP header that tells the traffic type. They could just as easily base this on source or destination IP addresses. Similar layer 2 schemes can be used based on MAC addresses or VLANs. There are different scheduling algorithms and implementations, but the simple bottom line is that your time sensitive IP traffic can be prioritized. VoIP calls won't have the delay, and big downloads should still go about as fast.

I haven't gotten to programming QoS in IOS on Cisco systems. My friend said that the QoS configuration on his home router was straightforward. You simply give devices a priority. If it's anything like ACLs (access control lists) on routers, the device keeps track of all the MAC and IP addresses of devices that have connected to it. You would simply open the HTML based web configuration page and click on devices to prioritize - the Xbox and VoIP phone in my friends case. I'll post a mini review when I pick up my own QoS "gaming" home router.

More on packet shaping to follow.

Victory over my Sys Admin

2007-12-04T04:42:00.001-08:00

Warning

Our building has 2 commercial DSL drops via the same company on opposite sides of the office. One has been up providing Internet access for years, plugged into a Cisco Catalyst 2950. The other new one was to be plugged into a Catalyst 3750. For some reason, plugging in the 2nd DSL modem (CSU/DSU) would drop Internet access on the other side. The lines each tested well to our provider.

After a lucky hour of troubleshooting, I determined that the second modem could provide Internet access at the same time that the other "network" was up. As soon as you plugged that 3750 switch into the modem (that was only connected to the ISP), Internet access would drop on the other side. It seemed like phone wires were crossed.

I had a sneaking suspicion (read guess) that it had to do with the Switches Spanning Tree Protocol (STP), a layer 2 algorithm that protects you from loops in the network by logically creating a "spanning tree". After describing the symptoms and my guess to our Systems Administrator, he was sure that wasn't that problem. Sir, there's no way, with my understanding of STP, that this could be the problem. Maybe something similar, but STP just blocks single ports. After observing that the single port with the modem on the 2950 was orange (in blocking mode), he still didn't believe me. In his defense, we were troubleshooting a lot and I've only mentioned the relevant findings. Only after my network engineer had no idea did I contact the technical people at the ISP. He'd seen the problem before as described in a few sentances. "I don't know what causes it, but we've seen it". Only then would my sys admin modify the STP settings. Viola, it worked perfectly.

If you didn't follow what was happening (I don't blame you), the two Cisco switches were forming a spanning tree (that happens when you uplink switches) across the DSL gateways and through the ISPs cloud. We were supposed to be able to think of the two circuits as totally separate. Weirder yet was why that spanning tree blocked the port plugged into the modem on the old Cisco Switch. The new one was fine. The ISP said 2 new switches wouldn't have that problem.

This post wins the "Most boring" award. What I'd like to convey for Industrial readers is that growing networks require a specialized skill set. IT can be your friend and your ally. It's important to break that historical tension between plant production and IT.

SQL Standards. And standards.

2007-12-04T03:58:00.000-08:00

Who comes up with this shit? Seriously? Is it human nature to try to make everything your own, or a flawed side effect of our culture? (In that case it's royalties). I'm talking standards, of course! Why can't we all just get along? Consider SQL. We like SQL! It's simple, powerful, and has proven to be conducive to interoperability. Don't believe me? Check out all the database frontends that work with so many "flavors" of SQL. There are innumerable database driven applications that could run on any. Why is it so hard to get along? We've got ANSI and ISO SQL (think 7 layer OSI reference model - let's implement that...right...?). Microsoft's gotta be different from Oracle, and MySQL, and IBM DB2, and PostgreSQL - and they're all subtle-ly (is that a word?) different from each other! Cumon M$, why do you have to use the TOP keyword instead of LIMIT to limit returned record sets? You know your programmers could efficiently implement both? Can't just pick on Microsoft, though - they all do it! Going to a unified, or standardized language set, while maintaining backward compatibility, really shouldn't be that big an issue. Everyone's products will be the better for it.

