Proprietary Equipment

Do not eliminate your options. After proprietary equipment has been installed as “standard” for the system, the customer can be held hostage and be forced to pay an inflated price. In addition, a closed protocol leaves the end-user with fewer options for integrating future equipment from vendors as well as being vulnerable to lack of support and inability to replace failed components due to obsolescence and/or company shutdown.

Pre SCADA System Assessment

As technology continues to advance, SCADA systems will become recognized as a standard for any processing site. But from the hundreds of system providers available today, which one will you listen to? What system will be right for your application? Who will you choose to partner with and why?

Choosing a SCADA system provider that will design a system applicable to your needs can be an overwhelming and confusing task. With little or no knowledge of SCADA and Data Acquisition systems and an incomplete pre-system assessment, the decisions made can be costly mistakes. Too often the decisions are based on . . .

Price:

The quality of the work and components suffer when vendors are eager to get to the bottom to win the low bid. Vendors will then indiscriminately find ways to still make a profit. You get what you pay for!

SCADA System Assessment

INTRODUCTION

Supervisory Control and Data Acquisition (SCADA) is a system that allows an operator at a master facility to monitor and control processes that are distributed among various remote sites.

A properly designed SCADA system saves time and money by eliminating the need for service personnel to visit each site for inspection, data collection/logging or make adjustments. Real-time monitoring, system modifications, troubleshooting, increased equipment life, automatic report generating . . . these are just a few of the benefits that come with today’s SCADA system.

Other benefits SCADA Systems provide:

* Reduces operational costs
* Provides immediate knowledge of system performance
* Improves system efficiency and performance
* Increases equipment life
* Reduces costly repairs
* Reduces number of man-hours (labor costs) required for troubleshooting or service
* Frees up personnel for other important tasks
* Facilitates compliance with regulatory agencies through automated report generating
* And more . . .

(1) POSYS 3104

servo-Halbeck GmbH & Co.KG (1)
POSYS 3104
Four-axes PC/104 motion controller with extensive interpolation functionality (2D/3D, bit pattern, and continuous interpolation) for servo and stepper motors
Features (see all):

* Absolutely simultaneous start/stop/continuous operation of all four axes (no update rates = real-time operation of each axis); 16 MHz clock bus
* For four axes for DC-brushed/brushless servo or microstepping/stepper motors; each axis individually
* Supports hardware linear and circular interpolation, Bit Pattern interpolation, continuous interpolation, Electronic Gearing, and Constant Vector Control
* Symmetrical or asymmetrical accel./decel. ramps for both profiles (S-curve and trapezoidal profile generation) [...]

National Instruments (1)

A series of eight-axis, high-performance motion controllers

Features

• DAQ-like capability with eight channels of calibrated (non-NIST traceable calibration) 16-bit analog to digital conversion
• Small size
• Highest performance integration capabilities
• 62.5 µs PID rates for each multiple of two axes
• Sinusoidal commutation for brushless motors
• Remote configuration in MAX for motion controllers in a LabVIEW RT system
  

* DAQ-like capability with eight channels of calibrated (non-NIST traceable calibration) 16-bit analog to digital conversion

National Instruments (1)

A series of eight-axis, high-performance motion controllers

Features

• DAQ-like capability with eight channels of calibrated (non-NIST traceable calibration) 16-bit analog to digital conversion
• Small size
• Highest performance integration capabilities
• 62.5 µs PID rates for each multiple of two axes
• Sinusoidal commutation for brushless motors
• Remote configuration in MAX for motion controllers in a LabVIEW RT system
  

* Small size
* Highest performance integration capabilities
* 62.5 µs PID rates for each multiple of two axes
* Sinusoidal commutation for brushless motors
* Remote configuration in MAX for motion controllers in a LabVIEW RT system

Orion Fans (1)

OD2510 Series
Orion Fans' OD2510 Series DC fans are available in 5 V and 12 V models and measure 25 mm x 10 mm, making them ideally suited for use in a variety of space-constrained applications
Features (see all):

* Available in dual ball or sealed sleeve bearing systems
* Feature brushless DC motors, locked rotor and polarity protection, and auto restart
* Available in speeds of 8000, 10000, 12000 RPMs
* Feature an airflow range from 1.8 to 2.7 CFM
* Available with tachometer and alarm features
* OD2510 ball bearing (L10) life expectancy is 65,000 hours [..

CP-6C2000(1)

Lanner Electronics, Inc. (1)
CP-6C2000
A 6U general purpose rack-mounting chassis
Features (see all):

* 8-slot CompactPCI backplane
* IEEE P1101.11 80 mm rear I/O modules
* Two 9 cm ball bearing fans on the chassis bottom provide 51 CFM each
* Hot Swap cooling fan tray with two 12 cm (32.5 CFM ea.) brushless blowers on top of the chassis
* 13.9 inches high x 19.0 inches wide x 15.94 inches deep [...]

