See also
* Industrial Control Systems
* Lonworks
* Modbus
* Telemetry
[edit] References
1. ^ Basic SCADA Animations
2. ^ Donald Wallace (2003-09-01). "How to put SCADA on the Internet". Control Engineering. http://www.controleng.com/article/CA321065.html. Retrieved 2008-05-30. (Note: Donald Wallace is COO of M2M Data Corporation, a SCADA vendor.)
3. ^ D. Maynor and R. Graham. "SCADA Security and Terrorism: We're Not Crying Wolf". http://www.blackhat.com/presentations/bh-federal-06/BH-Fed-06-Maynor-Graham-up.pdf.
4. ^ Robert Lemos (2006-07-26). "SCADA system makers pushed toward security". SecurityFocus. http://www.securityfocus.com/news/11402. Retrieved 2007-05-09.
5. ^ "S4 2008 Agenda". http://www.digitalbond.com/wp-content/uploads/2007/10/S4_2008_Agenda.pdf.
6. ^ "SCADA Security - Generic Electric Grid Malware Design". http://www.c4-security.com/SCADA%20Security%20-%20Generic%20Electric%20Grid%20Malware%20Design%20-%20SyScan08.pps.
7. ^ KEMA, Inc. (November 2006). Substation Communications: Enabler of Automation / An Assessment of Communications Technologies. UTC - United Telecom Council. p. 3–21.
[edit] External links
* UK SCADA security guidelines
* BBC NEWS | Technology | Spies 'infiltrate US power grid'
Thursday, July 15, 2010
Security issues
Security issues
The move from proprietary technologies to more standardized and open solutions together with the increased number of connections between SCADA systems and office networks and the Internet has made them more vulnerable to attacks - see references. Consequently, the security of SCADA-based systems has come into question as they are increasingly seen as extremely vulnerable to cyberwarfare/cyberterrorism attacks.[3][4]
In particular, security researchers are concerned about:
* the lack of concern about security and authentication in the design, deployment and operation of existing SCADA networks
* the belief that SCADA systems have the benefit of security through obscurity through the use of specialized protocols and proprietary interfaces
* the belief that SCADA networks are secure because they are physically secured
* the belief that SCADA networks are secure because they are disconnected from the Internet
SCADA systems are used to control and monitor physical processes, examples of which are transmission of electricity, transportation of gas and oil in pipelines, water distribution, traffic lights, and other systems used as the basis of modern society. The security of these SCADA systems is important because compromise or destruction of these systems would impact multiple areas of society far removed from the original compromise. For example, a blackout caused by a compromised electrical SCADA system would cause financial losses to all the customers that received electricity from that source. How security will affect legacy SCADA and new deployments remains to be seen.
There are two distinct threats to a modern SCADA system. First is the threat of unauthorized access to the control software, whether it be human access or changes induced intentionally or accidentally by virus infections and other software threats residing on the control host machine. Second is the threat of packet access to the network segments hosting SCADA devices. In many cases, there is rudimentary or no security on the actual packet control protocol, so anyone who can send packets to the SCADA device can control it. In many cases SCADA users assume that a VPN is sufficient protection and are unaware that physical access to SCADA-related network jacks and switches provides the ability to totally bypass all security on the control software and fully control those SCADA networks. These kinds of physical access attacks bypass firewall and VPN security and are best addressed by endpoint-to-endpoint authentication and authorization such as are commonly provided in the non-SCADA world by in-device SSL or other cryptographic techniques.
Many vendors of SCADA and control products have begun to address these risks in a basic sense by developing lines of specialized industrial firewall and VPN solutions for TCP/IP-based SCADA networks. Additionally, application whitelisting solutions are being implemented because of their ability to prevent malware and unauthorized application changes without the performance impacts of traditional antivirus scans[citation needed]. Also, the ISA Security Compliance Institute (ISCI) is emerging to formalize SCADA security testing starting as soon as 2009. ISCI is conceptually similar to private testing and certification that has been performed by vendors since 2007. Eventually, standards being defined by ISA99 WG4 will supersede the initial industry consortia efforts, but probably not before 2011 .
The increased interest in SCADA vulnerabilities has resulted in vulnerability researchers discovering vulnerabilities in commercial SCADA software and more general offensive SCADA techniques presented to the general security community.[5][6] In electric and gas utility SCADA systems, the vulnerability of the large installed base of wired and wireless serial communications links is addressed in some cases by applying bump-in-the-wire devices that employ authentication and Advanced Encryption Standard encryption rather than replacing all existing nodes.[7]
The move from proprietary technologies to more standardized and open solutions together with the increased number of connections between SCADA systems and office networks and the Internet has made them more vulnerable to attacks - see references. Consequently, the security of SCADA-based systems has come into question as they are increasingly seen as extremely vulnerable to cyberwarfare/cyberterrorism attacks.[3][4]
In particular, security researchers are concerned about:
* the lack of concern about security and authentication in the design, deployment and operation of existing SCADA networks
* the belief that SCADA systems have the benefit of security through obscurity through the use of specialized protocols and proprietary interfaces
* the belief that SCADA networks are secure because they are physically secured
* the belief that SCADA networks are secure because they are disconnected from the Internet
SCADA systems are used to control and monitor physical processes, examples of which are transmission of electricity, transportation of gas and oil in pipelines, water distribution, traffic lights, and other systems used as the basis of modern society. The security of these SCADA systems is important because compromise or destruction of these systems would impact multiple areas of society far removed from the original compromise. For example, a blackout caused by a compromised electrical SCADA system would cause financial losses to all the customers that received electricity from that source. How security will affect legacy SCADA and new deployments remains to be seen.
There are two distinct threats to a modern SCADA system. First is the threat of unauthorized access to the control software, whether it be human access or changes induced intentionally or accidentally by virus infections and other software threats residing on the control host machine. Second is the threat of packet access to the network segments hosting SCADA devices. In many cases, there is rudimentary or no security on the actual packet control protocol, so anyone who can send packets to the SCADA device can control it. In many cases SCADA users assume that a VPN is sufficient protection and are unaware that physical access to SCADA-related network jacks and switches provides the ability to totally bypass all security on the control software and fully control those SCADA networks. These kinds of physical access attacks bypass firewall and VPN security and are best addressed by endpoint-to-endpoint authentication and authorization such as are commonly provided in the non-SCADA world by in-device SSL or other cryptographic techniques.
Many vendors of SCADA and control products have begun to address these risks in a basic sense by developing lines of specialized industrial firewall and VPN solutions for TCP/IP-based SCADA networks. Additionally, application whitelisting solutions are being implemented because of their ability to prevent malware and unauthorized application changes without the performance impacts of traditional antivirus scans[citation needed]. Also, the ISA Security Compliance Institute (ISCI) is emerging to formalize SCADA security testing starting as soon as 2009. ISCI is conceptually similar to private testing and certification that has been performed by vendors since 2007. Eventually, standards being defined by ISA99 WG4 will supersede the initial industry consortia efforts, but probably not before 2011 .
The increased interest in SCADA vulnerabilities has resulted in vulnerability researchers discovering vulnerabilities in commercial SCADA software and more general offensive SCADA techniques presented to the general security community.[5][6] In electric and gas utility SCADA systems, the vulnerability of the large installed base of wired and wireless serial communications links is addressed in some cases by applying bump-in-the-wire devices that employ authentication and Advanced Encryption Standard encryption rather than replacing all existing nodes.[7]
Networked
Third generation: "Networked"
These are the current generation SCADA systems which use open system architecture rather than a vendor-controlled proprietary environment. The SCADA system utilizes open standards and protocols, thus distributing functionality across a WAN rather than a LAN. It is easier to connect third party peripheral devices like printers, disk drives, and tape drives due to the use of open architecture. WAN protocols such as Internet Protocol (IP) are used for communication between the master station and communications equipment. Due to the usage of standard protocols and the fact that many networked SCADA systems are accessible from the Internet, the systems are potentially vulnerable to remote cyber-attacks. On the other hand, the usage of standard protocols and security techniques means that standard security improvements are applicable to the SCADA systems, assuming they receive timely maintenance and updates.
[edit] Trends in SCADA
There is a trend for PLC and HMI/SCADA software to be more "mix-and-match". In the mid 1990s, the typical DAQ I/O manufacturer supplied equipment that communicated using proprietary protocols over a suitable-distance carrier like RS-485. End users who invested in a particular vendor's hardware solution often found themselves restricted to a limited choice of equipment when requirements changed (e.g. system expansions or performance improvement). To mitigate such problems, open communication protocols such as IEC IEC 60870-5-101 or 104, IEC 61850, DNP3 serial, and DNP3 LAN/WAN became increasingly popular among SCADA equipment manufacturers and solution providers alike. Open architecture SCADA systems enabled users to mix-and-match products from different vendors to develop solutions that were better than those that could be achieved when restricted to a single vendor's product offering.
Towards the late 1990s, the shift towards open communications continued with individual I/O manufacturers as well, who adopted open message structures such as Modbus RTU and Modbus ASCII (originally both developed by Modicon) over RS-485. By 2000, most I/O makers offered completely open interfacing such as Modbus TCP over Ethernet and IP.
The North American Electric Reliability Corporation (NERC) has specified that electrical system data should be time-tagged to the nearest millisecond. Electrical system SCADA systems provide this Sequence of events recorder function, using Radio clocks to synchronize the RTU or distributed RTU clocks.
SCADA systems are coming in line with standard networking technologies. Ethernet and TCP/IP based protocols are replacing the older proprietary standards. Although certain characteristics of frame-based network communication technology (determinism, synchronization, protocol selection, environment suitability) have restricted the adoption of Ethernet in a few specialized applications, the vast majority of markets have accepted Ethernet networks for HMI/SCADA.
With the emergence of software as a service in the broader software industry, a few vendors have begun offering application specific SCADA systems hosted on remote platforms over the Internet. This removes the need to install and commission systems at the end-user's facility and takes advantage of security features already available in Internet technology, VPNs and SSL. Some concerns include security,[2] Internet connection reliability, and latency.
SCADA systems are becoming increasingly ubiquitous. Thin clients, web portals, and web based products are gaining popularity with most major vendors. The increased convenience of end users viewing their processes remotely introduces security considerations. While these considerations are already considered solved in other sectors of Internet services, not all entities responsible for deploying SCADA systems have understood the changes in accessibility and threat scope implicit in connecting a system to the Internet.
These are the current generation SCADA systems which use open system architecture rather than a vendor-controlled proprietary environment. The SCADA system utilizes open standards and protocols, thus distributing functionality across a WAN rather than a LAN. It is easier to connect third party peripheral devices like printers, disk drives, and tape drives due to the use of open architecture. WAN protocols such as Internet Protocol (IP) are used for communication between the master station and communications equipment. Due to the usage of standard protocols and the fact that many networked SCADA systems are accessible from the Internet, the systems are potentially vulnerable to remote cyber-attacks. On the other hand, the usage of standard protocols and security techniques means that standard security improvements are applicable to the SCADA systems, assuming they receive timely maintenance and updates.
[edit] Trends in SCADA
There is a trend for PLC and HMI/SCADA software to be more "mix-and-match". In the mid 1990s, the typical DAQ I/O manufacturer supplied equipment that communicated using proprietary protocols over a suitable-distance carrier like RS-485. End users who invested in a particular vendor's hardware solution often found themselves restricted to a limited choice of equipment when requirements changed (e.g. system expansions or performance improvement). To mitigate such problems, open communication protocols such as IEC IEC 60870-5-101 or 104, IEC 61850, DNP3 serial, and DNP3 LAN/WAN became increasingly popular among SCADA equipment manufacturers and solution providers alike. Open architecture SCADA systems enabled users to mix-and-match products from different vendors to develop solutions that were better than those that could be achieved when restricted to a single vendor's product offering.
Towards the late 1990s, the shift towards open communications continued with individual I/O manufacturers as well, who adopted open message structures such as Modbus RTU and Modbus ASCII (originally both developed by Modicon) over RS-485. By 2000, most I/O makers offered completely open interfacing such as Modbus TCP over Ethernet and IP.
The North American Electric Reliability Corporation (NERC) has specified that electrical system data should be time-tagged to the nearest millisecond. Electrical system SCADA systems provide this Sequence of events recorder function, using Radio clocks to synchronize the RTU or distributed RTU clocks.
SCADA systems are coming in line with standard networking technologies. Ethernet and TCP/IP based protocols are replacing the older proprietary standards. Although certain characteristics of frame-based network communication technology (determinism, synchronization, protocol selection, environment suitability) have restricted the adoption of Ethernet in a few specialized applications, the vast majority of markets have accepted Ethernet networks for HMI/SCADA.
With the emergence of software as a service in the broader software industry, a few vendors have begun offering application specific SCADA systems hosted on remote platforms over the Internet. This removes the need to install and commission systems at the end-user's facility and takes advantage of security features already available in Internet technology, VPNs and SSL. Some concerns include security,[2] Internet connection reliability, and latency.
SCADA systems are becoming increasingly ubiquitous. Thin clients, web portals, and web based products are gaining popularity with most major vendors. The increased convenience of end users viewing their processes remotely introduces security considerations. While these considerations are already considered solved in other sectors of Internet services, not all entities responsible for deploying SCADA systems have understood the changes in accessibility and threat scope implicit in connecting a system to the Internet.
SCADA architectures
SCADA architectures
The United States Army's Training Manual 5-601 covers "SCADA Systems for C4ISR Facilities".
SCADA systems have evolved through 3 generations as follows:[citation needed]
[edit] First generation: "Monolithic"
In the first generation, computing was done by mainframe systems. Networks didn’t exist at the time SCADA was developed. Thus SCADA systems were independent systems with no connectivity to other systems. Wide Area Networks were later designed by RTU vendors to communicate with the RTU. The communication protocols used were often proprietary at that time. The first-generation SCADA system was redundant since a back-up mainframe system was connected at the bus level and was used in the event of failure of the primary mainframe system.
[edit] Second generation: "Distributed"
The processing was distributed across multiple stations which were connected through a LAN and they shared information in real time. Each station was responsible for a particular task thus making the size and cost of each station less than the one used in First Generation. The network protocols used were still mostly proprietary, which led to significant security problems for any SCADA system that received attention from a hacker. Since the protocols were proprietary, very few people beyond the developers and hackers knew enough to determine how secure a SCADA installation was. Since both parties had vested interests in keeping security issues quiet, the security of a SCADA installation was often badly overestimated, if it was considered at all.
The United States Army's Training Manual 5-601 covers "SCADA Systems for C4ISR Facilities".
SCADA systems have evolved through 3 generations as follows:[citation needed]
[edit] First generation: "Monolithic"
In the first generation, computing was done by mainframe systems. Networks didn’t exist at the time SCADA was developed. Thus SCADA systems were independent systems with no connectivity to other systems. Wide Area Networks were later designed by RTU vendors to communicate with the RTU. The communication protocols used were often proprietary at that time. The first-generation SCADA system was redundant since a back-up mainframe system was connected at the bus level and was used in the event of failure of the primary mainframe system.
[edit] Second generation: "Distributed"
The processing was distributed across multiple stations which were connected through a LAN and they shared information in real time. Each station was responsible for a particular task thus making the size and cost of each station less than the one used in First Generation. The network protocols used were still mostly proprietary, which led to significant security problems for any SCADA system that received attention from a hacker. Since the protocols were proprietary, very few people beyond the developers and hackers knew enough to determine how secure a SCADA installation was. Since both parties had vested interests in keeping security issues quiet, the security of a SCADA installation was often badly overestimated, if it was considered at all.
Communication infrastructure and methods
SCADA systems have traditionally used combinations of radio and direct serial or modem connections to meet communication requirements, although Ethernet and IP over SONET / SDH is also frequently used at large sites such as railways and power stations. The remote management or monitoring function of a SCADA system is often referred to as telemetry.
This has also come under threat with some customers wanting SCADA data to travel over their pre-established corporate networks or to share the network with other applications. The legacy of the early low-bandwidth protocols remains, though. SCADA protocols are designed to be very compact and many are designed to send information to the master station only when the master station polls the RTU. Typical legacy SCADA protocols include Modbus RTU, RP-570, Profibus and Conitel. These communication protocols are all SCADA-vendor specific but are widely adopted and used. Standard protocols are IEC 60870-5-101 or 104, IEC 61850 and DNP3. These communication protocols are standardized and recognized by all major SCADA vendors. Many of these protocols now contain extensions to operate over TCP/IP. It is good security engineering practice to avoid connecting SCADA systems to the Internet so the attack surface is reduced.
RTUs and other automatic controller devices were being developed before the advent of industry wide standards for interoperability. The result is that developers and their management created a multitude of control protocols. Among the larger vendors, there was also the incentive to create their own protocol to "lock in" their customer base. A list of automation protocols is being compiled here.
Recently, OLE for Process Control (OPC) has become a widely accepted solution for intercommunicating different hardware and software, allowing communication even between devices originally not intended to be part of an industrial network.