Let me tell you about designating quality codes for object overlays when designing SQLTags in FactoryPMI. We could have chosen whatever quality codes we wanted. My birthday could have been a tragic error! But we chose to follow OPC convention. Why? Standardization. I have no idea why 192 is the quality code for good data. But someone smarter than me said it would be. And so it went...

I was prepping myself for a long rant about standards - I was going to tear Sony a new one. But I'm tired. I'd rather go to sleep.

Intel back to Roswell. Again.

2007-12-04T03:10:00.001-08:00

Our buddies at Intel are pulling some super sci-fi crap out of who knows where!

Let's recap a broad stroked CPU history as I recall off the top of my head:
x86s - Intel leads, AMD "compatible"
Pentium - Intel stomps on AMD for years (maybe 6) through the P4.
Athlon - Somehow AMD jumps back in it and, for the first couple year period, establishes itself as the dominant product. Through the Athlonx2, clock speed was lower for a faster product.

OK, close enough battles! What matters for modern CPUs:
1. Speed - decided by benchmarks not Mhz.
2. Cost - to determine the valuable price/performance ratio.
3. Power usage/heat dissipation - Recall that 486s shipped with passive heatsinks. Modern AMDs have massive heatsink/fan combos that require a new generation of power supplies. This isn't just for laptops anymore.

I had a Computer Science architecture professor project a graph of Moore's Law and physics projecting a CPU's thermal dissipation at a of nuclear reactor than the sun in the next decade or so (starting several years ago). He was projecting a breakdown of Moore's law, not a superhot machine! While physics will eventually defeat it with our current technology, he failed to consider architectural innovation and the constantly shrinking die size.

Where Intel has been getting interesting recently:
Core 2 Duo - It couldn't have been much more than a year ago when Intel released this monster! Sure Athlon x2s already had two cores on one die! But the Intel beast shared a common cache, greatly speeding up data transfer where it mattered. It was also able to turn off sections of the cache, producing a considerable power savings. Who would have known?

Bottom line, Intel, seemingly totally dominated, releases a CPU that takes the crown by a large margin in the big three categories: Speed, Power (usage), and Price. Meanwhile, I'm scratching my head wondering where this came from.

So this year, Intel again releases a monster! Yeah, yeah, we've all seen the reviews of the quad cores - not that impressive. But around the same time, Intel sends out lab samples of their new processor. This time, it's SUBSTANTIALLY faster (45% than AMD current top dog according to tomshardware), very overclockable, and is frugal in terms of power consumption. What gives? Besides going down to a 45nm process, Intel has developed a new transistor technology. Instead of the typical Silicon Oxide MOSFETs, they've gone to Hafnium based "High-K" gates. You can read about the higher switching speeds and lower leakage currents at the Tomshardware review. They sent a faster QX9770 than the reviewed QX9550 the following week.

CPUs get faster - that's a fact of life that we're all used to. But Intel's sudden moves in the last 2 years have been nothing less than shocking.

OPC-HDA, what a bummer!

2007-12-04T02:54:00.000-08:00

An integrator recently inquired about connecting FactorySQL to an OPC-HDA (historial data access) Server. A reasonable request. Hey, we're standardizing on OPC (DA) so why not? It seems reasonable that a historical data specification could bring some good to the table.

It turns out that OPC-HDA is another outdated COM based specification that was designed to standardize access to all of the different historian packages. Suppose you wanted a simple ActiveX graph or table back in the day. The idea is that it wouldn't have to know about the PLC. But wait, it still doesn't know how to poll the historical data. The user still needs to subscribe to tags, choose time ranges, etc. Sound like something that SQL's good at? Yeah, makes sense to use a standard interface. Plus, this many years later, all the vendors have jumped on the SQL bandwagon. And for good reason!