MCK2812 Kit D Pro

Applications: DC-brushless motor speed and servo control; DC-Brush Servo motor control AC-Asynchronous motor speed control; AC-Asynchronous Servo motor control
Features (see all):

* TI DSP TMS320F2812
* 128 kB 0-wait state external SRAM
* RS-232 and JTAG interfaces
* PM50, 3-phase inverter power module
* Brushless motor equipped with Hall sensors and 500-line encoder
* Real-time serial communication monitor
* A graphical motion control evaluation/analysis software for the specific motor control peripherals embedded in the TMS320F2812 DSP is provided to rapidly familiarize you with these functions. A set of ready-to-run examples (with ASM source code) is included
* Demos for AC and DC brushless motor speed control are included
* Through an advanced Windows IDE, all system variables can be visualized in real time, and motion parameters can be customized and downloaded into the DSP for a quick optimization of the control algorithms

MCK2812 DSP(2)

EZ-EMBEDDED (2)
MCK2812 DSP
MCK2812 DSP Motion Control Kit
Features (see all):

* Reliable and fast servomotor driver solution
* Contains three parts: MCK2812 DSP Board, PM50 Power Module and IB-2812 Interface Board
* Application: Digital motor control (DC brush/brushless servo motor, stepping servo motor, AC servo motor)
* Variable Frequency Control (VFC) packing mechanism
* Digital control machine-tool
* Electrical control [...]

Labdrive Interface Module(1)

Spectrum Digital (1)
Labdrive Interface Module
A Labdrive interface module for the TI EVM F240 and SD EVM320F240/F243
Features (see all):

* Compatible with TI's F240 EVM and Spectrum Digital's EVM320F240
* Supports 3-phase AC Induction/DC Brushless and custom designed inverters, including Spectrum's Labdrive Inverter
* Supports algorithms and demonstration code developed by TI
* Four Analog input channels
* Differential/single ended
* Adjustable gain and offset for each input
* Input range +/- 10V maximum
* Drive output power (+5V or +12V selectable)
* One fault input
* Two connectors for user expansion
* Optical encode interface: A,B and Index channel, differential, or single ended
* Three inputs for Hall Effect sensors
* Two limit switch inputs
* One driver enable input
* Two general purpose outputs
* One single-ended analog Tachometer input
* One differential/single ended input for control voltage (velocity/torque)
* Two unipolar digital outputs (0V to 5V)
* Six PWM drive outputs [...]

(1) 64PW3

North Atlantic Industries (1)
64PW3
A conduction-cooled VME card
Features (see all):

* Incorporates two four-quadrant, bidirectional PWM amplifiers that drive brush type (optional brushless) DC motors and optional RS-422, A/D, D/A, or dual resolver-to-digital converters
* Continuous background bit testing
* When interrupt is set, status registers indicate drive fail, bias loss, etc.
* Over-current condition
* Supply over-voltage condition and under-voltage condition
* Over-temperature condition for PWM card and power supply
* Master drive enable [...]

IDM640 Servo Drive

IDM640 is a high precision, fully digital servo drive, with embedded intelligence, and built-in 640W power amplifier. The drive can be used for brushless motors with sinusoidal or trapezoidal commutation, or DC brush motors. The on-board CAN-bus interface allows the drive to be used as an intelligent axis in a distributed intelligence, multiple-axis network of up to 256 axes. Programmable with the high-level Technosoft Motion Language (TML), the IDM640 embeds, on one board, advanced motion control and PLC-specific functionality.
Features (see all):

* Suitable for brushless and DC brush motors
* 12-48 V logic and 80 V motor power supply
* 8 A continuous, 16 A peak current
* Opto-isolated programmable digital inputs (7) / outputs (6) and analog inputs (2)
* High resolution up to 256 microsteps / full step
* Quadrature and sin-cos encoder, Hall sensors and linear Halls
* Resolver, SSI or EnDat absolute encoder (optional)
* RS-232 / RS-485 [...]

Technosoft (2)

ISM4803 Servo Drive
This high-performance intelligent module is a true universal drive covering all applications for AC and DC brushless, DC brush and step motors up to 150 W (48 V, 3 A)
Features (see all):

* Designed to embed motion control, drive and PLC functionalities in a single open frame unit (size: 64 x 104 x 16 mm, card format)
* Programmable with Technosoft Motion Language (TML) and graphical tools in stand-alone or multi-axis configurations
* Torque, speed, position, contouring, profiling, e-cams and step motor emulation are the multi-mode motion operations of this servo module
* Typical feedback devices include tacho generators, incremental encoders, digital or linear Halls
* 48 V motor power supply
* 3 A continuous, 6 A peak
* Programmable digital input /outputs and analog inputs
* Quadrature encoder, Hall sensors or linear Halls
* RS-232 and CAN-Bus2.0 (optional) [...]