This has also come under threat with some customers wanting SCADA data to travel over their pre-established corporate networks or to share the network with other applications. The legacy of the early low-bandwidth protocols remains, though. SCADA protocols are designed to be very compact and many are designed to send information to the master station only when the master station polls the RTU. Typical legacy SCADA protocols include Modbus RTU, RP-570, Profibus and Conitel. These communication protocols are all SCADA-vendor specific but are widely adopted and used. Standard protocols are IEC 60870-5-101 or 104, IEC 61850 and DNP3. These communication protocols are standardized and recognized by all major SCADA vendors. Many of these protocols now contain extensions to operate over TCP/IP. It is good security engineering practice to avoid connecting SCADA systems to the Internet so the attack surface is reduced.
RTUs and other automatic controller devices were being developed before the advent of industry wide standards for interoperability. The result is that developers and their management created a multitude of control protocols. Among the larger vendors, there was also the incentive to create their own protocol to "lock in" their customer base. A list of automation protocols is being compiled here.
Recently, OLE for Process Control (OPC) has become a widely accepted solution for intercommunicating different hardware and software, allowing communication even between devices originally not intended to be part of an industrial network.
Operational philosophy
Operational philosophy
For some installations, the costs that would result from the control system failing are extremely high. Possibly even lives could be lost. Hardware for some SCADA systems is ruggedized to withstand temperature, vibration, and voltage extremes, but in most critical installations reliability is enhanced by having redundant hardware and communications channels, up to the point of having multiple fully equipped control centres. A failing part can be quickly identified and its functionality automatically taken over by backup hardware. A failed part can often be replaced without interrupting the process. The reliability of such systems can be calculated statistically and is stated as the mean time to failure, which is a variant of mean time between failures. The calculated mean time to failure of such high reliability systems can be on the order of centuries.
For some installations, the costs that would result from the control system failing are extremely high. Possibly even lives could be lost. Hardware for some SCADA systems is ruggedized to withstand temperature, vibration, and voltage extremes, but in most critical installations reliability is enhanced by having redundant hardware and communications channels, up to the point of having multiple fully equipped control centres. A failing part can be quickly identified and its functionality automatically taken over by backup hardware. A failed part can often be replaced without interrupting the process. The reliability of such systems can be calculated statistically and is stated as the mean time to failure, which is a variant of mean time between failures. The calculated mean time to failure of such high reliability systems can be on the order of centuries.
Remote Terminal Unit (RTU)
The RTU connects to physical equipment. Typically, an RTU converts the electrical signals from the equipment to digital values such as the open/closed status from a switch or a valve, or measurements such as pressure, flow, voltage or current. By converting and sending these electrical signals out to equipment the RTU can control equipment, such as opening or closing a switch or a valve, or setting the speed of a pump.
[edit] Supervisory Station
The term "Supervisory Station" refers to the servers and software responsible for communicating with the field equipment (RTUs, PLCs, etc), and then to the HMI software running on workstations in the control room, or elsewhere. In smaller SCADA systems, the master station may be composed of a single PC. In larger SCADA systems, the master station may include multiple servers, distributed software applications, and disaster recovery sites. To increase the integrity of the system the multiple servers will often be configured in a dual-redundant or hot-standby formation providing continuous control and monitoring in the event of a server failure.
[edit] Supervisory Station
The term "Supervisory Station" refers to the servers and software responsible for communicating with the field equipment (RTUs, PLCs, etc), and then to the HMI software running on workstations in the control room, or elsewhere. In smaller SCADA systems, the master station may be composed of a single PC. In larger SCADA systems, the master station may include multiple servers, distributed software applications, and disaster recovery sites. To increase the integrity of the system the multiple servers will often be configured in a dual-redundant or hot-standby formation providing continuous control and monitoring in the event of a server failure.
Hardware solutions
SCADA solutions often have Distributed Control System (DCS) components. Use of "smart" RTUs or PLCs, which are capable of autonomously executing simple logic processes without involving the master computer, is increasing. A functional block programming language, IEC 61131-3 (Ladder Logic), is frequently used to create programs which run on these RTUs and PLCs. Unlike a procedural language such as the C programming language or FORTRAN, IEC 61131-3 has minimal training requirements by virtue of resembling historic physical control arrays. This allows SCADA system engineers to perform both the design and implementation of a program to be executed on an RTU or PLC. A Programmable automation controller (PAC) is a compact controller that combines the features and capabilities of a PC-based control system with that of a typical PLC. PACs are deployed in SCADA systems to provide RTU and PLC functions. In many electrical substation SCADA applications, "distributed RTUs" use information processors or station computers to communicate with protective relays, PACS, and other devices for I/O, and communicate with the SCADA master in lieu of a traditional RTU.
Since about 1998, virtually all major PLC manufacturers have offered integrated HMI/SCADA systems, many of them using open and non-proprietary communications protocols. Numerous specialized third-party HMI/SCADA packages, offering built-in compatibility with most major PLCs, have also entered the market, allowing mechanical engineers, electrical engineers and technicians to configure HMIs themselves, without the need for a custom-made program written by a software developer.
Since about 1998, virtually all major PLC manufacturers have offered integrated HMI/SCADA systems, many of them using open and non-proprietary communications protocols. Numerous specialized third-party HMI/SCADA packages, offering built-in compatibility with most major PLCs, have also entered the market, allowing mechanical engineers, electrical engineers and technicians to configure HMIs themselves, without the need for a custom-made program written by a software developer.
Human Machine Interface
Human Machine Interface
Typical Basic SCADA Animations [1]
A Human-Machine Interface or HMI is the apparatus which presents process data to a human operator, and through which the human operator controls the process.
An HMI is usually linked to the SCADA system's databases and software programs, to provide trending, diagnostic data, and management information such as scheduled maintenance procedures, logistic information, detailed schematics for a particular sensor or machine, and expert-system troubleshooting guides.
The HMI system usually presents the information to the operating personnel graphically, in the form of a mimic diagram. This means that the operator can see a schematic representation of the plant being controlled. For example, a picture of a pump connected to a pipe can show the operator that the pump is running and how much fluid it is pumping through the pipe at the moment. The operator can then switch the pump off. The HMI software will show the flow rate of the fluid in the pipe decrease in real time. Mimic diagrams may consist of line graphics and schematic symbols to represent process elements, or may consist of digital photographs of the process equipment overlain with animated symbols.
The HMI package for the SCADA system typically includes a drawing program that the operators or system maintenance personnel use to change the way these points are represented in the interface. These representations can be as simple as an on-screen traffic light, which represents the state of an actual traffic light in the field, or as complex as a multi-projector display representing the position of all of the elevators in a skyscraper or all of the trains on a railway.
An important part of most SCADA implementations is alarm handling. The system monitors whether certain alarm conditions are satisfied, to determine when an alarm event has occurred. Once an alarm event has been detected, one or more actions are taken (such as the activation of one or more alarm indicators, and perhaps the generation of email or text messages so that management or remote SCADA operators are informed). In many cases, a SCADA operator may have to acknowledge the alarm event; this may deactivate some alarm indicators, whereas other indicators remain active until the alarm conditions are cleared. Alarm conditions can be explicit - for example, an alarm point is a digital status point that has either the value NORMAL or ALARM that is calculated by a formula based on the values in other analogue and digital points - or implicit: the SCADA system might automatically monitor whether the value in an analogue point lies outside high and low limit values associated with that point. Examples of alarm indicators include a siren, a pop-up box on a screen, or a coloured or flashing area on a screen (that might act in a similar way to the "fuel tank empty" light in a car); in each case, the role of the alarm indicator is to draw the operator's attention to the part of the system 'in alarm' so that appropriate action can be taken. In designing SCADA systems, care is needed in coping with a cascade of alarm events occurring in a short time, otherwise the underlying cause (which might not be the earliest event detected) may get lost in the noise. Unfortunately, when used as a noun, the word 'alarm' is used rather loosely in the industry; thus, depending on context it might mean an alarm point, an alarm indicator, or an alarm event.
Typical Basic SCADA Animations [1]
A Human-Machine Interface or HMI is the apparatus which presents process data to a human operator, and through which the human operator controls the process.
An HMI is usually linked to the SCADA system's databases and software programs, to provide trending, diagnostic data, and management information such as scheduled maintenance procedures, logistic information, detailed schematics for a particular sensor or machine, and expert-system troubleshooting guides.
The HMI system usually presents the information to the operating personnel graphically, in the form of a mimic diagram. This means that the operator can see a schematic representation of the plant being controlled. For example, a picture of a pump connected to a pipe can show the operator that the pump is running and how much fluid it is pumping through the pipe at the moment. The operator can then switch the pump off. The HMI software will show the flow rate of the fluid in the pipe decrease in real time. Mimic diagrams may consist of line graphics and schematic symbols to represent process elements, or may consist of digital photographs of the process equipment overlain with animated symbols.
The HMI package for the SCADA system typically includes a drawing program that the operators or system maintenance personnel use to change the way these points are represented in the interface. These representations can be as simple as an on-screen traffic light, which represents the state of an actual traffic light in the field, or as complex as a multi-projector display representing the position of all of the elevators in a skyscraper or all of the trains on a railway.
An important part of most SCADA implementations is alarm handling. The system monitors whether certain alarm conditions are satisfied, to determine when an alarm event has occurred. Once an alarm event has been detected, one or more actions are taken (such as the activation of one or more alarm indicators, and perhaps the generation of email or text messages so that management or remote SCADA operators are informed). In many cases, a SCADA operator may have to acknowledge the alarm event; this may deactivate some alarm indicators, whereas other indicators remain active until the alarm conditions are cleared. Alarm conditions can be explicit - for example, an alarm point is a digital status point that has either the value NORMAL or ALARM that is calculated by a formula based on the values in other analogue and digital points - or implicit: the SCADA system might automatically monitor whether the value in an analogue point lies outside high and low limit values associated with that point. Examples of alarm indicators include a siren, a pop-up box on a screen, or a coloured or flashing area on a screen (that might act in a similar way to the "fuel tank empty" light in a car); in each case, the role of the alarm indicator is to draw the operator's attention to the part of the system 'in alarm' so that appropriate action can be taken. In designing SCADA systems, care is needed in coping with a cascade of alarm events occurring in a short time, otherwise the underlying cause (which might not be the earliest event detected) may get lost in the noise. Unfortunately, when used as a noun, the word 'alarm' is used rather loosely in the industry; thus, depending on context it might mean an alarm point, an alarm indicator, or an alarm event.
SCADA schematic
SCADA schematic overview-s.svg
Data acquisition begins at the RTU or PLC level and includes meter readings and equipment status reports that are communicated to SCADA as required. Data is then compiled and formatted in such a way that a control room operator using the HMI can make supervisory decisions to adjust or override normal RTU (PLC) controls. Data may also be fed to a Historian, often built on a commodity Database Management System, to allow trending and other analytical auditing.
SCADA systems typically implement a distributed database, commonly referred to as a tag database, which contains data elements called tags or points. A point represents a single input or output value monitored or controlled by the system. Points can be either "hard" or "soft". A hard point represents an actual input or output within the system, while a soft point results from logic and math operations applied to other points. (Most implementations conceptually remove the distinction by making every property a "soft" point expression, which may, in the simplest case, equal a single hard point.) Points are normally stored as value-timestamp pairs: a value, and the timestamp when it was recorded or calculated. A series of value-timestamp pairs gives the history of that point. It's also common to store additional metadata with tags, such as the path to a field device or PLC register, design time comments, and alarm information.
Data acquisition begins at the RTU or PLC level and includes meter readings and equipment status reports that are communicated to SCADA as required. Data is then compiled and formatted in such a way that a control room operator using the HMI can make supervisory decisions to adjust or override normal RTU (PLC) controls. Data may also be fed to a Historian, often built on a commodity Database Management System, to allow trending and other analytical auditing.
SCADA systems typically implement a distributed database, commonly referred to as a tag database, which contains data elements called tags or points. A point represents a single input or output value monitored or controlled by the system. Points can be either "hard" or "soft". A hard point represents an actual input or output within the system, while a soft point results from logic and math operations applied to other points. (Most implementations conceptually remove the distinction by making every property a "soft" point expression, which may, in the simplest case, equal a single hard point.) Points are normally stored as value-timestamp pairs: a value, and the timestamp when it was recorded or calculated. A series of value-timestamp pairs gives the history of that point. It's also common to store additional metadata with tags, such as the path to a field device or PLC register, design time comments, and alarm information.
Systems concepts
The term SCADA usually refers to centralized systems which monitor and control entire sites, or complexes of systems spread out over large areas (anything between an industrial plant and a country). Most control actions are performed automatically by Remote Terminal Units ("RTUs") or by programmable logic controllers ("PLCs"). Host control functions are usually restricted to basic overriding or supervisory level intervention. For example, a PLC may control the flow of cooling water through part of an industrial process, but the SCADA system may allow operators to change the set points for the flow, and enable alarm conditions, such as loss of flow and high temperature, to be displayed and recorded. The feedback control loop passes through the RTU or PLC, while the SCADA system monitors the overall performance of the loop.
Supervision vs. control
Supervision vs. control
There is, in several industries, considerable confusion over the differences between SCADA systems and distributed control systems (DCS). Generally speaking, a SCADA system usually refers to a system that coordinates, but does not control processes in real time. The discussion on real-time control is muddied somewhat by newer telecommunications technology, enabling reliable, low latency, high speed communications over wide areas. Most differences between SCADA and DCS are culturally determined and can usually be ignored. As communication infrastructures with higher capacity become available, the difference between SCADA and DCS will fade.
There is, in several industries, considerable confusion over the differences between SCADA systems and distributed control systems (DCS). Generally speaking, a SCADA system usually refers to a system that coordinates, but does not control processes in real time. The discussion on real-time control is muddied somewhat by newer telecommunications technology, enabling reliable, low latency, high speed communications over wide areas. Most differences between SCADA and DCS are culturally determined and can usually be ignored. As communication infrastructures with higher capacity become available, the difference between SCADA and DCS will fade.
Common system components
A SCADA System usually consists of the following subsystems:
* A Human-Machine Interface or HMI is the apparatus which presents process data to a human operator, and through this, the human operator monitors and controls the process.
* A supervisory (computer) system, gathering (acquiring) data on the process and sending commands (control) to the process.
* Remote Terminal Units (RTUs) connecting to sensors in the process, converting sensor signals to digital data and sending digital data to the supervisory system.
* Programmable Logic Controller (PLCs) used as field devices because they are more economical, versatile, flexible, and configurable than special-purpose RTUs.
* Communication infrastructure connecting the supervisory system to the Remote Terminal Units.
* A Human-Machine Interface or HMI is the apparatus which presents process data to a human operator, and through this, the human operator monitors and controls the process.
* A supervisory (computer) system, gathering (acquiring) data on the process and sending commands (control) to the process.
* Remote Terminal Units (RTUs) connecting to sensors in the process, converting sensor signals to digital data and sending digital data to the supervisory system.
* Programmable Logic Controller (PLCs) used as field devices because they are more economical, versatile, flexible, and configurable than special-purpose RTUs.
* Communication infrastructure connecting the supervisory system to the Remote Terminal Units.
SCADA stands
SCADA stands for supervisory control and data acquisition. It generally refers to an industrial control system: a computer system monitoring and controlling a process. The process can be industrial, infrastructure or facility-based as described below:
* Industrial processes include those of manufacturing, production, power generation, fabrication, and refining, and may run in continuous, batch, repetitive, or discrete modes.
* Infrastructure processes may be public or private, and include water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, Wind Farms, civil defense siren systems, and large communication systems.
* Facility processes occur both in public facilities and private ones, including buildings, airports, ships, and space stations. They monitor and control HVAC, access, and energy consumption.
* Industrial processes include those of manufacturing, production, power generation, fabrication, and refining, and may run in continuous, batch, repetitive, or discrete modes.
* Infrastructure processes may be public or private, and include water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, Wind Farms, civil defense siren systems, and large communication systems.
* Facility processes occur both in public facilities and private ones, including buildings, airports, ships, and space stations. They monitor and control HVAC, access, and energy consumption.
Telemetry Software
More Info Catalog
Server Control (DDE)
The NBT Dynamic Data Exchange (DDE) Server Control Software provides the link between your NBT telemetry hardware and the Windows DDE environment and extends the reach of traditional SCADA systems.
SM800 Series PLC
Programmer: Used for configuring and documenting the SM800 Series Programmable Logic Controller online or offline
Visual Graphics Add-On: Designed to eliminate the tedious repetition of programming through the use of function block diagrams. Simply drag and drop the function blocks and draw connection lines.
SR900 Series Configuration
Provides the ability to set all of the SR900 Series Spread Spectrum Wireless Radio parameters and operating modes.
It allows the creation and editing of the Master, Slave or Repeater station configuration files.
Real-Time Monitoring Software (HMI)
Powerful, flexible SCADA, data acquisition and real time telemetry control software package that comes with the DDE server, automated configuration, and point capabilities unmatched by competitors.
Real-Time Report Generating for Excel
Daily, monthly, yearly summary data reports including totals, average, minimum, and maximum are reported at intervals
Historical Database Reporter for Access
Moves time tagged field data into a powerful Microsoft Access Database for analysis and reporting
CSV to Excel Converter Utility
Converts CSV files of events and historical data into an Excel workbook
Server Control (DDE)
The NBT Dynamic Data Exchange (DDE) Server Control Software provides the link between your NBT telemetry hardware and the Windows DDE environment and extends the reach of traditional SCADA systems.