At this stage I can't even think of a practical way that FactorySQL could OPC-HDA that would make sense. Maybe if you needed to log from or write to an old HMI, but why? Logging works better from the PLC directly. Why would you ever need to write to an old HMI? It could only introducing unnecessary complexity and potential points of failure.

Aghh! Hurry, OPC-UA! We want web services! XML! Security models! NO MORE COM! Microsoft killed it so many years and major versions ago. Why can't industrial software follow suit!?!!? (I have my explanations, but will leave for another time)

VoIP, QoS and PLCs...hugh?

2007-12-04T02:26:00.000-08:00

So I'm sitting here at my desk. In my home. Gazing at the traffic going by out my 26th story window. My lightning fast Internet connection no longer seems impressive. The building sits on a true 100 megabit pipe, but the novelty's quickly worn. Don't get me wrong, I'd be devastated without it. But when it's here, what do I do? Check email, type, read web sites, and post to forms - and blogs.

But my VoIP phone, complements a la Vonage, provides an invaluable service that I continue to appreciate. The technology is simple - send that voice stream over our worldwide routed network just like we would have with the monopolized circuit switched network. The fiber under the ocean has much greater capacity than satellite voice channels. Back to reality - answering a US cell phone call on a normal physical phone at home in Korea, then talking about nothing for an hour and not worrying about billing! Sweet! The only reality check comes in when you forget that you're 17 hours ahead. I made one accidental call to a friend on a weekend at 2:00AM. Luckily she was out somewhere (scratches head...).

Along with VoIP comes the importance of QoS. I still haven't purchased a home ("gaming") QoS router. My coworker claims it worked wonders for his VoIP and gaming rig - particularly when downloading large files. He brings a good point - VoIP creates "chatty" low bandwidth, high frequency, traffic where latency really matters. Quality of Service prioritizes the delivery of such packets. With QoS, your VoIP will seem uninterrupted, while your high bandwidth download will still transfer quickly. This same concept applies to HMI/SCADA traffic to PLCs. They require rapid polling of little bits of data so that the system feels responsive on a change. The last thing you want is Bob From Accounting to download his end of the month spreadsheet and slow down your control system. PC/PLC traffic can be thought of like typical time intensive UDP streams. Tell your IT department to prioritize the traffic like they would a VoIP phone or important webcam.

A blog is born!

2007-12-04T01:41:00.000-08:00

Welcome to Not another Industrial Blog! I'll use this space to point out cool new technologies, geeky news, and whatever else crosses my mind. I never thought of myself as a Blogger, but Nathan Goes to Korea has been surprisingly well received - so successful that I've had to fight off the adwords temptation. It started as a suggestion from a friend - thanks, Adam! And has since become a means of not having to repeat the same story... And I commonly start sentences with conjunctions and prepositions. And I constantly use the "dot dot dot".

Not another Industrial Blog may often be my venting grounds! The forums that I participate in require that I maintain topicality and vendor neutrality - and I have to be political and nice! If someone's a fucking idiot there, I might say so here! If that offends your sensibilities, (or you already left a comment correcting me to 'ellipses'), feel free to take a hike!

That said, I will typically only rant about what I know about! As much as I'd like to join in on Walt Boyes discussion on Slurry Density Measurement - I haven't spent 27 years in that industry! I'll be writing about: networking, databases, PLCs, and trying to figure out WHY PEOPLE CAN'T QUIT TRYING TO USE MICROSOFT EXCEL as an industrial data logging tool. Use it to view your data, damn it! Use it to analyze your data! DON'T TRY TO MAKE IT A DATABASE! It's much worse than Access at that - read: not suitable for your baseball card collection!

Also, I take great pride in my buddies work at Inductive Automation. I truly feel that FactorySQL and FactoryPMI are the best things to happen to industrial software and will gladly defend that claim. Several projects over a few years was enough clunky crap. It saddens me to see how many other users on the forums struggle with poorly written, antiquated software.

If you're still reading, I'm amazed! Let the Blogging Begin!