ISCM4805 Servodrive

The ISCM4805 Intelligent Servo Control Module is targeted for medium to high volume applications and has a cost optimized hardware structure
Features (see all):

* Being software configurable and having comprehensive diagnostics ISCM4805 is able to drive brushless, DC brush or step motors up to 200 W (48 V, 5 A)
* It is developed to embed motion control, drive and PLC functionalities in a single open frame unit (size: 80 x 50 x 17 mm, credit card format). A 240 W (80 V, 5 A) version (ISCM8005) is also available
* Suitable for brushless, DC brush and step motors
* 12-48 V logic
* 48 V motor power supply
* DIN-rail version available
* High current capability 5 A continuous, 16 A peak
* Programmable digital input/outputs and analog inputs
* Quadrature and sin-cos encoder, Hall sensors or linear Halls
* RS-232 and CAN-Bus2.0 [...]

IBL2403 Minidrive

The IBL2403 Intelligent Minidrive is ideal solution for use in modern miniaturized control of intelligent axes
Features (see all):

* The drive is software configurable to drive brushless, step, DC or linear motors up to 75 W (24 V, 3 A) and embeds motion control, drive and PLC functionalities in a single compact unit (size 65 x 58 x 21 mm)
* Multi-mode motion operations, including contouring, profiling, gearing, and electronic camming, PVT, in stand-alone or multi-axis configurations can easily be programmed with Technosoft Motion Language (TML) in a graphical environment
* Libraries for C++, Delphi, Visual Basic or Labview and S7 PLC, complemented by starter kits, are available for easy integration into the final applications
* Suitable for brushless, DC brush and step motors
* 12-24 V logic and motor power supply
* Programmable digital input/outputs and analog inputs
* Quadrature and sin-cos encoder, Hall sensors or linear Halls.

IM23x Motors

The IM23x Intelligent Motors represent flexible, easy to use and compact products based on Technosoft’s latest MotionChipTM DSP Control Technology
Features (see all):

* This family of motors offers cost-effective motion control solutions for a wide range of applications: basic pulse and direction (IM23x-DS models), stand-alone, pre-stored sequences (IM23x-IS models), and multiple-axis (IM23x-MA models)
* The hardware structure of an IM23x integrates motor, power electronics, controller, position sensor and interface into a single compact unit (104¸144 x 57 x 57 mm), together with basic local digital and analog I/O signals
* IM23x are designed in 3 motor lengths, offering from 0.1 to 0.3 Nm permanent output torque and operated from 12 to 48 V single power supply
* Gearing and electronic CAM functions are also included, for operation in CAN (CANopen – TechnoCAN) or RS-232 networks
* Fully digital intelligent brushless motors
* 12-48 V l [...]

TMC-3D Controller

TMC-3D combines a multi-axis motion controller and a digital servo drive in a single compact unit
Features (see all):

* Multi-axis motion controller (up to 8 axes)
* Real-time 3-D reference generator
* Powerful motion language commands including vector interpolation, 3-D coordinated moves, G-code execution
* CAN network management
* Integrated servo drive for 1 axis, suitable for brushless / DC motors with encoder or resolver feedback
* Usable with all Technosoft drives
* External reference: analog or digital (a 2nd encoder, or pulse and direction)
* Powerful TML instruction set including: motion commands, program flow control, I/O handling, arithmetic and logic operations, remote control from another drive
* Output current: 8 A continuous; 16.5 A peak
* Supply voltage: 12 to 48 V for logic; 12 to 80 V for motor
* Compact covered-frame design (136 x 84.5 x 26) mm [...]

ISD720/860 Drives

ISD720 and ISD860 are fully digital high-precision servo drives with embedded intelligence and a built-in power amplifier (720, or 860 W)
Features (see all):

* Developed for high power needs and cost-sensitive applications
* Suitable for brushless and DC brush motors
* Motor power supply: 36V - ISD720 or 72V - ISD860; 12-36V logic
* High continuous current capability: 20A - ISD720 or 12A - ISD860
* Peak current: 49A - ISD720 or 31A - ISD860
* Setup, tuning and motion programming are simple with EasyMotion Studio and Technosoft Motion Language (TML)
* Perform position, speed or torque control and works in single-axis, multi-axis or stand alone configurations
* Programmable digital inputs (7) / outputs (4), analog inputs (2)
* RS-232 and CAN / CANopen (optional)
* Quadrature encoder and digital Hall sensors
* Open-frame design: 136 x 84 x 26 mm, 226 g [...]