SM800 Series PLC
Programmer: Used for configuring and documenting the SM800 Series Programmable Logic Controller online or offline
Visual Graphics Add-On: Designed to eliminate the tedious repetition of programming through the use of function block diagrams. Simply drag and drop the function blocks and draw connection lines.
SR900 Series Configuration
Provides the ability to set all of the SR900 Series Spread Spectrum Wireless Radio parameters and operating modes.
It allows the creation and editing of the Master, Slave or Repeater station configuration files.
Real-Time Monitoring Software (HMI)
Powerful, flexible SCADA, data acquisition and real time telemetry control software package that comes with the DDE server, automated configuration, and point capabilities unmatched by competitors.
Real-Time Report Generating for Excel
Daily, monthly, yearly summary data reports including totals, average, minimum, and maximum are reported at intervals
Historical Database Reporter for Access
Moves time tagged field data into a powerful Microsoft Access Database for analysis and reporting
CSV to Excel Converter Utility
Converts CSV files of events and historical data into an Excel workbook
Telemetry Hardware Equipment
More Info Catalog
Dependable, long-lasting, cost-effective; that's how customers describe NBT telemetry, SCADA and data acquisition equipment. Whether it is a landfill, remediation, water and wastewater or other industrial application, NBT telemetry equipment will give you years of accurate remote process control.
Available NBT Telemetry Components:
Low Cost Telemetry Equipment for Input/Output Transmission
SM300 Series - Master MTUs and Slave RTUs
Programmable Logic Controllers
SM800 Series - PLC, logging, remote monitoring, control,
and communication capabilities
License-Free, Spread Spectrum Wireless Radios
SR900 Series - Reliable, cost-effective interface for any point-to-
point and/or point-to-multipoint serial equipment operation
TSR900 Series - Same features as the SR900 plus built-in input
output capabilities
Licensed Telemetry Wireless Radios
JSLM - FCC licensed analog telemetry radio
T-SR96 - FCC licensed, refarming-compliant radio modem that
comes in both VHF and UHF frequency bands
Leased Line and Wireless Modems
XMOD15 - 1200 baud analog modem used to interface virtually any
serial RS232 communications to leased line or radio
Telemetry Equipment Accessories
SM800 Expansion Modules
SM800 Display and Entry Module
Antennas
Cables and Connectors
Surge Protection
Cavity Filters
Dependable, long-lasting, cost-effective; that's how customers describe NBT telemetry, SCADA and data acquisition equipment. Whether it is a landfill, remediation, water and wastewater or other industrial application, NBT telemetry equipment will give you years of accurate remote process control.
Available NBT Telemetry Components:
Low Cost Telemetry Equipment for Input/Output Transmission
SM300 Series - Master MTUs and Slave RTUs
Programmable Logic Controllers
SM800 Series - PLC, logging, remote monitoring, control,
and communication capabilities
License-Free, Spread Spectrum Wireless Radios
SR900 Series - Reliable, cost-effective interface for any point-to-
point and/or point-to-multipoint serial equipment operation
TSR900 Series - Same features as the SR900 plus built-in input
output capabilities
Licensed Telemetry Wireless Radios
JSLM - FCC licensed analog telemetry radio
T-SR96 - FCC licensed, refarming-compliant radio modem that
comes in both VHF and UHF frequency bands
Leased Line and Wireless Modems
XMOD15 - 1200 baud analog modem used to interface virtually any
serial RS232 communications to leased line or radio
Telemetry Equipment Accessories
SM800 Expansion Modules
SM800 Display and Entry Module
Antennas
Cables and Connectors
Surge Protection
Cavity Filters
Monday, July 5, 2010
Purchasing Principles
1. Use open standards architecture, i.e. Modbus protocol.
2. Purchase from a reputable, established manufacturer.
3. Equipment must integrate well with existing and future equipment.
4. Equipment must be supportable and well documented.
5. Equipment and system overall must be reliable.
6. Equipment must be easy to use and not cause disruptions to the every day business operation.
7. Equipment must be non-proprietary, proven technology.
EPG equipment uses the open architecture Modbus protocol, is well documented, and will integrate into any existing system. For over 20 years we have been manufacturing dependable, cost-effective process control solutions for thousands of industry professionals. If you have any questions or would like to talk to a Data Acquisition, SCADA or Telemetry hardware specialist, please give us a call at 800-443-7426. We look forward to partnering with you.
2. Purchase from a reputable, established manufacturer.
3. Equipment must integrate well with existing and future equipment.
4. Equipment must be supportable and well documented.
5. Equipment and system overall must be reliable.
6. Equipment must be easy to use and not cause disruptions to the every day business operation.
7. Equipment must be non-proprietary, proven technology.
EPG equipment uses the open architecture Modbus protocol, is well documented, and will integrate into any existing system. For over 20 years we have been manufacturing dependable, cost-effective process control solutions for thousands of industry professionals. If you have any questions or would like to talk to a Data Acquisition, SCADA or Telemetry hardware specialist, please give us a call at 800-443-7426. We look forward to partnering with you.
Protocol-Encoding/Decoding
1. Will the future system use existing protocol? (If new purchase, do not use proprietary protocol! You will reduce your options for integrating future equipment. If possible, use the Modbus protocol.)
2. Is there complete documentation?
3. What existing equipment do you need to connect to?
4. Do you need a multi-vendor software application to communicate with a variety of manufacturer's equipment?
5. Consider the security issues: What type of protection/safeguards will be needed and used to keep out hacking, tampering, sabotage and other unauthorized use.
(Master Control Station)
1. Do you need the master station to control local input/output and back up operations?
2. How many sites and stations does your application require?
3. Will the remote station collect data independent from the master station?
2. Is there complete documentation?
3. What existing equipment do you need to connect to?
4. Do you need a multi-vendor software application to communicate with a variety of manufacturer's equipment?
5. Consider the security issues: What type of protection/safeguards will be needed and used to keep out hacking, tampering, sabotage and other unauthorized use.
(Master Control Station)
1. Do you need the master station to control local input/output and back up operations?
2. How many sites and stations does your application require?
3. Will the remote station collect data independent from the master station?
Future System Needs
(Telemetry/Communication Path)
1. Where will the control center be located?
2. What is the distance you need to span between sites?
3. Will additional sites be added in the future?
4. What obstacles are between the control center and each present and future site, if known?
5. What topology and transmission mode is best suited for your application?
6. What transmission media is available? (May be different for each site.)
7. What are your maintenance/service needs? Will you assign your own maintenance personnel or contract out?
8. How much is in the budget to spend?
1. Where will the control center be located?
2. What is the distance you need to span between sites?
3. Will additional sites be added in the future?
4. What obstacles are between the control center and each present and future site, if known?
5. What topology and transmission mode is best suited for your application?
6. What transmission media is available? (May be different for each site.)
7. What are your maintenance/service needs? Will you assign your own maintenance personnel or contract out?
8. How much is in the budget to spend?
IN REVIEW
IN REVIEW
SCADA systems of today are an excellent means for operators of process control sites to save time and money. But from the hundreds of SCADA system providers to choose from, one poor decision may lead you down the path to countless frustrations, inefficiencies and unnecessary expenses. We at EPG Companies Inc. have prepared this pre-system assessment to help prepare the way for you to purchase a SCADA system that will give you years of cost-effective and dependable process control while leaving you open for tomorrows expansions and options. In closing consider the following:
QUESTIONS TO CONSIDER
The ROI (return on investment) and benefits produced by a properly engineered PLC SCADA system will far outweigh your initial investment if the right equipment is chosen and installed correctly. To help facilitate a suitable and beneficial choice, consider answering the following:
Existing Equipment
1. How many sites do you have in operation?
2. What type of equipment is presently in place at all sites? (pumps, valves, monitors, etc.)
3. What type of equipment will be installed in the future? (upgrades, additions, new sites, etc.)
4. What type of telemetry, data acquisition or SCADA system is presently installed? (proprietary, outdated, basic telemetry, etc.)
5. What type of telemetry network or communication path is presently in place?
Topology: Point-to-Point, Point-to-Multipoint, Multipoint-to-Multipoint
Transmission Mode: Hardwire, Telephone, Fiber Optics, Radio/Microwave
6. What type of protocol is being used and will it integrate well with future equipment?
7. What type of software is being used with the present system? Does it come with complete documentation and support? Is it likely to be supported in the future?
8. How many data-dependent users are on the present system?
9. How well would you rate the performance standards of your present system? Is it reliable?
10. What equipment can/will continue to be used? (field equipment, present SCADA components, software, etc.)
11. Can the present equipment and/or upgrades integrate well and communicate with the new equipment?
12. What type of maintenance or service arrangement is presently in place? How will it change with new equipment?
13. What are your present costs for inspection, maintenance and repair? How can it be changed to be cost-effective? How will it change with a new SCADA or data acquisition system?
14. If changes are made to the present system, will outside vendors (telephone company, satellite links, etc.) service change and what are those changes? (new transmission modes, service charges, etc.)
SCADA systems of today are an excellent means for operators of process control sites to save time and money. But from the hundreds of SCADA system providers to choose from, one poor decision may lead you down the path to countless frustrations, inefficiencies and unnecessary expenses. We at EPG Companies Inc. have prepared this pre-system assessment to help prepare the way for you to purchase a SCADA system that will give you years of cost-effective and dependable process control while leaving you open for tomorrows expansions and options. In closing consider the following:
QUESTIONS TO CONSIDER
The ROI (return on investment) and benefits produced by a properly engineered PLC SCADA system will far outweigh your initial investment if the right equipment is chosen and installed correctly. To help facilitate a suitable and beneficial choice, consider answering the following:
Existing Equipment
1. How many sites do you have in operation?
2. What type of equipment is presently in place at all sites? (pumps, valves, monitors, etc.)
3. What type of equipment will be installed in the future? (upgrades, additions, new sites, etc.)
4. What type of telemetry, data acquisition or SCADA system is presently installed? (proprietary, outdated, basic telemetry, etc.)
5. What type of telemetry network or communication path is presently in place?
Topology: Point-to-Point, Point-to-Multipoint, Multipoint-to-Multipoint
Transmission Mode: Hardwire, Telephone, Fiber Optics, Radio/Microwave
6. What type of protocol is being used and will it integrate well with future equipment?
7. What type of software is being used with the present system? Does it come with complete documentation and support? Is it likely to be supported in the future?
8. How many data-dependent users are on the present system?
9. How well would you rate the performance standards of your present system? Is it reliable?
10. What equipment can/will continue to be used? (field equipment, present SCADA components, software, etc.)
11. Can the present equipment and/or upgrades integrate well and communicate with the new equipment?
12. What type of maintenance or service arrangement is presently in place? How will it change with new equipment?
13. What are your present costs for inspection, maintenance and repair? How can it be changed to be cost-effective? How will it change with a new SCADA or data acquisition system?
14. If changes are made to the present system, will outside vendors (telephone company, satellite links, etc.) service change and what are those changes? (new transmission modes, service charges, etc.)
Benefits
Benefits:
* PLC-based equipment is usually more reliable and can run without direction from the master control.
* Operators can see real-time system trouble.
* The number of customer complaints/inquiries can be drastically reduced, for example: incoming calls concerning low pressure or poor water quality in water systems.
* PLC SCADA systems save time and money.
* Wear and tear on equipment can be reduced by continuously monitoring levels.
* The number of man-hours for troubleshooting and/or maintenance can be drastically reduced.
* Labor costs can be reduced through automatic report generating.
* Operating costs can be reduced and greater ROI (return on investment) can be achieved by using a PLC-based SCADA system compared to a proprietary system.
* Compliance with local, state & federal agencies is met easier.
* Expensive service calls by repair technicians can be eliminated.
* Local system integrators and electrical distributors can provide the needed support.
* NBT PLC-based SCADA systems use open architecture, non-proprietary products and protocol. Price lists are published to eliminate "hostage", discriminatory price fixing.
You may be able to think of some additional benefits that would be applicable to your own site. Begin by answering the following questions:
1. What could a PLC SCADA system do for your site?
2. What type of operation would it perform at the master/remote site?
3. What are some benefits you would like to receive by having a PLC SCADA system installed at your site?
4. What aspect of SCADA systems do you need more information on? Organize your thoughts for future reference and then give us a call if you need more help.
* PLC-based equipment is usually more reliable and can run without direction from the master control.
* Operators can see real-time system trouble.
* The number of customer complaints/inquiries can be drastically reduced, for example: incoming calls concerning low pressure or poor water quality in water systems.
* PLC SCADA systems save time and money.
* Wear and tear on equipment can be reduced by continuously monitoring levels.
* The number of man-hours for troubleshooting and/or maintenance can be drastically reduced.
* Labor costs can be reduced through automatic report generating.
* Operating costs can be reduced and greater ROI (return on investment) can be achieved by using a PLC-based SCADA system compared to a proprietary system.
* Compliance with local, state & federal agencies is met easier.
* Expensive service calls by repair technicians can be eliminated.
* Local system integrators and electrical distributors can provide the needed support.
* NBT PLC-based SCADA systems use open architecture, non-proprietary products and protocol. Price lists are published to eliminate "hostage", discriminatory price fixing.
You may be able to think of some additional benefits that would be applicable to your own site. Begin by answering the following questions:
1. What could a PLC SCADA system do for your site?
2. What type of operation would it perform at the master/remote site?
3. What are some benefits you would like to receive by having a PLC SCADA system installed at your site?
4. What aspect of SCADA systems do you need more information on? Organize your thoughts for future reference and then give us a call if you need more help.
FEATURES
FEATURES & BENEFITS
Now lets look at some of the features and benefits you'll receive from a properly engineered PLC-based SCADA system.
Features:
* PLCs have no moving parts. They are extremely robust and reliable.
* If communication with the MTU is lost, a PLC-based RTU can operate alone through "intelligent" programming.
* PLC programs are easy to understand and easy to use and can be completely documented with simple and extensive descriptions, technical programming and support manuals.
* PLCs are modular and can provide room for future expansion and growth.
* Programming for security sensors can be integrated into PLCs providing security and monitoring of door switches, heat and motion detectors. The SCADA system can then automatically notify as prescribed.
* No waiting period to replace electrical components. The SCADA system can be designed to use components that any local or national electrical distributor supplies.
* Standard built in diagnostics can continuously monitor and display all status and fault information in easy to understand text.
* The HMI (Human Machine Interface) software can provide extensive, on-screen documentation including operators manual, wiring diagrams, programs, etc.
* PLC-based SCADA systems can automatically gather and report data necessary to comply with local, state and federal regulations in formats that integrate well will Microsoft Excel, Access and Word.
* Data collected can be stored in the PLC and also in the MTU’s database providing a more robust reporting system.
* The SCADA system can keep managers and operators informed 24 hours a day through automatic email, paging and dial-up call features.
* Future upgrades and/or new installations of pumps, monitoring systems, level and flow sensors etc., can be easily integrated into the system.
* Multiple user features can easily be integrated into the SCADA system through web-based technology.
Now lets look at some of the features and benefits you'll receive from a properly engineered PLC-based SCADA system.
Features:
* PLCs have no moving parts. They are extremely robust and reliable.
* If communication with the MTU is lost, a PLC-based RTU can operate alone through "intelligent" programming.
* PLC programs are easy to understand and easy to use and can be completely documented with simple and extensive descriptions, technical programming and support manuals.
* PLCs are modular and can provide room for future expansion and growth.
* Programming for security sensors can be integrated into PLCs providing security and monitoring of door switches, heat and motion detectors. The SCADA system can then automatically notify as prescribed.
* No waiting period to replace electrical components. The SCADA system can be designed to use components that any local or national electrical distributor supplies.
* Standard built in diagnostics can continuously monitor and display all status and fault information in easy to understand text.
* The HMI (Human Machine Interface) software can provide extensive, on-screen documentation including operators manual, wiring diagrams, programs, etc.
* PLC-based SCADA systems can automatically gather and report data necessary to comply with local, state and federal regulations in formats that integrate well will Microsoft Excel, Access and Word.
* Data collected can be stored in the PLC and also in the MTU’s database providing a more robust reporting system.
* The SCADA system can keep managers and operators informed 24 hours a day through automatic email, paging and dial-up call features.
* Future upgrades and/or new installations of pumps, monitoring systems, level and flow sensors etc., can be easily integrated into the system.
* Multiple user features can easily be integrated into the SCADA system through web-based technology.
SCADA Software
A typical SCADA system provides a Human Machine Interface (HMI) allowing the operator to visualize all the functions as the system is operating. The operator can also use the HMI to change set points, view critical condition alerts and warnings, and analyze, archive or present data trends. Since the advent of Windows NT, the HMI software can be installed on PC hardware as a reliable representation of the real system at work.
Common HMI software packages include Cimplicity (GE-Fanuc), RSView (Rockwell Automation), IFIX (Intellution) and InTouch (Wonderware). Most of these software packages use standard data manipulation/presentation tools for reporting and archiving data and integrate well with Microsoft Excel, Access and Word.
Web-based technology is widely being accepted as well. Data collected by the SCADA system is sent to web servers that dynamically generate HTML pages. These pages are then sent to a LAN system at the operator’s site or published to the Internet.