PIM3605 Minidrive

PIM3605 intelligent plug-in minidrive is specially designed for motion control applications where space is critical and embeds motion controller, drive and PLC functionalities
Features (see all):

* 180W servo drive suitable for brushless, DC brush and step motors
* Embeds motion controller, drive and PLC functionalities in one unit
* 12-36V logic and motor power supply, 5A continuous, 16A peak current
* Motion modes: contouring, profiling, gearing, electronic camming, PVT
* Programmable digital inputs (5) / outputs (2), analog inputs (2)
* Quadrature encoder, Hall sensors or linear Halls
* Fully programmable with EasyMotion Studio software and Technosoft Motion Language (TML)
* Can execute complex motions without requiring an external controller
* Starter kits available for evaluating and develop specific projects
* RS-232 and CAN / CANopen (optional)
* Miniature size: 67 x 43 x 20 mm, 27 g [...]

IBL3605 Minidrive

IBL3605 is a remarkably compact intelligent servo drive that reaches up to 600W peak power
Features (see all):

* It embeds motion controller, drive and PLC functionality in one unit
* 180W servo drive (600W peak ) suitable for brushless, DC brush and step motors
* 12-36V logic and motor power supply, 5A continuous, 16A peak current
* Can be mounted right beside the motor, all cables and maintenance thus being significantly reduced
* Fully programmable with EasyMotion Studio and Technosoft Motion Language (TML)
* Usable as a network drive in distributed motion systems through a CAN / CANopen interface, or as a stand-alone motion controller for single-axis control
* Motion modes: contouring, profiling, gearing, electronic camming or PVT
* RS-232 and CAN / CANopen (optional)
* Programmable digital inputs (5) / outputs (2), analog inputs (2)
* Quadrature encoder, Hall sensors or linear Halls
* Starter kits available
* Dimensions: 65 x 58 x [...]

MotionChip

A high performance, ready to run motion controller, based on the TMS320C240 DSP controller
Features (see all):

* Stand alone or master/slave
* Single or multiple axis configuration
* Controls several motor types (DC, Brushless, induction, and step motors)
* Implements open loop, torque, speed, position, and external parameter control structures
* Interfaces Encoder, Hall sensors, and tacho-generators directly, with external interface
* Various communication channels such as SCI, CAN, and parallel I/O
* Execution of advanced motion commands and complex motion sequences
* Technosoft Motion Language is a high level set of codes that allows users to configure and parameterize the MotionChip and to execute motion operations on-line
* Motion Studio platform enhances the use of the MotionChip by simplifying set-up and motion programming as well as the development and graphical evaluation of your motion sequences [...

TECHNOSOFT S.A. (9)

MCK2812 Pro-MS-MATLAB
MSK2812 DSP board (150 MHz, 128kw Flash, 128kw RAM)
Features (see all):

* PM50 power module (50W)
* Brushless motor with Halls and 500-line encoder
* MATLAB model for PMSM position/speed control
* Complete DSP source code for PMSM application
* DMCD-Pro Windows IDE development environment [...]

GESPAC

GESPAC (1)
VMEDMC-4P
A self-tuning motion controller board that drives 4 DC or brushless motors
Features (see all):

* Based on 40 MHz MC56002
* Four 16-bit DAC outputs
* 4 incremental encoder inputs and sixteen 12-48 VDC opto-isolated digital I/O
* ±10V analog output drives any servo-amplifier in torque mode or current mode
* Onboard Flash EPROM
* Auto-expert software for axis tuning and programming that runs on a PC and communicates with the host CPU over a RS-232 serial link
* Assists in the tuning phase of the 2nd order pole placement regulator by calculating the closed loop resonant frequency
* Includes a motion editor
* C library [...]

DMC-2000

Stand-alone motion controllers for the high-speed, flexible Universal Serial Bus (USB)
Features (see all):

* Available in 1- through 8-axis formats and controls step and servo motors on any combination of axes
* Features 12 Mbits/sec USB with two ports, two RS-232/422/485 ports configurable up to 115 Kbits, nonvolatile memory for application programs, multitasking, sinusoidal commutation for brushless motors, two encoder inputs for each axis, 64 configurable I/O
* Optoisolated forward and reverse limits and home inputs for each axis
* Accepts encoder frequencies of up to 12 MHz [...]

DMC-13x8

A high-performance motion controller available in 1-axis through 4-axis formats, enabling control of both step and servo motors on any combination of axis
Features (see all):

* 64 programmable I/Os
* 12 MHz encoder inputs
* Multitasking of up to eight programs
* Sinusoidal commutation for brushless motors
* Flash EEPROM for firmware updates
* High-density shielded cables for noise immunity
* 0.5 msec command processing rates
* Modes of motion include independent axis positioning, linear and circular interpolation, contouring, electronic gearing, and ECAM [...]

DMC-1600 Series

DMC-1600 Series
Line of CompactPCI bus motion control cards
Features (see all):

* Features 80 user-configurable inputs and outputs, nonvolatile program memory with multitasking of up to eight programs, high-speed communications, and onboard sinusoidal commutation for brushless motors
* The CompactPCI bus controller provides dual high-speed FIFOs for sending and receiving commands, and a secondary FIFO for instant access to status and parameters
* Provides high-speed servo update rates with sample rates as low as 62.5 msec/axis and control of up to 12 million encoder counts/sec and step motor control of up to three million steps/sec
* Modes of motion include point-to-point positioning, linear and circular interpolation, contouring, gearing, and ECAM [...]

AMP-20540

A 4-axis servo amplifier board designed for driving four brushless or brush-type motors up to 500W
Features (see all):

* Attaches directly to the 96-pin DIN connector of Galil’s DMC-2143 controller
* Contains four transconductance, PWM amplifiers on a single 6.92” x 4.85” board, with each amplifier capable of producing up to 500W
* Accepts 18-60VDC, produces 7A of continuous current, and has a PWM switching frequency of 60 KHz
* Provides protection for over-current, short-circuit, under-voltage, over-voltage, and over-temperature

Industrial board family

Industrial board family
Pentium and Pentium II boards including Pentium II mobile CPU boards include peripherals for Ethernet, FireWire, CardBus, Ultrawide SCSI, ISDN, and USB
Features (see all):

* Analog I/O functions are available as PC
* MIP modules that fit on i960-based cards or used with a hot swap carrier board
* For motion applications, DSP-based 3U and 6U multi axis motion controllers and brushless power amplifiers are available
* Different hot swap extender cards with bridges and card holders and customization of board functions are offered .

Dual 3 Phase bridge driver

Dual 3 Phase bridge driver for brushless 3 phase motors
Features (see all):

* Available in low voltage and high voltage models
* The low voltage model is rated at 10 A 25 VDC per axis while the high voltage model is rated at 5A 50 VDC per axis
* Each 3 Phase bridge on the 7I39 has selectable overcurrent limits of .75 times and 1.5 times rated current
* An overvoltage clamp protects the 7I39 from inductive voltage surges, reducing the need for large motor supply capacitors
* Low on resistance MOSFETs and high performance gate drivers give the 7I39 high efficiency and low dead time to support high switching rates
* Gate power is derived from logic side power so that unlike other bridges, the drivers are functional all the way down to 0 V motor power supply, allowing safe and easy initial setup and testing
* Encoder and Hall effect inputs are RC filtered and processed through a Schmitt trigger before being forwarded to the controller

Single-axis IC

Magellan MC50110 single-axis IC
Offers users the ability to offload intensive motion control functions from the application’s host processor
Features (see all):

* Motion controller requires only an external amplifier to be functional
* Dedicated single-axis control for DC brush, brushless DC, microstepping, and pulse and direction motors
* Profile generation, servo loop closure, PLC-style signal manipulation, and motor signal generation
* Driven by a host microprocessor using an 8 or 16-bit parallel bus, CANBus 2.0B, or an asynchronous serial port
* 32-bit position error, dual bi-quad filters, 50 µSec loop time and multi-chip synchronization
* Trace capabilities provide designers with on-the-fly data storage for analyzing system performance, tuning servo filters, and performing maintenance and diagnostics
* PMD’s advanced instruction set supports more than 130 commands
* Available in two versions: MC58110 provides dedicated control for DC brush, brushless DC, microste [...]

Prodigy

Low-cost, easy-to-use Prodigy-PCI from PMD delivers high-performance multi-axis motion control for DC brush, brushless DC, microstepping, and step motors
Features (see all):

* Available in 1, 2, 3, and 4-axis versions
* Supports DC brush, brushless DC, microstepping, and step motors
* S-curve trapezoidal, electronic gearing, and external profile modes
* PCI, CANbus, or serial communications
* Watchdog timer [...]

ION Digital Drive

ION Digital Drive
A fully enclosed, compact drive that delivers high-performance network connectivity, power amplification and other advanced features in a rugged, easy-to-use package
Features (see all):

* All digital drive
* DC brush, brushless DC, and step motor versions
* CANbus or serial communications
* S-curve, trapezoidal, velocity contouring, and electronic gearing profiles
* 102 µsec servo loop rate
* 40 kHz PWM frequency
* 500 W capability
* 8 Amps continuous, 15 Amps peak current
* Optional heat sink for increased current capability
* 12-56 volt single power source
* High-efficiency MOSFETs [...]