THE MICROPROCESSOR OPTION
Now that you have a basic understanding of the SCADA system components, you may want to consider utilizing a microprocessor (MP) and/or a PLC-based SCADA system over a basic RTU or a proprietary system for the following reasons:
MPs, like MTUs, can continuously collect, process and store data, operating independently from the MTU through "intelligent" programming. In addition, by utilizing the EPG 2551 microprocessor-based level meter (pictured), you can have a robust SCADA system with both a master and a local display that automatically gathers, processes, and reports data necessary to comply with local, state and federal regulations in formats that integrate well will Microsoft Excel, Access and Word.
MPs can provide security and monitoring of door switches, heat and motion detectors. Managers/operators can be informed 24 hours a day through automatic email, paging and dial-up call features. Multiple users can easily be added and if open architecture protocol is used, future equipment can easily be integrated. Since MPs have no moving parts, they are extremely reliable and can be designed to be repairable with components that any local electrical distributor supplies.
MP-based SCADA system can reduce the number of man-hours needed for on-site visual inspections, adjustments, data collection and logging. Continually monitoring and troubleshooting potential problems increases equipment life, reduces service calls, reduces customer complaints and increases system efficiency. Simply put, open-architecture, MP-based SCADA systems are an excellent means for process control facilities to save time and money.
Common HMI software packages include Cimplicity (GE-Fanuc), RSView (Rockwell Automation), IFIX (Intellution) and InTouch (Wonderware). Most of these software packages use standard data manipulation/presentation tools for reporting and archiving data and integrate well with Microsoft Excel, Access and Word.
Web-based technology is widely being accepted as well. Data collected by the SCADA system is sent to web servers that dynamically generate HTML pages. These pages are then sent to a LAN system at the operator’s site or published to the Internet.
THE MICROPROCESSOR OPTION
Now that you have a basic understanding of the SCADA system components, you may want to consider utilizing a microprocessor (MP) and/or a PLC-based SCADA system over a basic RTU or a proprietary system for the following reasons:
MPs, like MTUs, can continuously collect, process and store data, operating independently from the MTU through "intelligent" programming. In addition, by utilizing the EPG 2551 microprocessor-based level meter (pictured), you can have a robust SCADA system with both a master and a local display that automatically gathers, processes, and reports data necessary to comply with local, state and federal regulations in formats that integrate well will Microsoft Excel, Access and Word.
MPs can provide security and monitoring of door switches, heat and motion detectors. Managers/operators can be informed 24 hours a day through automatic email, paging and dial-up call features. Multiple users can easily be added and if open architecture protocol is used, future equipment can easily be integrated. Since MPs have no moving parts, they are extremely reliable and can be designed to be repairable with components that any local electrical distributor supplies.
MP-based SCADA system can reduce the number of man-hours needed for on-site visual inspections, adjustments, data collection and logging. Continually monitoring and troubleshooting potential problems increases equipment life, reduces service calls, reduces customer complaints and increases system efficiency. Simply put, open-architecture, MP-based SCADA systems are an excellent means for process control facilities to save time and money.
Communication Equipment
The way the SCADA system network (topology) is set up can vary with each system but there must be uninterrupted, bidirectional communication between the MTU and the RTU for a SCADA or Data Acquisition system to function properly. This can be accomplished in various ways, i.e. private wire lines, buried cable, telephone, radios, modems, microwave dishes, satellites, or other atmospheric means, and many times, systems employ more than one means of communicating to the remote site. This may include dial-up or dedicated voice grade telephone lines, DSL (Digital Subscriber Line), Integrated Service Digital Network (ISDN), cable, fiber optics, WiFi, or other broadband services.
There are many options to consider when selecting the appropriate communication equipment and can include either a public and/or private medium. Public medium is a communication service that the customer pays for on a monthly or per time or volume use. Private mediums are owned, licensed, operated and serviced by the user. If you choose to use a private medium, consider the staffing requirements necessary to support the technical and maintenance aspects of the system.
Private Media Types:
Private Wire
Sometimes it makes sense to string or bury your own cable between sites to provide continuous communication. This type of media usually is limited to low bandwidth modems.
Wireless
(Spread Spectrum Radio)
This media type is license-free and available to the public in the 900 MHz and 5.8GHz bands. The higher the frequency used in the system, the more "line of sight" it becomes. Some Spread Spectrum radio units have the ability to span distances by re-strengthening signals for the next radio in line, acting like a repeater for other units in the network. Spread Spectrum radio modems generally have built in error correction, encryption and other features that make them a reliable, secure and long-lasting solution for network communication.
(Microwave Radio)
Microwave radio transmits at high frequencies through parabolic dishes mounted on towers or on top of buildings. This media uses point-to-point, line-of-sight technology and communications may become interrupted at times due to misalignment and/or atmospheric conditions.
(VHF/UHF Radio)
Good for up to 30 miles, VHF/UHF radio is an electromagnetic transmission with frequencies of 175MHz-450MGz-900MHz received by special antennas. A license from the FCC must be obtained and coverage is limited to special geographical boundaries.
Public Media Types:
(Telephone Company)
There are different services that your local telephone company can provide including: Switched Lines, Private Leased Lines, Digital Data Service, Cellular and PCS/CDPD.
* Switched Lines: Public Switch Telephone Network (PSTN) and Generally Switched Telephone network (GSTN) are dial-up voice and data transmission networks furnished by your local telephone company.
* Private Leased Lines: Private Leased Lines (PLL) are permanently connected 24 hours a day between two or more locations and used for analog (continuously varying signal) data transmission.
* Digital Data Service: Digital Data Service (DDS) is a private leased line with a special bandwidth used to transfer data at a higher speed and lower error rate. This service is applicable for computer-to-computer links.
* Cellular: This service is equivalent to Switched Line services over landlines.
* PCS/CDPD: This service is provided by cellular companies on a monthly fee or traffic volume basis and is used when continuous communication is needed.
Other Media Types:
(WiFi-SMR)
Sometimes it makes sense to use the infrastructure of another company. WiFi equipment utilizes broadband with high data rates and is used in a "time-share" basis to communicate between sites of the system. This media type generally requires advanced protocols like TCP/IP and network type connections.
(Satellite-Geosychronous/LEO)
Geosynchronous satellite's orbits are synchronous with the earth's orbit and remain in the same position with respect to the earth. These satellites use high frequency transmissions received by parabolic dish antennas. Low Earth Orbit (LEO) satellites hand off signals to other satellites for continuous coverage and latency times are less than geosynchronous satellites due to the lower orbit.
There are many options to consider when selecting the appropriate communication equipment and can include either a public and/or private medium. Public medium is a communication service that the customer pays for on a monthly or per time or volume use. Private mediums are owned, licensed, operated and serviced by the user. If you choose to use a private medium, consider the staffing requirements necessary to support the technical and maintenance aspects of the system.
Private Media Types:
Private Wire
Sometimes it makes sense to string or bury your own cable between sites to provide continuous communication. This type of media usually is limited to low bandwidth modems.
Wireless
(Spread Spectrum Radio)
This media type is license-free and available to the public in the 900 MHz and 5.8GHz bands. The higher the frequency used in the system, the more "line of sight" it becomes. Some Spread Spectrum radio units have the ability to span distances by re-strengthening signals for the next radio in line, acting like a repeater for other units in the network. Spread Spectrum radio modems generally have built in error correction, encryption and other features that make them a reliable, secure and long-lasting solution for network communication.
(Microwave Radio)
Microwave radio transmits at high frequencies through parabolic dishes mounted on towers or on top of buildings. This media uses point-to-point, line-of-sight technology and communications may become interrupted at times due to misalignment and/or atmospheric conditions.
(VHF/UHF Radio)
Good for up to 30 miles, VHF/UHF radio is an electromagnetic transmission with frequencies of 175MHz-450MGz-900MHz received by special antennas. A license from the FCC must be obtained and coverage is limited to special geographical boundaries.
Public Media Types:
(Telephone Company)
There are different services that your local telephone company can provide including: Switched Lines, Private Leased Lines, Digital Data Service, Cellular and PCS/CDPD.
* Switched Lines: Public Switch Telephone Network (PSTN) and Generally Switched Telephone network (GSTN) are dial-up voice and data transmission networks furnished by your local telephone company.
* Private Leased Lines: Private Leased Lines (PLL) are permanently connected 24 hours a day between two or more locations and used for analog (continuously varying signal) data transmission.
* Digital Data Service: Digital Data Service (DDS) is a private leased line with a special bandwidth used to transfer data at a higher speed and lower error rate. This service is applicable for computer-to-computer links.
* Cellular: This service is equivalent to Switched Line services over landlines.
* PCS/CDPD: This service is provided by cellular companies on a monthly fee or traffic volume basis and is used when continuous communication is needed.
Other Media Types:
(WiFi-SMR)
Sometimes it makes sense to use the infrastructure of another company. WiFi equipment utilizes broadband with high data rates and is used in a "time-share" basis to communicate between sites of the system. This media type generally requires advanced protocols like TCP/IP and network type connections.
(Satellite-Geosychronous/LEO)
Geosynchronous satellite's orbits are synchronous with the earth's orbit and remain in the same position with respect to the earth. These satellites use high frequency transmissions received by parabolic dish antennas. Low Earth Orbit (LEO) satellites hand off signals to other satellites for continuous coverage and latency times are less than geosynchronous satellites due to the lower orbit.
Remote Terminal Unit (RTU)
Remote Terminal Unit (RTU)
The Remote Terminal Unit is usually defined as a communication satellite within the SCADA system and is located at the remote site. The RTU gathers data from field devices (pumps, valves, alarms, etc.) in memory until the MTU initiates a send command. Some RTUs are designed with microcomputers and programmable logic controllers (PLCs) that can perform functions at the remote site without any direction from the MTU. In addition, PLCs can be modular and expandable for the purpose of monitoring and controlling additional field devices. Within the RTU is the central processing unit (CPU) that receives a data stream from the protocol that the communication equipment uses. The protocol can be open like Modbus, Transmission Control Protocol and Internet Protocol (TCP/IP) or a proprietary closed protocol. When the RTU sees its node address embedded in the protocol, data is interpreted and the CPU directs the specified action to take.
During the sixties, many manufacturers developed RTUs with communicative functions that performed a few specific tasks such as monitor and control digital and analog field devices. These all-in-one RTUs needed constant communication with the MTU in order to operate. A wide variety of programming languages were used that were not well known or supported. In the eighties the first micro PLCs were introduced as the first Open Architecture technology which has evolved and gained acceptance as todays preferred alternative to closed, proprietary systems.
Some manufacturers, like EPGs SCADA division NBT, now make Remote Access PLCs (RAPLC) specifically designed for SCADA and Data Acquisition applications. With NBTs PLC system, you can:
* Perform control
* Check site conditions
* Re-program anytime from anywhere
* Have any alarm or event trigger a call to your personal computer
This can all be done from a single, master site and the system can control one or multiple sites. Both industry representatives and customers welcome these smart PLCs because they provide remote programmable functionality while retaining the communications capability of an RTU.
The Remote Terminal Unit is usually defined as a communication satellite within the SCADA system and is located at the remote site. The RTU gathers data from field devices (pumps, valves, alarms, etc.) in memory until the MTU initiates a send command. Some RTUs are designed with microcomputers and programmable logic controllers (PLCs) that can perform functions at the remote site without any direction from the MTU. In addition, PLCs can be modular and expandable for the purpose of monitoring and controlling additional field devices. Within the RTU is the central processing unit (CPU) that receives a data stream from the protocol that the communication equipment uses. The protocol can be open like Modbus, Transmission Control Protocol and Internet Protocol (TCP/IP) or a proprietary closed protocol. When the RTU sees its node address embedded in the protocol, data is interpreted and the CPU directs the specified action to take.
During the sixties, many manufacturers developed RTUs with communicative functions that performed a few specific tasks such as monitor and control digital and analog field devices. These all-in-one RTUs needed constant communication with the MTU in order to operate. A wide variety of programming languages were used that were not well known or supported. In the eighties the first micro PLCs were introduced as the first Open Architecture technology which has evolved and gained acceptance as todays preferred alternative to closed, proprietary systems.
Some manufacturers, like EPGs SCADA division NBT, now make Remote Access PLCs (RAPLC) specifically designed for SCADA and Data Acquisition applications. With NBTs PLC system, you can:
* Perform control
* Check site conditions
* Re-program anytime from anywhere
* Have any alarm or event trigger a call to your personal computer
This can all be done from a single, master site and the system can control one or multiple sites. Both industry representatives and customers welcome these smart PLCs because they provide remote programmable functionality while retaining the communications capability of an RTU.
SYSTEM COMPONENTS -MTU
SCADA systems typically have four major elements:
1. Master Terminal Unit (MTU)
2. Remote Terminal Unit (RTU)
3. Communication Equipment
4. SCADA Software
1. Master Terminal Unit (MTU)
The Master Terminal Unit is usually defined as the master or heart of a SCADA system and is located at the operators central control facility. The MTU initiates virtually all communication with remote sites and interfaces with an operator. Data from remote field devices (pumps, valves, alarms, etc.) is sent to the MTU to be processed, stored and/or sent to other systems. For example, the MTU may send the data to the operators display console, store the information, and then send an operators initiate command to a field pumps RTU.
1. Master Terminal Unit (MTU)
2. Remote Terminal Unit (RTU)
3. Communication Equipment
4. SCADA Software
1. Master Terminal Unit (MTU)
The Master Terminal Unit is usually defined as the master or heart of a SCADA system and is located at the operators central control facility. The MTU initiates virtually all communication with remote sites and interfaces with an operator. Data from remote field devices (pumps, valves, alarms, etc.) is sent to the MTU to be processed, stored and/or sent to other systems. For example, the MTU may send the data to the operators display console, store the information, and then send an operators initiate command to a field pumps RTU.
A BRIEF HISTORY
The development of SCADA can be traced back to the early 1900s with the advent of telemetry. Telemetry involves the transmission and collection of data obtained by sensing real-time conditions. The monitoring of remote conditions became possible with the convergence of electricity, telegraph, telephone, and wireless communication technology. Throughout the last century, more industries, such as gas, electric, and water utilities, used telemetry systems to monitor processes at remote sites.
SCADA began in the early sixties as an electronic system operating as Input/Output (I/O) signal transmissions between a master station and a Remote Terminal Unit (RTU) station. The master station would receive the I/O transmissions from the RTU through a telemetry network and then store the data on mainframe computers.
In the early seventies, DCS (Distributed Control Systems) were developed. The ISAS5.1 standard defines a distributed control system as a system that while being functionally integrated consists of subsystems, which may be physically separate and remotely located from one another. Large manufacturers and process facilities utilized DCS primarily because they required large amounts of analog control.
Further development enabled Distributed Control Systems to use Programmable Logic Controllers (PLC), which being more intelligent than RTUs, have the ability to control sites without taking direction from a master.
In the late nineties, the differences between SCADA and DCS blurred. SCADA systems had DCS capabilities. DCS had SCADA capabilities. Systems were customized based on certain control features built in by designers. Now with the Internet being utilized more as a communication tool, control functions that were once old telemetry systems are becoming more advanced, interconnected and accessible. Automated software products are being developed to exploit the inter-connectivity of the Internet and certain portals can connect to a SCADA system and download information or control a process.
Good SCADA systems today not only control processes but are also used for measuring, forecasting, billing, analyzing and planning. Todays SCADA system must meet a whole new level of control automation, interfacing with yesterdays obsolete equipment yet flexible enough to adapt to tomorrows changes.
Whether you need a new system or are upgrading an older one, it is important to know the system components before you decide on who to talk with and what equipment you will need for your particular application.
SCADA began in the early sixties as an electronic system operating as Input/Output (I/O) signal transmissions between a master station and a Remote Terminal Unit (RTU) station. The master station would receive the I/O transmissions from the RTU through a telemetry network and then store the data on mainframe computers.
In the early seventies, DCS (Distributed Control Systems) were developed. The ISAS5.1 standard defines a distributed control system as a system that while being functionally integrated consists of subsystems, which may be physically separate and remotely located from one another. Large manufacturers and process facilities utilized DCS primarily because they required large amounts of analog control.
Further development enabled Distributed Control Systems to use Programmable Logic Controllers (PLC), which being more intelligent than RTUs, have the ability to control sites without taking direction from a master.
In the late nineties, the differences between SCADA and DCS blurred. SCADA systems had DCS capabilities. DCS had SCADA capabilities. Systems were customized based on certain control features built in by designers. Now with the Internet being utilized more as a communication tool, control functions that were once old telemetry systems are becoming more advanced, interconnected and accessible. Automated software products are being developed to exploit the inter-connectivity of the Internet and certain portals can connect to a SCADA system and download information or control a process.
Good SCADA systems today not only control processes but are also used for measuring, forecasting, billing, analyzing and planning. Todays SCADA system must meet a whole new level of control automation, interfacing with yesterdays obsolete equipment yet flexible enough to adapt to tomorrows changes.
Whether you need a new system or are upgrading an older one, it is important to know the system components before you decide on who to talk with and what equipment you will need for your particular application.