PC/104 Motion Controller

Magellan PC/104 Motion Controller
Uses ultra-advanced Magellan Motion Processor
Features (see all):

* PCI-bus and PC/104-bus configurations
* Available in 1, 2, 3, and 4-axis versions
* Supports DC brush, brushless DC, microstepping, and pulse and direction motors
* Standard C or C++ language programming using C-Motion
* S-curve, trapezoidal, electronic gearing, and external profile modes
* PCI-bus, CAN bus or serial communications
* Separately programmable acceleration and deceleration values
* Profile & servo changes-on-the-fly
* Advanced PID filter with feedforward and dual bi-quad filters
* Loop rate up to 50 µsec/axis
* Incremental and parallel encoder input
* Dual-loop encoder input
* Pulse and direction output up to 5 Mpulses/sec
* 6-step (hall-based) and sinusoidal commutation
* High-speed motion trace for servo tuning and diagnostics
* High-precision 16-bit DAC output to amplifier
* PLC-style programmable inputs and outputs
* General purpose digital and analo [...]

Motor Control IC

MC73110 Motor Control IC
Controls 3-phase brushless DC Motors
Features (see all):

* High performance digital current loop
* Velocity loop with encoder or tachometer feedback
* Internal velocity profile generator
* Sinusoidal or 6-step commutation
* Direct analog signal input
* Serial EEPROM or onboard Flash configuration load
* SPI (synchronous serial interface) command input
* 10 KHz velocity loop and commutation rate
* Hall sensor inputs
* 6-signal PWM output with shoot-through protection
* Compact 64-pin TQFP [...]

Install and commission

When developers visited the site to install and commission the system, they discovered that they could not use the internal sample timers in the particle counters. Instead, they had to redesign the driver so that it would command the particle counters to stop, return a record, and start a new count every 10 minutes. Although this was a radical departure from the original design, it took the development team less than a day to implement. A custom driver with code would have required much more effort.
Weighing trade-offs

While using the U-CON driver can be effective in certain applications, writing an I/O driver may be worth the effort in other applications. When approaching each project, developers should consider a few critical questions:

* Is high-speed data processing a requirement?
* How complex is the protocol?
* Is it important to have a branded or proprietary interface?
* Which HMI/historian or client applications will need access to the data, and should they access the data via open standards or a proprietary API?
* Does the driver need to be distributed via licensing or royalty-free?
* Do you love writing code (and reading manuals)?

The answers to these questions can help guide developers to the best solution. Using U-CON can prove advantageous for most proprietary serial and Ethernet protocols.
Cutting integration time

OPC’s growth has enabled system integrators to easily integrate most programmable logic control and distributed control systems with HMI/SCADA systems. However, many legacy and proprietary systems still do not have an off-the-shelf driver. Previously, the system integrator’s only option in this situation was to write a custom driver at a significant cost.

The Kepware U-CON driver introduces a new option that can significantly reduce the time spent and expense paid to integrate a serial device. Using this driver, development time can drop from an estimated six-plus weeks per project to a few days.

Transaction editor

One of the transaction editor’s powerful features is its ability to create global functions that all the tags can reuse. This reduces development time and allows changes to be made in one location for all the tags.

The U-CON driver also enables developers to write the transactions using a device ID variable as opposed to hard-coding the ID for each new device.
U-CON in action

EVSystems developers used the U-CON driver in two recent projects that required integrating GE Fanuc’s iFIX SCADA product with legacy devices using a proprietary RS-485 protocol.

A feature common to all Kepware drivers is that all the tags are available via OPC as well as the native nio interface in GE iFIX. The latter approach is particularly useful because data can be read directly in iFIX without configuring any OPC items, significantly reducing configuration and validation efforts.

The first application involved 50 cryogenic tank controllers, each with an RS-485 connection and its own ID. Adding a new tank to the U-CON driver was as simple as duplicating an existing tank and changing the ID property. In total, the cryogenic tank driver took developers no more than a week to write, with half of that time spent learning the protocol and gaining familiarity with the product. (Famous last words: "We don’t need to read the manual." Sometimes, it helps.)

Most recently, the development team used the U-CON driver to talk to a dozen Met One particle counters (see Figure 3). Though the connection remained RS-485, the protocol was entirely different, with a mix of hexadecimal and ASCII components. Nonetheless, total driver development time took about three days.

U-CON driver

U-CON is a universal translator between the proprietary serial world and OPC. With the U-CON driver, developers can easily create OPC data item tags that represent almost any value from the serial device. As with other OPC devices, tags can be read-only or read-write and consist of any data type.