Marketing
Sales People and/or Flashy Marketing:
Good sales and marketing strategies are meant to produce top-of-mind, foot-in-the-door results. They may lure you or pressure you rather than equip you in making a sound decision based on all factors that affect optimum system performance.
These and other costly mistakes can be avoided through knowing, understanding, and carefully assessing your particular needs. For some, that may mean skimming through this article and then focusing on Table A and B below. For others, with little or no SCADA knowledge, you should read and become familiar with the background information provided below.
We at EPG Companies Inc. have prepared this Pre SCADA System Assessment to help equip you in determining what SCADA or Data Acquisition system is right for you. If you have any questions or comments after reviewing this assessment, please call us at 800-443-7426 and ask for a SCADA or Data Acquisition specialist. We have served the industry for over 20 years manufacturing systems that save time and money, are easy to use, and give years of dependable process control.
Good sales and marketing strategies are meant to produce top-of-mind, foot-in-the-door results. They may lure you or pressure you rather than equip you in making a sound decision based on all factors that affect optimum system performance.
These and other costly mistakes can be avoided through knowing, understanding, and carefully assessing your particular needs. For some, that may mean skimming through this article and then focusing on Table A and B below. For others, with little or no SCADA knowledge, you should read and become familiar with the background information provided below.
We at EPG Companies Inc. have prepared this Pre SCADA System Assessment to help equip you in determining what SCADA or Data Acquisition system is right for you. If you have any questions or comments after reviewing this assessment, please call us at 800-443-7426 and ask for a SCADA or Data Acquisition specialist. We have served the industry for over 20 years manufacturing systems that save time and money, are easy to use, and give years of dependable process control.
Experience
Years of Experience:
Be careful. There are a host of reputable SCADA providers with years of experience and knowledgeable expertise that have designed systems that are too broad, expensive and/or do not work. Many companies use this line as if it sets them apart from all the rest. Experience and knowledge is important but only as a starting point when determining what vendor is right for you.
Be careful. There are a host of reputable SCADA providers with years of experience and knowledgeable expertise that have designed systems that are too broad, expensive and/or do not work. Many companies use this line as if it sets them apart from all the rest. Experience and knowledge is important but only as a starting point when determining what vendor is right for you.
Customized Equipment
Excessively Complex or Customized Equipment:
Many operators are wowed by system specialists demonstrating all the capabilities of their SCADA system. After installation, the system is too complex for them to understand, operate and support. What you will have is a very expensive system running at minimum while the operator continues to work the old habits. The only recourse is to purchase expensive training and/or service contracts, which do not always guarantee prompt and professional service. Some SCADA systems have been shut down for months while waiting for a single source of technical support to arrive. Keep it simple wherever possible.
Many operators are wowed by system specialists demonstrating all the capabilities of their SCADA system. After installation, the system is too complex for them to understand, operate and support. What you will have is a very expensive system running at minimum while the operator continues to work the old habits. The only recourse is to purchase expensive training and/or service contracts, which do not always guarantee prompt and professional service. Some SCADA systems have been shut down for months while waiting for a single source of technical support to arrive. Keep it simple wherever possible.
Wednesday, June 30, 2010
Proprietary Equipment
Do not eliminate your options. After proprietary equipment has been installed as “standard” for the system, the customer can be held hostage and be forced to pay an inflated price. In addition, a closed protocol leaves the end-user with fewer options for integrating future equipment from vendors as well as being vulnerable to lack of support and inability to replace failed components due to obsolescence and/or company shutdown.
Pre SCADA System Assessment
As technology continues to advance, SCADA systems will become recognized as a standard for any processing site. But from the hundreds of system providers available today, which one will you listen to? What system will be right for your application? Who will you choose to partner with and why?
Choosing a SCADA system provider that will design a system applicable to your needs can be an overwhelming and confusing task. With little or no knowledge of SCADA and Data Acquisition systems and an incomplete pre-system assessment, the decisions made can be costly mistakes. Too often the decisions are based on . . .
Price:
The quality of the work and components suffer when vendors are eager to get to the bottom to win the low bid. Vendors will then indiscriminately find ways to still make a profit. You get what you pay for!
Choosing a SCADA system provider that will design a system applicable to your needs can be an overwhelming and confusing task. With little or no knowledge of SCADA and Data Acquisition systems and an incomplete pre-system assessment, the decisions made can be costly mistakes. Too often the decisions are based on . . .
Price:
The quality of the work and components suffer when vendors are eager to get to the bottom to win the low bid. Vendors will then indiscriminately find ways to still make a profit. You get what you pay for!
SCADA System Assessment
INTRODUCTION
Supervisory Control and Data Acquisition (SCADA) is a system that allows an operator at a master facility to monitor and control processes that are distributed among various remote sites.
A properly designed SCADA system saves time and money by eliminating the need for service personnel to visit each site for inspection, data collection/logging or make adjustments. Real-time monitoring, system modifications, troubleshooting, increased equipment life, automatic report generating . . . these are just a few of the benefits that come with today’s SCADA system.
Other benefits SCADA Systems provide:
* Reduces operational costs
* Provides immediate knowledge of system performance
* Improves system efficiency and performance
* Increases equipment life
* Reduces costly repairs
* Reduces number of man-hours (labor costs) required for troubleshooting or service
* Frees up personnel for other important tasks
* Facilitates compliance with regulatory agencies through automated report generating
* And more . . .
Supervisory Control and Data Acquisition (SCADA) is a system that allows an operator at a master facility to monitor and control processes that are distributed among various remote sites.
A properly designed SCADA system saves time and money by eliminating the need for service personnel to visit each site for inspection, data collection/logging or make adjustments. Real-time monitoring, system modifications, troubleshooting, increased equipment life, automatic report generating . . . these are just a few of the benefits that come with today’s SCADA system.
Other benefits SCADA Systems provide:
* Reduces operational costs
* Provides immediate knowledge of system performance
* Improves system efficiency and performance
* Increases equipment life
* Reduces costly repairs
* Reduces number of man-hours (labor costs) required for troubleshooting or service
* Frees up personnel for other important tasks
* Facilitates compliance with regulatory agencies through automated report generating
* And more . . .
Monday, June 28, 2010
(1) POSYS 3104
servo-Halbeck GmbH & Co.KG (1)
POSYS 3104
Four-axes PC/104 motion controller with extensive interpolation functionality (2D/3D, bit pattern, and continuous interpolation) for servo and stepper motors
Features (see all):
* Absolutely simultaneous start/stop/continuous operation of all four axes (no update rates = real-time operation of each axis); 16 MHz clock bus
* For four axes for DC-brushed/brushless servo or microstepping/stepper motors; each axis individually
* Supports hardware linear and circular interpolation, Bit Pattern interpolation, continuous interpolation, Electronic Gearing, and Constant Vector Control
* Symmetrical or asymmetrical accel./decel. ramps for both profiles (S-curve and trapezoidal profile generation) [...]
POSYS 3104
Four-axes PC/104 motion controller with extensive interpolation functionality (2D/3D, bit pattern, and continuous interpolation) for servo and stepper motors
Features (see all):
* Absolutely simultaneous start/stop/continuous operation of all four axes (no update rates = real-time operation of each axis); 16 MHz clock bus
* For four axes for DC-brushed/brushless servo or microstepping/stepper motors; each axis individually
* Supports hardware linear and circular interpolation, Bit Pattern interpolation, continuous interpolation, Electronic Gearing, and Constant Vector Control
* Symmetrical or asymmetrical accel./decel. ramps for both profiles (S-curve and trapezoidal profile generation) [...]
National Instruments (1)
A series of eight-axis, high-performance motion controllers
Features
- DAQ-like capability with eight channels of calibrated (non-NIST traceable calibration) 16-bit analog to digital conversion
- Small size
- Highest performance integration capabilities
- 62.5 µs PID rates for each multiple of two axes
- Sinusoidal commutation for brushless motors
- Remote configuration in MAX for motion controllers in a LabVIEW RT system
* DAQ-like capability with eight channels of calibrated (non-NIST traceable calibration) 16-bit analog to digital conversion
National InstrumentsA series of eight-axis, high-performance motion controllers
Features
- DAQ-like capability with eight channels of calibrated (non-NIST traceable calibration) 16-bit analog to digital conversion
- Small size
- Highest performance integration capabilities
- 62.5 µs PID rates for each multiple of two axes
- Sinusoidal commutation for brushless motors
- Remote configuration in MAX for motion controllers in a LabVIEW RT system
* Highest performance integration capabilities
* 62.5 µs PID rates for each multiple of two axes
* Sinusoidal commutation for brushless motors
* Remote configuration in MAX for motion controllers in a LabVIEW RT system
Orion Fans (1)
OD2510 Series
Orion Fans' OD2510 Series DC fans are available in 5 V and 12 V models and measure 25 mm x 10 mm, making them ideally suited for use in a variety of space-constrained applications
Features (see all):
* Available in dual ball or sealed sleeve bearing systems
* Feature brushless DC motors, locked rotor and polarity protection, and auto restart
* Available in speeds of 8000, 10000, 12000 RPMs
* Feature an airflow range from 1.8 to 2.7 CFM
* Available with tachometer and alarm features
* OD2510 ball bearing (L10) life expectancy is 65,000 hours [..
Orion Fans' OD2510 Series DC fans are available in 5 V and 12 V models and measure 25 mm x 10 mm, making them ideally suited for use in a variety of space-constrained applications
Features (see all):
* Available in dual ball or sealed sleeve bearing systems
* Feature brushless DC motors, locked rotor and polarity protection, and auto restart
* Available in speeds of 8000, 10000, 12000 RPMs
* Feature an airflow range from 1.8 to 2.7 CFM
* Available with tachometer and alarm features
* OD2510 ball bearing (L10) life expectancy is 65,000 hours [..
CP-6C2000(1)
Lanner Electronics, Inc. (1)
CP-6C2000
A 6U general purpose rack-mounting chassis
Features (see all):
* 8-slot CompactPCI backplane
* IEEE P1101.11 80 mm rear I/O modules
* Two 9 cm ball bearing fans on the chassis bottom provide 51 CFM each
* Hot Swap cooling fan tray with two 12 cm (32.5 CFM ea.) brushless blowers on top of the chassis
* 13.9 inches high x 19.0 inches wide x 15.94 inches deep [...]
CP-6C2000
A 6U general purpose rack-mounting chassis
Features (see all):
* 8-slot CompactPCI backplane
* IEEE P1101.11 80 mm rear I/O modules
* Two 9 cm ball bearing fans on the chassis bottom provide 51 CFM each
* Hot Swap cooling fan tray with two 12 cm (32.5 CFM ea.) brushless blowers on top of the chassis
* 13.9 inches high x 19.0 inches wide x 15.94 inches deep [...]
MCK2812 Kit D Pro
Applications: DC-brushless motor speed and servo control; DC-Brush Servo motor control AC-Asynchronous motor speed control; AC-Asynchronous Servo motor control
Features (see all):
* TI DSP TMS320F2812
* 128 kB 0-wait state external SRAM
* RS-232 and JTAG interfaces
* PM50, 3-phase inverter power module
* Brushless motor equipped with Hall sensors and 500-line encoder
* Real-time serial communication monitor
* A graphical motion control evaluation/analysis software for the specific motor control peripherals embedded in the TMS320F2812 DSP is provided to rapidly familiarize you with these functions. A set of ready-to-run examples (with ASM source code) is included
* Demos for AC and DC brushless motor speed control are included
* Through an advanced Windows IDE, all system variables can be visualized in real time, and motion parameters can be customized and downloaded into the DSP for a quick optimization of the control algorithms
Features (see all):
* TI DSP TMS320F2812
* 128 kB 0-wait state external SRAM
* RS-232 and JTAG interfaces
* PM50, 3-phase inverter power module
* Brushless motor equipped with Hall sensors and 500-line encoder
* Real-time serial communication monitor
* A graphical motion control evaluation/analysis software for the specific motor control peripherals embedded in the TMS320F2812 DSP is provided to rapidly familiarize you with these functions. A set of ready-to-run examples (with ASM source code) is included
* Demos for AC and DC brushless motor speed control are included
* Through an advanced Windows IDE, all system variables can be visualized in real time, and motion parameters can be customized and downloaded into the DSP for a quick optimization of the control algorithms
MCK2812 DSP(2)
EZ-EMBEDDED (2)
MCK2812 DSP
MCK2812 DSP Motion Control Kit
Features (see all):
* Reliable and fast servomotor driver solution
* Contains three parts: MCK2812 DSP Board, PM50 Power Module and IB-2812 Interface Board
* Application: Digital motor control (DC brush/brushless servo motor, stepping servo motor, AC servo motor)
* Variable Frequency Control (VFC) packing mechanism
* Digital control machine-tool
* Electrical control [...]
MCK2812 DSP
MCK2812 DSP Motion Control Kit
Features (see all):
* Reliable and fast servomotor driver solution
* Contains three parts: MCK2812 DSP Board, PM50 Power Module and IB-2812 Interface Board
* Application: Digital motor control (DC brush/brushless servo motor, stepping servo motor, AC servo motor)
* Variable Frequency Control (VFC) packing mechanism
* Digital control machine-tool
* Electrical control [...]
Labdrive Interface Module(1)
Spectrum Digital (1)
Labdrive Interface Module
A Labdrive interface module for the TI EVM F240 and SD EVM320F240/F243
Features (see all):
* Compatible with TI's F240 EVM and Spectrum Digital's EVM320F240
* Supports 3-phase AC Induction/DC Brushless and custom designed inverters, including Spectrum's Labdrive Inverter
* Supports algorithms and demonstration code developed by TI
* Four Analog input channels
* Differential/single ended
* Adjustable gain and offset for each input
* Input range +/- 10V maximum
* Drive output power (+5V or +12V selectable)
* One fault input
* Two connectors for user expansion
* Optical encode interface: A,B and Index channel, differential, or single ended
* Three inputs for Hall Effect sensors
* Two limit switch inputs
* One driver enable input
* Two general purpose outputs
* One single-ended analog Tachometer input
* One differential/single ended input for control voltage (velocity/torque)
* Two unipolar digital outputs (0V to 5V)
* Six PWM drive outputs [...]
Labdrive Interface Module
A Labdrive interface module for the TI EVM F240 and SD EVM320F240/F243
Features (see all):
* Compatible with TI's F240 EVM and Spectrum Digital's EVM320F240
* Supports 3-phase AC Induction/DC Brushless and custom designed inverters, including Spectrum's Labdrive Inverter
* Supports algorithms and demonstration code developed by TI
* Four Analog input channels
* Differential/single ended
* Adjustable gain and offset for each input
* Input range +/- 10V maximum
* Drive output power (+5V or +12V selectable)
* One fault input
* Two connectors for user expansion
* Optical encode interface: A,B and Index channel, differential, or single ended
* Three inputs for Hall Effect sensors
* Two limit switch inputs
* One driver enable input
* Two general purpose outputs
* One single-ended analog Tachometer input
* One differential/single ended input for control voltage (velocity/torque)
* Two unipolar digital outputs (0V to 5V)
* Six PWM drive outputs [...]
(1) 64PW3
North Atlantic Industries (1)
64PW3
A conduction-cooled VME card
Features (see all):
* Incorporates two four-quadrant, bidirectional PWM amplifiers that drive brush type (optional brushless) DC motors and optional RS-422, A/D, D/A, or dual resolver-to-digital converters
* Continuous background bit testing
* When interrupt is set, status registers indicate drive fail, bias loss, etc.
* Over-current condition
* Supply over-voltage condition and under-voltage condition
* Over-temperature condition for PWM card and power supply
* Master drive enable [...]
64PW3
A conduction-cooled VME card
Features (see all):
* Incorporates two four-quadrant, bidirectional PWM amplifiers that drive brush type (optional brushless) DC motors and optional RS-422, A/D, D/A, or dual resolver-to-digital converters
* Continuous background bit testing
* When interrupt is set, status registers indicate drive fail, bias loss, etc.
* Over-current condition
* Supply over-voltage condition and under-voltage condition
* Over-temperature condition for PWM card and power supply
* Master drive enable [...]
IDM640 Servo Drive
IDM640 is a high precision, fully digital servo drive, with embedded intelligence, and built-in 640W power amplifier. The drive can be used for brushless motors with sinusoidal or trapezoidal commutation, or DC brush motors. The on-board CAN-bus interface allows the drive to be used as an intelligent axis in a distributed intelligence, multiple-axis network of up to 256 axes. Programmable with the high-level Technosoft Motion Language (TML), the IDM640 embeds, on one board, advanced motion control and PLC-specific functionality.
Features (see all):
* Suitable for brushless and DC brush motors
* 12-48 V logic and 80 V motor power supply
* 8 A continuous, 16 A peak current
* Opto-isolated programmable digital inputs (7) / outputs (6) and analog inputs (2)
* High resolution up to 256 microsteps / full step
* Quadrature and sin-cos encoder, Hall sensors and linear Halls
* Resolver, SSI or EnDat absolute encoder (optional)
* RS-232 / RS-485 [...]