The U-CON transaction editor makes this possible by allowing developers to create the command structure for a tag as a series of simple steps. For example, the screen shot in Figure 1 shows the command structure for reading a temperature probe. The transaction steps are generated using a menu system to create an easy-to-read state machine, as shown in Figure 2.

Ethernet devices

Integrating proprietary serial and Ethernet devices with SCADA/HMI systems
By

Stephen Friedenthal
EVSystems Data Solutions
3To write a driver, or not to write a driver? Developers don’t usually have a choice if a driver isn’t available, but new tools are making the job easier. An experienced Supervisory Control and Data Acquisition (SCADA) integrator explains how one such tool is speeding up the process of integrating OLE for Process Control (OPC) hardware.

When starting a SCADA project, developers must first identify the installed devices and controllers to determine how they will interface with the SCADA system. Most of the time, a programmable logic controller with one or more I/O drivers will be available. With OPC’s growing popularity, hardware connectivity is becoming less difficult.

However, connecting to devices that lack an available driver often presents the greatest challenge. This is especially a problem with devices that have proprietary serial and Ethernet protocols such as electronic scales, particle counters, controllers, and so forth. Developers traditionally resolved this issue by writing an I/O driver from scratch.

Consequently, developers would do well to heed this advice: Don’t bid fixed price. Creating a robust and reliable driver is not trivial, as it requires a keen understanding of hardware and software interfaces and error modes. Additionally, as OPC becomes an industry standard, it only makes sense to undertake the effort if the driver supports the OPC protocol.
Creating drivers without writing them

If developers don’t have the time or expertise to write their own drivers, they should consider using the Kepware User-Configurable (U-CON) driver, which has proven useful in two recent development projects. Figure 1 shows the U-CON transaction editor.

Serial interface simulation

Many industrial network devices use RS-232/485 for communication. Typically the serial port of a PC would be directly (or indirectly, via a serial Ethernet gateway) connected to the serial port of the device. There would be a software running on the PC, which sends commands to the device over the serial interface. By some accounts there are hundreds of serial protocols in use in SCADA networks. Some of the more common protocols are MODBUS and DNP.

We need to simulate those protocols over the serial port, so as to present a protocol interface to an attacker who connects to the serial port. Many languages support serial interface programming including Python and Java. We were able to achieve serial communication through a open source Python serial programming module (pyserial.sf.net).

Simulating 802.11
The HostAP driver(http://hostap.epitest.fi/), replies for 802.1b management packets and converts a client adapter an access point. The driver can be used to simulate an access point which is inside a automation or a SCADA network
Capturing attack tools and capturing the attackers' track
Though not part of Honeyd, there are lots of keystroke loggers available. We need a mechanism to track the attacker on the web interface of the device. We do not know of any tools which can provide that functionality, however we explored some possibilities where the the Java applet (running on the "attackers" web browser) is able to comm

Challenges

Deployment and Testing
An ideal deployment site for such a script would be a subnet close to a real Industrial/SCADA network or a phone number which belongs to a SCADA/Automation plant. We are not aware of any active and on-going SCADA specific attacks, it would be difficult to get a SCADA aware attacker into the honeypot.

Review of existing technologies

Review of existing technologies and relavency

Honeyd
Honeyd has facilities for easy simulation of TCP/IP stacks and applications.
Honeynet takes Nmap and Xprobe signatures through configuration files and sends packet responses to scans matching those signatures. Users can set up profiles, mapping IP addresses that Honeyd should respond to a corresponding device profile. When attackers Nmap or Xprobe scan the IP address which Honeyd is taking care of, he will be returned with packets matching the corresponding device profile.

Therefore using Honeyd, it would be possible to simultaneously simulate stacks of multiple IP based Industrial devices, provided the corresponding scanning tools (Nmap or Xprobe) has the knowledge of the signature. As of now, there are no signatures of Industrial devices in Nmap's database.
Honeyd allows the user to listen on a port and run a script on that particular port when anybody connects to that port. As of now, there are many scripts contributed to the project, which can simulate web pages, WSFTP servers and Cisco telnet servers.

Using this feature on Honeyd, it is possible to write scripts that simulated various Industrial Ethernet protocols. For example, it would be possible to simulate a Modbus/TCP server on port 502 and EtherNet/IP on ports 44818/2222.

Capture the attacker tools

Capture the attacker tools and tracks
Our scripts need to capture the attacker tools and tracks. That should include keystroke logging and facilities to capture the tools and binaries he might be up loading, if the attack. Our scripts also need to capture network traffic.