Features (see all):
* Suitable for brushless and DC brush motors
* 12-48 V logic and 80 V motor power supply
* 8 A continuous, 16 A peak current
* Opto-isolated programmable digital inputs (7) / outputs (6) and analog inputs (2)
* High resolution up to 256 microsteps / full step
* Quadrature and sin-cos encoder, Hall sensors and linear Halls
* Resolver, SSI or EnDat absolute encoder (optional)
* RS-232 / RS-485 [...]
Technosoft (2)
ISM4803 Servo Drive
This high-performance intelligent module is a true universal drive covering all applications for AC and DC brushless, DC brush and step motors up to 150 W (48 V, 3 A)
Features (see all):
* Designed to embed motion control, drive and PLC functionalities in a single open frame unit (size: 64 x 104 x 16 mm, card format)
* Programmable with Technosoft Motion Language (TML) and graphical tools in stand-alone or multi-axis configurations
* Torque, speed, position, contouring, profiling, e-cams and step motor emulation are the multi-mode motion operations of this servo module
* Typical feedback devices include tacho generators, incremental encoders, digital or linear Halls
* 48 V motor power supply
* 3 A continuous, 6 A peak
* Programmable digital input /outputs and analog inputs
* Quadrature encoder, Hall sensors or linear Halls
* RS-232 and CAN-Bus2.0 (optional) [...]
This high-performance intelligent module is a true universal drive covering all applications for AC and DC brushless, DC brush and step motors up to 150 W (48 V, 3 A)
Features (see all):
* Designed to embed motion control, drive and PLC functionalities in a single open frame unit (size: 64 x 104 x 16 mm, card format)
* Programmable with Technosoft Motion Language (TML) and graphical tools in stand-alone or multi-axis configurations
* Torque, speed, position, contouring, profiling, e-cams and step motor emulation are the multi-mode motion operations of this servo module
* Typical feedback devices include tacho generators, incremental encoders, digital or linear Halls
* 48 V motor power supply
* 3 A continuous, 6 A peak
* Programmable digital input /outputs and analog inputs
* Quadrature encoder, Hall sensors or linear Halls
* RS-232 and CAN-Bus2.0 (optional) [...]
ISCM4805 Servodrive
The ISCM4805 Intelligent Servo Control Module is targeted for medium to high volume applications and has a cost optimized hardware structure
Features (see all):
* Being software configurable and having comprehensive diagnostics ISCM4805 is able to drive brushless, DC brush or step motors up to 200 W (48 V, 5 A)
* It is developed to embed motion control, drive and PLC functionalities in a single open frame unit (size: 80 x 50 x 17 mm, credit card format). A 240 W (80 V, 5 A) version (ISCM8005) is also available
* Suitable for brushless, DC brush and step motors
* 12-48 V logic
* 48 V motor power supply
* DIN-rail version available
* High current capability 5 A continuous, 16 A peak
* Programmable digital input/outputs and analog inputs
* Quadrature and sin-cos encoder, Hall sensors or linear Halls
* RS-232 and CAN-Bus2.0 [...]
Features (see all):
* Being software configurable and having comprehensive diagnostics ISCM4805 is able to drive brushless, DC brush or step motors up to 200 W (48 V, 5 A)
* It is developed to embed motion control, drive and PLC functionalities in a single open frame unit (size: 80 x 50 x 17 mm, credit card format). A 240 W (80 V, 5 A) version (ISCM8005) is also available
* Suitable for brushless, DC brush and step motors
* 12-48 V logic
* 48 V motor power supply
* DIN-rail version available
* High current capability 5 A continuous, 16 A peak
* Programmable digital input/outputs and analog inputs
* Quadrature and sin-cos encoder, Hall sensors or linear Halls
* RS-232 and CAN-Bus2.0 [...]
IBL2403 Minidrive
The IBL2403 Intelligent Minidrive is ideal solution for use in modern miniaturized control of intelligent axes
Features (see all):
* The drive is software configurable to drive brushless, step, DC or linear motors up to 75 W (24 V, 3 A) and embeds motion control, drive and PLC functionalities in a single compact unit (size 65 x 58 x 21 mm)
* Multi-mode motion operations, including contouring, profiling, gearing, and electronic camming, PVT, in stand-alone or multi-axis configurations can easily be programmed with Technosoft Motion Language (TML) in a graphical environment
* Libraries for C++, Delphi, Visual Basic or Labview and S7 PLC, complemented by starter kits, are available for easy integration into the final applications
* Suitable for brushless, DC brush and step motors
* 12-24 V logic and motor power supply
* Programmable digital input/outputs and analog inputs
* Quadrature and sin-cos encoder, Hall sensors or linear Halls.
Features (see all):
* The drive is software configurable to drive brushless, step, DC or linear motors up to 75 W (24 V, 3 A) and embeds motion control, drive and PLC functionalities in a single compact unit (size 65 x 58 x 21 mm)
* Multi-mode motion operations, including contouring, profiling, gearing, and electronic camming, PVT, in stand-alone or multi-axis configurations can easily be programmed with Technosoft Motion Language (TML) in a graphical environment
* Libraries for C++, Delphi, Visual Basic or Labview and S7 PLC, complemented by starter kits, are available for easy integration into the final applications
* Suitable for brushless, DC brush and step motors
* 12-24 V logic and motor power supply
* Programmable digital input/outputs and analog inputs
* Quadrature and sin-cos encoder, Hall sensors or linear Halls.
IM23x Motors
The IM23x Intelligent Motors represent flexible, easy to use and compact products based on Technosoft’s latest MotionChipTM DSP Control Technology
Features (see all):
* This family of motors offers cost-effective motion control solutions for a wide range of applications: basic pulse and direction (IM23x-DS models), stand-alone, pre-stored sequences (IM23x-IS models), and multiple-axis (IM23x-MA models)
* The hardware structure of an IM23x integrates motor, power electronics, controller, position sensor and interface into a single compact unit (104¸144 x 57 x 57 mm), together with basic local digital and analog I/O signals
* IM23x are designed in 3 motor lengths, offering from 0.1 to 0.3 Nm permanent output torque and operated from 12 to 48 V single power supply
* Gearing and electronic CAM functions are also included, for operation in CAN (CANopen – TechnoCAN) or RS-232 networks
* Fully digital intelligent brushless motors
* 12-48 V l [...]
Features (see all):
* This family of motors offers cost-effective motion control solutions for a wide range of applications: basic pulse and direction (IM23x-DS models), stand-alone, pre-stored sequences (IM23x-IS models), and multiple-axis (IM23x-MA models)
* The hardware structure of an IM23x integrates motor, power electronics, controller, position sensor and interface into a single compact unit (104¸144 x 57 x 57 mm), together with basic local digital and analog I/O signals
* IM23x are designed in 3 motor lengths, offering from 0.1 to 0.3 Nm permanent output torque and operated from 12 to 48 V single power supply
* Gearing and electronic CAM functions are also included, for operation in CAN (CANopen – TechnoCAN) or RS-232 networks
* Fully digital intelligent brushless motors
* 12-48 V l [...]
TMC-3D Controller
TMC-3D combines a multi-axis motion controller and a digital servo drive in a single compact unit
Features (see all):
* Multi-axis motion controller (up to 8 axes)
* Real-time 3-D reference generator
* Powerful motion language commands including vector interpolation, 3-D coordinated moves, G-code execution
* CAN network management
* Integrated servo drive for 1 axis, suitable for brushless / DC motors with encoder or resolver feedback
* Usable with all Technosoft drives
* External reference: analog or digital (a 2nd encoder, or pulse and direction)
* Powerful TML instruction set including: motion commands, program flow control, I/O handling, arithmetic and logic operations, remote control from another drive
* Output current: 8 A continuous; 16.5 A peak
* Supply voltage: 12 to 48 V for logic; 12 to 80 V for motor
* Compact covered-frame design (136 x 84.5 x 26) mm [...]
Features (see all):
* Multi-axis motion controller (up to 8 axes)
* Real-time 3-D reference generator
* Powerful motion language commands including vector interpolation, 3-D coordinated moves, G-code execution
* CAN network management
* Integrated servo drive for 1 axis, suitable for brushless / DC motors with encoder or resolver feedback
* Usable with all Technosoft drives
* External reference: analog or digital (a 2nd encoder, or pulse and direction)
* Powerful TML instruction set including: motion commands, program flow control, I/O handling, arithmetic and logic operations, remote control from another drive
* Output current: 8 A continuous; 16.5 A peak
* Supply voltage: 12 to 48 V for logic; 12 to 80 V for motor
* Compact covered-frame design (136 x 84.5 x 26) mm [...]
ISD720/860 Drives
ISD720 and ISD860 are fully digital high-precision servo drives with embedded intelligence and a built-in power amplifier (720, or 860 W)
Features (see all):
* Developed for high power needs and cost-sensitive applications
* Suitable for brushless and DC brush motors
* Motor power supply: 36V - ISD720 or 72V - ISD860; 12-36V logic
* High continuous current capability: 20A - ISD720 or 12A - ISD860
* Peak current: 49A - ISD720 or 31A - ISD860
* Setup, tuning and motion programming are simple with EasyMotion Studio and Technosoft Motion Language (TML)
* Perform position, speed or torque control and works in single-axis, multi-axis or stand alone configurations
* Programmable digital inputs (7) / outputs (4), analog inputs (2)
* RS-232 and CAN / CANopen (optional)
* Quadrature encoder and digital Hall sensors
* Open-frame design: 136 x 84 x 26 mm, 226 g [...]
Features (see all):
* Developed for high power needs and cost-sensitive applications
* Suitable for brushless and DC brush motors
* Motor power supply: 36V - ISD720 or 72V - ISD860; 12-36V logic
* High continuous current capability: 20A - ISD720 or 12A - ISD860
* Peak current: 49A - ISD720 or 31A - ISD860
* Setup, tuning and motion programming are simple with EasyMotion Studio and Technosoft Motion Language (TML)
* Perform position, speed or torque control and works in single-axis, multi-axis or stand alone configurations
* Programmable digital inputs (7) / outputs (4), analog inputs (2)
* RS-232 and CAN / CANopen (optional)
* Quadrature encoder and digital Hall sensors
* Open-frame design: 136 x 84 x 26 mm, 226 g [...]
PIM3605 Minidrive
PIM3605 intelligent plug-in minidrive is specially designed for motion control applications where space is critical and embeds motion controller, drive and PLC functionalities
Features (see all):
* 180W servo drive suitable for brushless, DC brush and step motors
* Embeds motion controller, drive and PLC functionalities in one unit
* 12-36V logic and motor power supply, 5A continuous, 16A peak current
* Motion modes: contouring, profiling, gearing, electronic camming, PVT
* Programmable digital inputs (5) / outputs (2), analog inputs (2)
* Quadrature encoder, Hall sensors or linear Halls
* Fully programmable with EasyMotion Studio software and Technosoft Motion Language (TML)
* Can execute complex motions without requiring an external controller
* Starter kits available for evaluating and develop specific projects
* RS-232 and CAN / CANopen (optional)
* Miniature size: 67 x 43 x 20 mm, 27 g [...]
Features (see all):
* 180W servo drive suitable for brushless, DC brush and step motors
* Embeds motion controller, drive and PLC functionalities in one unit
* 12-36V logic and motor power supply, 5A continuous, 16A peak current
* Motion modes: contouring, profiling, gearing, electronic camming, PVT
* Programmable digital inputs (5) / outputs (2), analog inputs (2)
* Quadrature encoder, Hall sensors or linear Halls
* Fully programmable with EasyMotion Studio software and Technosoft Motion Language (TML)
* Can execute complex motions without requiring an external controller
* Starter kits available for evaluating and develop specific projects
* RS-232 and CAN / CANopen (optional)
* Miniature size: 67 x 43 x 20 mm, 27 g [...]
IBL3605 Minidrive
IBL3605 is a remarkably compact intelligent servo drive that reaches up to 600W peak power
Features (see all):
* It embeds motion controller, drive and PLC functionality in one unit
* 180W servo drive (600W peak ) suitable for brushless, DC brush and step motors
* 12-36V logic and motor power supply, 5A continuous, 16A peak current
* Can be mounted right beside the motor, all cables and maintenance thus being significantly reduced
* Fully programmable with EasyMotion Studio and Technosoft Motion Language (TML)
* Usable as a network drive in distributed motion systems through a CAN / CANopen interface, or as a stand-alone motion controller for single-axis control
* Motion modes: contouring, profiling, gearing, electronic camming or PVT
* RS-232 and CAN / CANopen (optional)
* Programmable digital inputs (5) / outputs (2), analog inputs (2)
* Quadrature encoder, Hall sensors or linear Halls
* Starter kits available
* Dimensions: 65 x 58 x [...]
Features (see all):
* It embeds motion controller, drive and PLC functionality in one unit
* 180W servo drive (600W peak ) suitable for brushless, DC brush and step motors
* 12-36V logic and motor power supply, 5A continuous, 16A peak current
* Can be mounted right beside the motor, all cables and maintenance thus being significantly reduced
* Fully programmable with EasyMotion Studio and Technosoft Motion Language (TML)
* Usable as a network drive in distributed motion systems through a CAN / CANopen interface, or as a stand-alone motion controller for single-axis control
* Motion modes: contouring, profiling, gearing, electronic camming or PVT
* RS-232 and CAN / CANopen (optional)
* Programmable digital inputs (5) / outputs (2), analog inputs (2)
* Quadrature encoder, Hall sensors or linear Halls
* Starter kits available
* Dimensions: 65 x 58 x [...]
MotionChip
A high performance, ready to run motion controller, based on the TMS320C240 DSP controller
Features (see all):
* Stand alone or master/slave
* Single or multiple axis configuration
* Controls several motor types (DC, Brushless, induction, and step motors)
* Implements open loop, torque, speed, position, and external parameter control structures
* Interfaces Encoder, Hall sensors, and tacho-generators directly, with external interface
* Various communication channels such as SCI, CAN, and parallel I/O
* Execution of advanced motion commands and complex motion sequences
* Technosoft Motion Language is a high level set of codes that allows users to configure and parameterize the MotionChip and to execute motion operations on-line
* Motion Studio platform enhances the use of the MotionChip by simplifying set-up and motion programming as well as the development and graphical evaluation of your motion sequences [...
Features (see all):
* Stand alone or master/slave
* Single or multiple axis configuration
* Controls several motor types (DC, Brushless, induction, and step motors)
* Implements open loop, torque, speed, position, and external parameter control structures
* Interfaces Encoder, Hall sensors, and tacho-generators directly, with external interface
* Various communication channels such as SCI, CAN, and parallel I/O
* Execution of advanced motion commands and complex motion sequences
* Technosoft Motion Language is a high level set of codes that allows users to configure and parameterize the MotionChip and to execute motion operations on-line
* Motion Studio platform enhances the use of the MotionChip by simplifying set-up and motion programming as well as the development and graphical evaluation of your motion sequences [...
TECHNOSOFT S.A. (9)
MCK2812 Pro-MS-MATLAB
MSK2812 DSP board (150 MHz, 128kw Flash, 128kw RAM)
Features (see all):
* PM50 power module (50W)
* Brushless motor with Halls and 500-line encoder
* MATLAB model for PMSM position/speed control
* Complete DSP source code for PMSM application
* DMCD-Pro Windows IDE development environment [...]
MSK2812 DSP board (150 MHz, 128kw Flash, 128kw RAM)
Features (see all):
* PM50 power module (50W)
* Brushless motor with Halls and 500-line encoder
* MATLAB model for PMSM position/speed control
* Complete DSP source code for PMSM application
* DMCD-Pro Windows IDE development environment [...]
GESPAC
GESPAC (1)
VMEDMC-4P
A self-tuning motion controller board that drives 4 DC or brushless motors
Features (see all):
* Based on 40 MHz MC56002
* Four 16-bit DAC outputs
* 4 incremental encoder inputs and sixteen 12-48 VDC opto-isolated digital I/O
* ±10V analog output drives any servo-amplifier in torque mode or current mode
* Onboard Flash EPROM
* Auto-expert software for axis tuning and programming that runs on a PC and communicates with the host CPU over a RS-232 serial link
* Assists in the tuning phase of the 2nd order pole placement regulator by calculating the closed loop resonant frequency
* Includes a motion editor
* C library [...]
VMEDMC-4P
A self-tuning motion controller board that drives 4 DC or brushless motors
Features (see all):
* Based on 40 MHz MC56002
* Four 16-bit DAC outputs
* 4 incremental encoder inputs and sixteen 12-48 VDC opto-isolated digital I/O
* ±10V analog output drives any servo-amplifier in torque mode or current mode
* Onboard Flash EPROM
* Auto-expert software for axis tuning and programming that runs on a PC and communicates with the host CPU over a RS-232 serial link
* Assists in the tuning phase of the 2nd order pole placement regulator by calculating the closed loop resonant frequency
* Includes a motion editor
* C library [...]
DMC-2000
Stand-alone motion controllers for the high-speed, flexible Universal Serial Bus (USB)
Features (see all):
* Available in 1- through 8-axis formats and controls step and servo motors on any combination of axes
* Features 12 Mbits/sec USB with two ports, two RS-232/422/485 ports configurable up to 115 Kbits, nonvolatile memory for application programs, multitasking, sinusoidal commutation for brushless motors, two encoder inputs for each axis, 64 configurable I/O
* Optoisolated forward and reverse limits and home inputs for each axis
* Accepts encoder frequencies of up to 12 MHz [...]
Features (see all):
* Available in 1- through 8-axis formats and controls step and servo motors on any combination of axes
* Features 12 Mbits/sec USB with two ports, two RS-232/422/485 ports configurable up to 115 Kbits, nonvolatile memory for application programs, multitasking, sinusoidal commutation for brushless motors, two encoder inputs for each axis, 64 configurable I/O
* Optoisolated forward and reverse limits and home inputs for each axis
* Accepts encoder frequencies of up to 12 MHz [...]
DMC-13x8
A high-performance motion controller available in 1-axis through 4-axis formats, enabling control of both step and servo motors on any combination of axis
Features (see all):
* 64 programmable I/Os
* 12 MHz encoder inputs
* Multitasking of up to eight programs
* Sinusoidal commutation for brushless motors
* Flash EEPROM for firmware updates
* High-density shielded cables for noise immunity
* 0.5 msec command processing rates
* Modes of motion include independent axis positioning, linear and circular interpolation, contouring, electronic gearing, and ECAM [...]
Features (see all):
* 64 programmable I/Os
* 12 MHz encoder inputs
* Multitasking of up to eight programs
* Sinusoidal commutation for brushless motors
* Flash EEPROM for firmware updates
* High-density shielded cables for noise immunity
* 0.5 msec command processing rates
* Modes of motion include independent axis positioning, linear and circular interpolation, contouring, electronic gearing, and ECAM [...]
DMC-1600 Series
DMC-1600 Series
Line of CompactPCI bus motion control cards
Features (see all):
* Features 80 user-configurable inputs and outputs, nonvolatile program memory with multitasking of up to eight programs, high-speed communications, and onboard sinusoidal commutation for brushless motors
* The CompactPCI bus controller provides dual high-speed FIFOs for sending and receiving commands, and a secondary FIFO for instant access to status and parameters
* Provides high-speed servo update rates with sample rates as low as 62.5 msec/axis and control of up to 12 million encoder counts/sec and step motor control of up to three million steps/sec
* Modes of motion include point-to-point positioning, linear and circular interpolation, contouring, gearing, and ECAM [...]
Line of CompactPCI bus motion control cards
Features (see all):
* Features 80 user-configurable inputs and outputs, nonvolatile program memory with multitasking of up to eight programs, high-speed communications, and onboard sinusoidal commutation for brushless motors
* The CompactPCI bus controller provides dual high-speed FIFOs for sending and receiving commands, and a secondary FIFO for instant access to status and parameters
* Provides high-speed servo update rates with sample rates as low as 62.5 msec/axis and control of up to 12 million encoder counts/sec and step motor control of up to three million steps/sec
* Modes of motion include point-to-point positioning, linear and circular interpolation, contouring, gearing, and ECAM [...]
AMP-20540
A 4-axis servo amplifier board designed for driving four brushless or brush-type motors up to 500W
Features (see all):
* Attaches directly to the 96-pin DIN connector of Galil’s DMC-2143 controller
* Contains four transconductance, PWM amplifiers on a single 6.92” x 4.85” board, with each amplifier capable of producing up to 500W
* Accepts 18-60VDC, produces 7A of continuous current, and has a PWM switching frequency of 60 KHz
* Provides protection for over-current, short-circuit, under-voltage, over-voltage, and over-temperature
Features (see all):
* Attaches directly to the 96-pin DIN connector of Galil’s DMC-2143 controller
* Contains four transconductance, PWM amplifiers on a single 6.92” x 4.85” board, with each amplifier capable of producing up to 500W
* Accepts 18-60VDC, produces 7A of continuous current, and has a PWM switching frequency of 60 KHz
* Provides protection for over-current, short-circuit, under-voltage, over-voltage, and over-temperature
Industrial board family
Industrial board family
Pentium and Pentium II boards including Pentium II mobile CPU boards include peripherals for Ethernet, FireWire, CardBus, Ultrawide SCSI, ISDN, and USB
Features (see all):
* Analog I/O functions are available as PC
* MIP modules that fit on i960-based cards or used with a hot swap carrier board
* For motion applications, DSP-based 3U and 6U multi axis motion controllers and brushless power amplifiers are available
* Different hot swap extender cards with bridges and card holders and customization of board functions are offered .
Pentium and Pentium II boards including Pentium II mobile CPU boards include peripherals for Ethernet, FireWire, CardBus, Ultrawide SCSI, ISDN, and USB
Features (see all):
* Analog I/O functions are available as PC
* MIP modules that fit on i960-based cards or used with a hot swap carrier board
* For motion applications, DSP-based 3U and 6U multi axis motion controllers and brushless power amplifiers are available
* Different hot swap extender cards with bridges and card holders and customization of board functions are offered .
Dual 3 Phase bridge driver
Dual 3 Phase bridge driver for brushless 3 phase motors
Features (see all):
* Available in low voltage and high voltage models
* The low voltage model is rated at 10 A 25 VDC per axis while the high voltage model is rated at 5A 50 VDC per axis
* Each 3 Phase bridge on the 7I39 has selectable overcurrent limits of .75 times and 1.5 times rated current
* An overvoltage clamp protects the 7I39 from inductive voltage surges, reducing the need for large motor supply capacitors
* Low on resistance MOSFETs and high performance gate drivers give the 7I39 high efficiency and low dead time to support high switching rates
* Gate power is derived from logic side power so that unlike other bridges, the drivers are functional all the way down to 0 V motor power supply, allowing safe and easy initial setup and testing
* Encoder and Hall effect inputs are RC filtered and processed through a Schmitt trigger before being forwarded to the controller
Features (see all):
* Available in low voltage and high voltage models
* The low voltage model is rated at 10 A 25 VDC per axis while the high voltage model is rated at 5A 50 VDC per axis
* Each 3 Phase bridge on the 7I39 has selectable overcurrent limits of .75 times and 1.5 times rated current
* An overvoltage clamp protects the 7I39 from inductive voltage surges, reducing the need for large motor supply capacitors
* Low on resistance MOSFETs and high performance gate drivers give the 7I39 high efficiency and low dead time to support high switching rates
* Gate power is derived from logic side power so that unlike other bridges, the drivers are functional all the way down to 0 V motor power supply, allowing safe and easy initial setup and testing
* Encoder and Hall effect inputs are RC filtered and processed through a Schmitt trigger before being forwarded to the controller
Single-axis IC
Magellan MC50110 single-axis IC
Offers users the ability to offload intensive motion control functions from the application’s host processor
Features (see all):
* Motion controller requires only an external amplifier to be functional
* Dedicated single-axis control for DC brush, brushless DC, microstepping, and pulse and direction motors
* Profile generation, servo loop closure, PLC-style signal manipulation, and motor signal generation
* Driven by a host microprocessor using an 8 or 16-bit parallel bus, CANBus 2.0B, or an asynchronous serial port
* 32-bit position error, dual bi-quad filters, 50 µSec loop time and multi-chip synchronization
* Trace capabilities provide designers with on-the-fly data storage for analyzing system performance, tuning servo filters, and performing maintenance and diagnostics
* PMD’s advanced instruction set supports more than 130 commands
* Available in two versions: MC58110 provides dedicated control for DC brush, brushless DC, microste [...]
Offers users the ability to offload intensive motion control functions from the application’s host processor
Features (see all):
* Motion controller requires only an external amplifier to be functional
* Dedicated single-axis control for DC brush, brushless DC, microstepping, and pulse and direction motors
* Profile generation, servo loop closure, PLC-style signal manipulation, and motor signal generation
* Driven by a host microprocessor using an 8 or 16-bit parallel bus, CANBus 2.0B, or an asynchronous serial port
* 32-bit position error, dual bi-quad filters, 50 µSec loop time and multi-chip synchronization
* Trace capabilities provide designers with on-the-fly data storage for analyzing system performance, tuning servo filters, and performing maintenance and diagnostics
* PMD’s advanced instruction set supports more than 130 commands
* Available in two versions: MC58110 provides dedicated control for DC brush, brushless DC, microste [...]
Prodigy
Low-cost, easy-to-use Prodigy-PCI from PMD delivers high-performance multi-axis motion control for DC brush, brushless DC, microstepping, and step motors
Features (see all):
* Available in 1, 2, 3, and 4-axis versions
* Supports DC brush, brushless DC, microstepping, and step motors
* S-curve trapezoidal, electronic gearing, and external profile modes
* PCI, CANbus, or serial communications
* Watchdog timer [...]
Features (see all):
* Available in 1, 2, 3, and 4-axis versions
* Supports DC brush, brushless DC, microstepping, and step motors
* S-curve trapezoidal, electronic gearing, and external profile modes
* PCI, CANbus, or serial communications
* Watchdog timer [...]
ION Digital Drive
ION Digital Drive
A fully enclosed, compact drive that delivers high-performance network connectivity, power amplification and other advanced features in a rugged, easy-to-use package
Features (see all):
* All digital drive
* DC brush, brushless DC, and step motor versions
* CANbus or serial communications
* S-curve, trapezoidal, velocity contouring, and electronic gearing profiles
* 102 µsec servo loop rate
* 40 kHz PWM frequency
* 500 W capability
* 8 Amps continuous, 15 Amps peak current
* Optional heat sink for increased current capability
* 12-56 volt single power source
* High-efficiency MOSFETs [...]
A fully enclosed, compact drive that delivers high-performance network connectivity, power amplification and other advanced features in a rugged, easy-to-use package
Features (see all):
* All digital drive
* DC brush, brushless DC, and step motor versions
* CANbus or serial communications
* S-curve, trapezoidal, velocity contouring, and electronic gearing profiles
* 102 µsec servo loop rate
* 40 kHz PWM frequency
* 500 W capability
* 8 Amps continuous, 15 Amps peak current
* Optional heat sink for increased current capability
* 12-56 volt single power source
* High-efficiency MOSFETs [...]
PC/104 Motion Controller
Magellan PC/104 Motion Controller
Uses ultra-advanced Magellan Motion Processor
Features (see all):
* PCI-bus and PC/104-bus configurations
* Available in 1, 2, 3, and 4-axis versions
* Supports DC brush, brushless DC, microstepping, and pulse and direction motors
* Standard C or C++ language programming using C-Motion
* S-curve, trapezoidal, electronic gearing, and external profile modes
* PCI-bus, CAN bus or serial communications
* Separately programmable acceleration and deceleration values
* Profile & servo changes-on-the-fly
* Advanced PID filter with feedforward and dual bi-quad filters
* Loop rate up to 50 µsec/axis
* Incremental and parallel encoder input
* Dual-loop encoder input
* Pulse and direction output up to 5 Mpulses/sec
* 6-step (hall-based) and sinusoidal commutation
* High-speed motion trace for servo tuning and diagnostics
* High-precision 16-bit DAC output to amplifier
* PLC-style programmable inputs and outputs
* General purpose digital and analo [...]
Uses ultra-advanced Magellan Motion Processor
Features (see all):
* PCI-bus and PC/104-bus configurations
* Available in 1, 2, 3, and 4-axis versions
* Supports DC brush, brushless DC, microstepping, and pulse and direction motors
* Standard C or C++ language programming using C-Motion
* S-curve, trapezoidal, electronic gearing, and external profile modes
* PCI-bus, CAN bus or serial communications
* Separately programmable acceleration and deceleration values
* Profile & servo changes-on-the-fly
* Advanced PID filter with feedforward and dual bi-quad filters
* Loop rate up to 50 µsec/axis
* Incremental and parallel encoder input
* Dual-loop encoder input
* Pulse and direction output up to 5 Mpulses/sec
* 6-step (hall-based) and sinusoidal commutation
* High-speed motion trace for servo tuning and diagnostics
* High-precision 16-bit DAC output to amplifier
* PLC-style programmable inputs and outputs
* General purpose digital and analo [...]
Motor Control IC
MC73110 Motor Control IC
Controls 3-phase brushless DC Motors
Features (see all):
* High performance digital current loop
* Velocity loop with encoder or tachometer feedback
* Internal velocity profile generator
* Sinusoidal or 6-step commutation
* Direct analog signal input
* Serial EEPROM or onboard Flash configuration load
* SPI (synchronous serial interface) command input
* 10 KHz velocity loop and commutation rate
* Hall sensor inputs
* 6-signal PWM output with shoot-through protection
* Compact 64-pin TQFP [...]
Controls 3-phase brushless DC Motors
Features (see all):
* High performance digital current loop
* Velocity loop with encoder or tachometer feedback
* Internal velocity profile generator
* Sinusoidal or 6-step commutation
* Direct analog signal input
* Serial EEPROM or onboard Flash configuration load
* SPI (synchronous serial interface) command input
* 10 KHz velocity loop and commutation rate
* Hall sensor inputs
* 6-signal PWM output with shoot-through protection
* Compact 64-pin TQFP [...]
Install and commission
When developers visited the site to install and commission the system, they discovered that they could not use the internal sample timers in the particle counters. Instead, they had to redesign the driver so that it would command the particle counters to stop, return a record, and start a new count every 10 minutes. Although this was a radical departure from the original design, it took the development team less than a day to implement. A custom driver with code would have required much more effort.
Weighing trade-offs
While using the U-CON driver can be effective in certain applications, writing an I/O driver may be worth the effort in other applications. When approaching each project, developers should consider a few critical questions:
* Is high-speed data processing a requirement?
* How complex is the protocol?
* Is it important to have a branded or proprietary interface?
* Which HMI/historian or client applications will need access to the data, and should they access the data via open standards or a proprietary API?
* Does the driver need to be distributed via licensing or royalty-free?
* Do you love writing code (and reading manuals)?
The answers to these questions can help guide developers to the best solution. Using U-CON can prove advantageous for most proprietary serial and Ethernet protocols.
Cutting integration time
OPC’s growth has enabled system integrators to easily integrate most programmable logic control and distributed control systems with HMI/SCADA systems. However, many legacy and proprietary systems still do not have an off-the-shelf driver. Previously, the system integrator’s only option in this situation was to write a custom driver at a significant cost.
The Kepware U-CON driver introduces a new option that can significantly reduce the time spent and expense paid to integrate a serial device. Using this driver, development time can drop from an estimated six-plus weeks per project to a few days.
Weighing trade-offs
While using the U-CON driver can be effective in certain applications, writing an I/O driver may be worth the effort in other applications. When approaching each project, developers should consider a few critical questions:
* Is high-speed data processing a requirement?
* How complex is the protocol?
* Is it important to have a branded or proprietary interface?
* Which HMI/historian or client applications will need access to the data, and should they access the data via open standards or a proprietary API?
* Does the driver need to be distributed via licensing or royalty-free?
* Do you love writing code (and reading manuals)?
The answers to these questions can help guide developers to the best solution. Using U-CON can prove advantageous for most proprietary serial and Ethernet protocols.
Cutting integration time
OPC’s growth has enabled system integrators to easily integrate most programmable logic control and distributed control systems with HMI/SCADA systems. However, many legacy and proprietary systems still do not have an off-the-shelf driver. Previously, the system integrator’s only option in this situation was to write a custom driver at a significant cost.
The Kepware U-CON driver introduces a new option that can significantly reduce the time spent and expense paid to integrate a serial device. Using this driver, development time can drop from an estimated six-plus weeks per project to a few days.
Transaction editor
One of the transaction editor’s powerful features is its ability to create global functions that all the tags can reuse. This reduces development time and allows changes to be made in one location for all the tags.
The U-CON driver also enables developers to write the transactions using a device ID variable as opposed to hard-coding the ID for each new device.
U-CON in action
EVSystems developers used the U-CON driver in two recent projects that required integrating GE Fanuc’s iFIX SCADA product with legacy devices using a proprietary RS-485 protocol.
A feature common to all Kepware drivers is that all the tags are available via OPC as well as the native nio interface in GE iFIX. The latter approach is particularly useful because data can be read directly in iFIX without configuring any OPC items, significantly reducing configuration and validation efforts.
The first application involved 50 cryogenic tank controllers, each with an RS-485 connection and its own ID. Adding a new tank to the U-CON driver was as simple as duplicating an existing tank and changing the ID property. In total, the cryogenic tank driver took developers no more than a week to write, with half of that time spent learning the protocol and gaining familiarity with the product. (Famous last words: "We don’t need to read the manual." Sometimes, it helps.)
Most recently, the development team used the U-CON driver to talk to a dozen Met One particle counters (see Figure 3). Though the connection remained RS-485, the protocol was entirely different, with a mix of hexadecimal and ASCII components. Nonetheless, total driver development time took about three days.
The U-CON driver also enables developers to write the transactions using a device ID variable as opposed to hard-coding the ID for each new device.
U-CON in action
EVSystems developers used the U-CON driver in two recent projects that required integrating GE Fanuc’s iFIX SCADA product with legacy devices using a proprietary RS-485 protocol.
A feature common to all Kepware drivers is that all the tags are available via OPC as well as the native nio interface in GE iFIX. The latter approach is particularly useful because data can be read directly in iFIX without configuring any OPC items, significantly reducing configuration and validation efforts.