Simulate Network

We need to simulate various entry points so that when an attacker encounters a perimeter device, he will be presented the same network as a real SCADA network at that particular network entry point
Various network entry points that we need to simulate include:

1. A router directly connected to the Internet: Control system networks are typically not directly conne a control network is located inside a corporate network. Assuming the corporate network as Internet, we need to simulate the entry point of a router that seperates the control network and the corporate network. The devices that are normally connected to such routers would be Industrial Ethernet switches or industrial devices with an IP stack, such as some IP enabled PLCs and wireless access points.
2. Direct serial device:Some of the industrial devices have a modem that can be directly dialed into from a PSTN. We need to simulate a "modem server" that can take connections and behaves like a industrial device or is connected to a industrial device.
3. A Ethernet enabled industrial device directly connected to the Internet: Such a scenario should be the same as simulating the stack, the protocols and applications on that device and connecting that to Internet
4. An Ethernet serial gateway directly plugged into the Internet:An Ethernet serial gateway is a bridge between the IP network and the serial interface. The IP side of the device would be connected to the network, either a Industrial switch or a router to which other IP industrial devices are connected to. The serial side of the device would be connected to a serial device or a serial network.
5. Wireless: Wireless is one of the entry points into a Industrial network. Most of the Industrial wireless devices use proprietary wireless protocols and some of them use 802.1b standard. Typically the serial interface of the device would be connected to a wireless bridge.
6. Remote desktop access and HMIs:The Human Machine Interfaces and the software that communicates with Industrial devices usually run on a Windows machine. Administrators who want remote access to these devices would typically run a remote desktop viewer, such as VNC or PC anywhere. An attacker would normally find it through a port scan ' after he gets into the control network and might get to it using a VNC client. Simulating this would probably need a custom made VNC protocol simulation.
7. Remote Access Server (RAS):Another possible entry point into a control network is to dial into the network using PPP and use the PPP password to authenticate yourself to a Network Access Server and then directly access the Industrial device.

Feature Requirements

Based on our knowledge of industrial network applications, products, and protocols, we identified the following requirements:

Individual Device Simulation
To simulate individual devices, the following functionality is needed:

* Stack level: To simulate the TCP/IP stack of a Ethernet-based device device to a script kiddie type attacker who is scanning the network with OS detection tools such as Nmap and Xprobe.
* Protocol level: To simulate industrial protocols for skilled attackers who have the tools which interrogate protocols and want to do something meaningful using the protocol features
* Application level: To simulate various applications on a SCADA device such as web servers and management applications such as SNMP and Telnet.
* Hardware level:Many of the SCADA devices use serial interfaces such as modems and RS232 interfaces for both SCADA protocol communication and for management purposes. An attacker who either "logs into" a SCADA device or has access to the serial network, needs to be presented with a serial device and/or a protocol communication over a serial device.

INTRODUCTION

There is still little information about SCADA vulnerabilities and attacks, despite the growing awareness of security issues in industrial networks. As is the case with IT security, owner-operators are often unwilling to release attack or incident data. However, unlike IT products and protocols, there are not the sort of public repositories of vendor advisories and vulnerabilities in industrial devices. Although some vulnerability research is being conducted in this area, very little has been released publically and no "SCADA security tools" (whatever that might mean) have been released to the public.

To address these limitations, this goal of this project is to provide tools and to simulate a variety of industrial networks and devices. We see several uses for this project:

* Build a HoneyNet for attackers, to gather data on attacker trends and tools
* Provide a scriptable industrial protocol simulators to test a real live protocol implementation
* Research countermeasures, such as device hardening, stack obfuscation, reducing application information, and the effectiveness network access controls

Objectives

The short-term goal of the project is to determine the feasibility of building a software-based framework to simulate a variety of industrial networks such as SCADA, DCS, and PLC architectures. We plan to document the requirements and release proof of concept code (in the form of honeyd scripts) so that a single Linux host can simulate multiple industrial devices and complex network topologies. Given the variety of deployments and the lack of standard, well-defined architectures for industrial networks, this project attempts to create the building blocks so that users can simulate their networks own networks--not make assumptions about what "real world" SCADA/DCS/PLC look like. Assuming deployment of "SCADA HoneyNets" ever reach critical mass, the longer term objective of the project is to gather information about general attack patterns and specific exploits that could be used to write signature for commercial and Open Source IDS products.

Introduction

HONEY NEWS

News & Updates
# 7/15/05/(released version 0.3) - Converted teh stand-alone scripts to work with honeyd, changes to html scripts. See Release Notes for more details.

# 6/01/04/(released version 0.2) - Fixed the bug regarding the absense of modbusHdrs.py, included sample nmap OS fingerprints of some PLCs, included a test file to generate custom Modbus packets to test the modbusSrve.py implementation
# 5/13/04 - Major cleanup of content
# 3/20/04 - PLC Simulation scripts available for down and PLC Simulation Case Study complete.