The first application involved 50 cryogenic tank controllers, each with an RS-485 connection and its own ID. Adding a new tank to the U-CON driver was as simple as duplicating an existing tank and changing the ID property. In total, the cryogenic tank driver took developers no more than a week to write, with half of that time spent learning the protocol and gaining familiarity with the product. (Famous last words: "We don’t need to read the manual." Sometimes, it helps.)
Most recently, the development team used the U-CON driver to talk to a dozen Met One particle counters (see Figure 3). Though the connection remained RS-485, the protocol was entirely different, with a mix of hexadecimal and ASCII components. Nonetheless, total driver development time took about three days.
U-CON driver
U-CON is a universal translator between the proprietary serial world and OPC. With the U-CON driver, developers can easily create OPC data item tags that represent almost any value from the serial device. As with other OPC devices, tags can be read-only or read-write and consist of any data type.
The U-CON transaction editor makes this possible by allowing developers to create the command structure for a tag as a series of simple steps. For example, the screen shot in Figure 1 shows the command structure for reading a temperature probe. The transaction steps are generated using a menu system to create an easy-to-read state machine, as shown in Figure 2.
The U-CON transaction editor makes this possible by allowing developers to create the command structure for a tag as a series of simple steps. For example, the screen shot in Figure 1 shows the command structure for reading a temperature probe. The transaction steps are generated using a menu system to create an easy-to-read state machine, as shown in Figure 2.
Ethernet devices
Integrating proprietary serial and Ethernet devices with SCADA/HMI systems
By
Stephen Friedenthal
EVSystems Data Solutions
3To write a driver, or not to write a driver? Developers don’t usually have a choice if a driver isn’t available, but new tools are making the job easier. An experienced Supervisory Control and Data Acquisition (SCADA) integrator explains how one such tool is speeding up the process of integrating OLE for Process Control (OPC) hardware.
When starting a SCADA project, developers must first identify the installed devices and controllers to determine how they will interface with the SCADA system. Most of the time, a programmable logic controller with one or more I/O drivers will be available. With OPC’s growing popularity, hardware connectivity is becoming less difficult.
However, connecting to devices that lack an available driver often presents the greatest challenge. This is especially a problem with devices that have proprietary serial and Ethernet protocols such as electronic scales, particle counters, controllers, and so forth. Developers traditionally resolved this issue by writing an I/O driver from scratch.
Consequently, developers would do well to heed this advice: Don’t bid fixed price. Creating a robust and reliable driver is not trivial, as it requires a keen understanding of hardware and software interfaces and error modes. Additionally, as OPC becomes an industry standard, it only makes sense to undertake the effort if the driver supports the OPC protocol.
Creating drivers without writing them
If developers don’t have the time or expertise to write their own drivers, they should consider using the Kepware User-Configurable (U-CON) driver, which has proven useful in two recent development projects. Figure 1 shows the U-CON transaction editor.
By
Stephen Friedenthal
EVSystems Data Solutions
3To write a driver, or not to write a driver? Developers don’t usually have a choice if a driver isn’t available, but new tools are making the job easier. An experienced Supervisory Control and Data Acquisition (SCADA) integrator explains how one such tool is speeding up the process of integrating OLE for Process Control (OPC) hardware.
When starting a SCADA project, developers must first identify the installed devices and controllers to determine how they will interface with the SCADA system. Most of the time, a programmable logic controller with one or more I/O drivers will be available. With OPC’s growing popularity, hardware connectivity is becoming less difficult.
However, connecting to devices that lack an available driver often presents the greatest challenge. This is especially a problem with devices that have proprietary serial and Ethernet protocols such as electronic scales, particle counters, controllers, and so forth. Developers traditionally resolved this issue by writing an I/O driver from scratch.
Consequently, developers would do well to heed this advice: Don’t bid fixed price. Creating a robust and reliable driver is not trivial, as it requires a keen understanding of hardware and software interfaces and error modes. Additionally, as OPC becomes an industry standard, it only makes sense to undertake the effort if the driver supports the OPC protocol.
Creating drivers without writing them
If developers don’t have the time or expertise to write their own drivers, they should consider using the Kepware User-Configurable (U-CON) driver, which has proven useful in two recent development projects. Figure 1 shows the U-CON transaction editor.
Serial interface simulation
Many industrial network devices use RS-232/485 for communication. Typically the serial port of a PC would be directly (or indirectly, via a serial Ethernet gateway) connected to the serial port of the device. There would be a software running on the PC, which sends commands to the device over the serial interface. By some accounts there are hundreds of serial protocols in use in SCADA networks. Some of the more common protocols are MODBUS and DNP.
We need to simulate those protocols over the serial port, so as to present a protocol interface to an attacker who connects to the serial port. Many languages support serial interface programming including Python and Java. We were able to achieve serial communication through a open source Python serial programming module (pyserial.sf.net).
Simulating 802.11
The HostAP driver(http://hostap.epitest.fi/), replies for 802.1b management packets and converts a client adapter an access point. The driver can be used to simulate an access point which is inside a automation or a SCADA network
Capturing attack tools and capturing the attackers' track
Though not part of Honeyd, there are lots of keystroke loggers available. We need a mechanism to track the attacker on the web interface of the device. We do not know of any tools which can provide that functionality, however we explored some possibilities where the the Java applet (running on the "attackers" web browser) is able to comm
Challenges
Deployment and Testing
An ideal deployment site for such a script would be a subnet close to a real Industrial/SCADA network or a phone number which belongs to a SCADA/Automation plant. We are not aware of any active and on-going SCADA specific attacks, it would be difficult to get a SCADA aware attacker into the honeypot.
We need to simulate those protocols over the serial port, so as to present a protocol interface to an attacker who connects to the serial port. Many languages support serial interface programming including Python and Java. We were able to achieve serial communication through a open source Python serial programming module (pyserial.sf.net).
Simulating 802.11
The HostAP driver(http://hostap.epitest.fi/), replies for 802.1b management packets and converts a client adapter an access point. The driver can be used to simulate an access point which is inside a automation or a SCADA network
Capturing attack tools and capturing the attackers' track
Though not part of Honeyd, there are lots of keystroke loggers available. We need a mechanism to track the attacker on the web interface of the device. We do not know of any tools which can provide that functionality, however we explored some possibilities where the the Java applet (running on the "attackers" web browser) is able to comm
Challenges
Deployment and Testing
An ideal deployment site for such a script would be a subnet close to a real Industrial/SCADA network or a phone number which belongs to a SCADA/Automation plant. We are not aware of any active and on-going SCADA specific attacks, it would be difficult to get a SCADA aware attacker into the honeypot.
Review of existing technologies
Review of existing technologies and relavency
Honeyd
Honeyd has facilities for easy simulation of TCP/IP stacks and applications.
Honeynet takes Nmap and Xprobe signatures through configuration files and sends packet responses to scans matching those signatures. Users can set up profiles, mapping IP addresses that Honeyd should respond to a corresponding device profile. When attackers Nmap or Xprobe scan the IP address which Honeyd is taking care of, he will be returned with packets matching the corresponding device profile.
Therefore using Honeyd, it would be possible to simultaneously simulate stacks of multiple IP based Industrial devices, provided the corresponding scanning tools (Nmap or Xprobe) has the knowledge of the signature. As of now, there are no signatures of Industrial devices in Nmap's database.
Honeyd allows the user to listen on a port and run a script on that particular port when anybody connects to that port. As of now, there are many scripts contributed to the project, which can simulate web pages, WSFTP servers and Cisco telnet servers.
Using this feature on Honeyd, it is possible to write scripts that simulated various Industrial Ethernet protocols. For example, it would be possible to simulate a Modbus/TCP server on port 502 and EtherNet/IP on ports 44818/2222.
Honeyd
Honeyd has facilities for easy simulation of TCP/IP stacks and applications.
Honeynet takes Nmap and Xprobe signatures through configuration files and sends packet responses to scans matching those signatures. Users can set up profiles, mapping IP addresses that Honeyd should respond to a corresponding device profile. When attackers Nmap or Xprobe scan the IP address which Honeyd is taking care of, he will be returned with packets matching the corresponding device profile.
Therefore using Honeyd, it would be possible to simultaneously simulate stacks of multiple IP based Industrial devices, provided the corresponding scanning tools (Nmap or Xprobe) has the knowledge of the signature. As of now, there are no signatures of Industrial devices in Nmap's database.
Honeyd allows the user to listen on a port and run a script on that particular port when anybody connects to that port. As of now, there are many scripts contributed to the project, which can simulate web pages, WSFTP servers and Cisco telnet servers.
Using this feature on Honeyd, it is possible to write scripts that simulated various Industrial Ethernet protocols. For example, it would be possible to simulate a Modbus/TCP server on port 502 and EtherNet/IP on ports 44818/2222.
Capture the attacker tools
Capture the attacker tools and tracks
Our scripts need to capture the attacker tools and tracks. That should include keystroke logging and facilities to capture the tools and binaries he might be up loading, if the attack. Our scripts also need to capture network traffic.
Our scripts need to capture the attacker tools and tracks. That should include keystroke logging and facilities to capture the tools and binaries he might be up loading, if the attack. Our scripts also need to capture network traffic.
Simulate Network
We need to simulate various entry points so that when an attacker encounters a perimeter device, he will be presented the same network as a real SCADA network at that particular network entry point
Various network entry points that we need to simulate include:
1. A router directly connected to the Internet: Control system networks are typically not directly conne a control network is located inside a corporate network. Assuming the corporate network as Internet, we need to simulate the entry point of a router that seperates the control network and the corporate network. The devices that are normally connected to such routers would be Industrial Ethernet switches or industrial devices with an IP stack, such as some IP enabled PLCs and wireless access points.
2. Direct serial device:Some of the industrial devices have a modem that can be directly dialed into from a PSTN. We need to simulate a "modem server" that can take connections and behaves like a industrial device or is connected to a industrial device.
3. A Ethernet enabled industrial device directly connected to the Internet: Such a scenario should be the same as simulating the stack, the protocols and applications on that device and connecting that to Internet
4. An Ethernet serial gateway directly plugged into the Internet:An Ethernet serial gateway is a bridge between the IP network and the serial interface. The IP side of the device would be connected to the network, either a Industrial switch or a router to which other IP industrial devices are connected to. The serial side of the device would be connected to a serial device or a serial network.
5. Wireless: Wireless is one of the entry points into a Industrial network. Most of the Industrial wireless devices use proprietary wireless protocols and some of them use 802.1b standard. Typically the serial interface of the device would be connected to a wireless bridge.
6. Remote desktop access and HMIs:The Human Machine Interfaces and the software that communicates with Industrial devices usually run on a Windows machine. Administrators who want remote access to these devices would typically run a remote desktop viewer, such as VNC or PC anywhere. An attacker would normally find it through a port scan ' after he gets into the control network and might get to it using a VNC client. Simulating this would probably need a custom made VNC protocol simulation.
7. Remote Access Server (RAS):Another possible entry point into a control network is to dial into the network using PPP and use the PPP password to authenticate yourself to a Network Access Server and then directly access the Industrial device.
Various network entry points that we need to simulate include:
1. A router directly connected to the Internet: Control system networks are typically not directly conne a control network is located inside a corporate network. Assuming the corporate network as Internet, we need to simulate the entry point of a router that seperates the control network and the corporate network. The devices that are normally connected to such routers would be Industrial Ethernet switches or industrial devices with an IP stack, such as some IP enabled PLCs and wireless access points.
2. Direct serial device:Some of the industrial devices have a modem that can be directly dialed into from a PSTN. We need to simulate a "modem server" that can take connections and behaves like a industrial device or is connected to a industrial device.
3. A Ethernet enabled industrial device directly connected to the Internet: Such a scenario should be the same as simulating the stack, the protocols and applications on that device and connecting that to Internet
4. An Ethernet serial gateway directly plugged into the Internet:An Ethernet serial gateway is a bridge between the IP network and the serial interface. The IP side of the device would be connected to the network, either a Industrial switch or a router to which other IP industrial devices are connected to. The serial side of the device would be connected to a serial device or a serial network.
5. Wireless: Wireless is one of the entry points into a Industrial network. Most of the Industrial wireless devices use proprietary wireless protocols and some of them use 802.1b standard. Typically the serial interface of the device would be connected to a wireless bridge.
6. Remote desktop access and HMIs:The Human Machine Interfaces and the software that communicates with Industrial devices usually run on a Windows machine. Administrators who want remote access to these devices would typically run a remote desktop viewer, such as VNC or PC anywhere. An attacker would normally find it through a port scan ' after he gets into the control network and might get to it using a VNC client. Simulating this would probably need a custom made VNC protocol simulation.
7. Remote Access Server (RAS):Another possible entry point into a control network is to dial into the network using PPP and use the PPP password to authenticate yourself to a Network Access Server and then directly access the Industrial device.
Feature Requirements
Based on our knowledge of industrial network applications, products, and protocols, we identified the following requirements:
Individual Device Simulation
To simulate individual devices, the following functionality is needed:
* Stack level: To simulate the TCP/IP stack of a Ethernet-based device device to a script kiddie type attacker who is scanning the network with OS detection tools such as Nmap and Xprobe.
* Protocol level: To simulate industrial protocols for skilled attackers who have the tools which interrogate protocols and want to do something meaningful using the protocol features
* Application level: To simulate various applications on a SCADA device such as web servers and management applications such as SNMP and Telnet.
* Hardware level:Many of the SCADA devices use serial interfaces such as modems and RS232 interfaces for both SCADA protocol communication and for management purposes. An attacker who either "logs into" a SCADA device or has access to the serial network, needs to be presented with a serial device and/or a protocol communication over a serial device.
Individual Device Simulation
To simulate individual devices, the following functionality is needed:
* Stack level: To simulate the TCP/IP stack of a Ethernet-based device device to a script kiddie type attacker who is scanning the network with OS detection tools such as Nmap and Xprobe.
* Protocol level: To simulate industrial protocols for skilled attackers who have the tools which interrogate protocols and want to do something meaningful using the protocol features
* Application level: To simulate various applications on a SCADA device such as web servers and management applications such as SNMP and Telnet.
* Hardware level:Many of the SCADA devices use serial interfaces such as modems and RS232 interfaces for both SCADA protocol communication and for management purposes. An attacker who either "logs into" a SCADA device or has access to the serial network, needs to be presented with a serial device and/or a protocol communication over a serial device.
INTRODUCTION
There is still little information about SCADA vulnerabilities and attacks, despite the growing awareness of security issues in industrial networks. As is the case with IT security, owner-operators are often unwilling to release attack or incident data. However, unlike IT products and protocols, there are not the sort of public repositories of vendor advisories and vulnerabilities in industrial devices. Although some vulnerability research is being conducted in this area, very little has been released publically and no "SCADA security tools" (whatever that might mean) have been released to the public.
To address these limitations, this goal of this project is to provide tools and to simulate a variety of industrial networks and devices. We see several uses for this project:
* Build a HoneyNet for attackers, to gather data on attacker trends and tools
* Provide a scriptable industrial protocol simulators to test a real live protocol implementation
* Research countermeasures, such as device hardening, stack obfuscation, reducing application information, and the effectiveness network access controls
To address these limitations, this goal of this project is to provide tools and to simulate a variety of industrial networks and devices. We see several uses for this project:
* Build a HoneyNet for attackers, to gather data on attacker trends and tools
* Provide a scriptable industrial protocol simulators to test a real live protocol implementation
* Research countermeasures, such as device hardening, stack obfuscation, reducing application information, and the effectiveness network access controls
Objectives
The short-term goal of the project is to determine the feasibility of building a software-based framework to simulate a variety of industrial networks such as SCADA, DCS, and PLC architectures. We plan to document the requirements and release proof of concept code (in the form of honeyd scripts) so that a single Linux host can simulate multiple industrial devices and complex network topologies. Given the variety of deployments and the lack of standard, well-defined architectures for industrial networks, this project attempts to create the building blocks so that users can simulate their networks own networks--not make assumptions about what "real world" SCADA/DCS/PLC look like. Assuming deployment of "SCADA HoneyNets" ever reach critical mass, the longer term objective of the project is to gather information about general attack patterns and specific exploits that could be used to write signature for commercial and Open Source IDS products.
Introduction
Introduction
HONEY NEWS
News & Updates
# 7/15/05/(released version 0.3) - Converted teh stand-alone scripts to work with honeyd, changes to html scripts. See Release Notes for more details.
# 6/01/04/(released version 0.2) - Fixed the bug regarding the absense of modbusHdrs.py, included sample nmap OS fingerprints of some PLCs, included a test file to generate custom Modbus packets to test the modbusSrve.py implementation
# 5/13/04 - Major cleanup of content
# 3/20/04 - PLC Simulation scripts available for down and PLC Simulation Case Study complete.
# 7/15/05/(released version 0.3) - Converted teh stand-alone scripts to work with honeyd, changes to html scripts. See Release Notes for more details.
# 6/01/04/(released version 0.2) - Fixed the bug regarding the absense of modbusHdrs.py, included sample nmap OS fingerprints of some PLCs, included a test file to generate custom Modbus packets to test the modbusSrve.py implementation
# 5/13/04 - Major cleanup of content
# 3/20/04 - PLC Simulation scripts available for down and PLC Simulation Case Study complete.
Subscribe to:
Posts (Atom)