Internet az automatizálásban Felügyelet és kezelés

Size: px

Start display at page:

Download "Internet az automatizálásban Felügyelet és kezelés"

Osborne Lawson
6 years ago
Views:

1 oder Internet az automatizálásban Felügyelet és kezelés Telecontrol Távszerviz Intranet: Control MES ERP kapcsolata Karbantartás

2 You Want to Use the Current Technological Trends in Automation The trend away from central control structures and towards distributed on-site units The use of Ethernet for all levels of automation The increased use of open IT standards in automation IT and the automation world are growing closer together 01/2007 2

3 The Ethernet Trend... World wide web IT functions Webserver , SMS Remote service Home office Networking across sites 01/2007 3

4 Ethernet egyfajta kommunikáció a folyamat és az IT szinten HMI Controller Security Safety Switching Wireless Proxy Motion Control & Drives Other fieldbuses Robots Distributed I/O Safety Sensors HMI Proxy Distributed I/O 01/2007 4

5 Why security for automation networks? Automation and Drives Automation networks Yesterday & today Proprietary systems Communication as stand-alone solution The production department is solely responsible for industrial communication Security mechanisms are hardly used Product-oriented services Trend Today & tomorrow Open systems and utilization of IT mechanisms Integrated networked systems and connection to the IT infrastructure The IT department is jointly responsible for automation networks Comprehensive security solutions Solution-oriented services 01/2007 5

6 Occurrence of disturbances and their causes 01/2007 6

7 Why industrial security? Automation networks are attacked "from within", for example: Accidental or intentional access violations Viruses, worms, Trojan horses through mobile PCs Communication load, e.g. broadcasts The corporate firewall does not protect against this! 01/2007 7

8 Danger Sources Due to Increased Networking Automation and Drives Ping Ping Network /2007 8

9 Security Requirements in Automation Networks Automation and Drives Protection against wrong addressing Simple configuration without expert knowledge No effect upon existing network infrastructures Protection against manipulation Secure automation network Protection against espionage Scalable for different security requirements Diagnosing and logging of attempted attacks Protection against communication overloads 01/2007 9

10 The Security Concept With Security Modules Automation and Drives IP subnet A IP subnet C VPN tunnel Internet Intranet IP subnet B IP subnet D VPN = Virtual Private Network Data traffic between internal and external networks is controlled by security modules Encrypted data transmission between security modules 01/

11 Example Configuration Ind. security component Secure connection (VPN tunnel) Firewall or S 612 / S 613 Reaction-free protection of critical data paths 01/

12 IWLAN Example Configuration Ind. security component Safe connection (VPN tunnel) Protection of wireless or mixed connections 01/

13 IWLAN and HiPath Wireless Linking of industrial and office sector by means of SCALANCE W788-2RR and HiPath Wireless Controller 01/

SCALANCE S security modules Protection against incorrect addressing unauthorized access espionage manipulation operator errors The security

14 SCALANCE S security modules Protection against incorrect addressing unauthorized access espionage manipulation operator errors The security solution is scalable and reaction-free Security is applicable without specific expertise Use of proven and certified security standards 01/

router mode Network Address Translation (NAT) Network Address and Port Translation (NAPT) DHCP server Can protect networks

15 SCALANCE S security modules SCALANCE S602/S612/S613 IP30 degree of protection 2x RJ45 10/100 Mbit/s Ethernet port Variant with firewall, without VPN Filters both IP-based and MAC-based data traffic Can be operated in the bridge mode and in the router mode Network Address Translation (NAT) Network Address and Port Translation (NAPT) DHCP server Can protect networks without limiting its quantity framework C-PLUG SCALANCE S612/S613 Data security by means of IPSec VPN tunneling 01/

16 Feature: Security and Safety Internet Service PC with VPN client software VPN Ethernet Backbone HMI SCALANCE S SCALANCE S Controller Wireless Motion Control Pro xy Distributed peripherals Sensors HMI Proxy SECURITY zone Other fieldbuses SECURED PROFIsafe zone SCALANCE S modules secure safety zones. 01/

OS Single Gliederungspunkt Station 3 (multi- VGA) PCS 7 Slot SIMATIC PCS 7 System Architecture Engineering Station ES SIMATIC PDM Engineering Toolset OS Clients OS-LAN OS server (redundant) @ BATCH

Drives Office LAN Ethernet Plant Plant Information Maintenance Service Box PC PROFIBUS-DP DP/AS-I DP/EIB MODBUS ET 200 X ET 200 S AS 417 AS 416 AS 414 PROFIBUS-DP DP/PA Link PROFIBUS-DP Zone 2 ET

17 OS Single Gliederungspunkt Station 3 (multi- VGA) PCS 7 Slot SIMATIC PCS 7 System Architecture Engineering Station ES SIMATIC PDM Engineering Toolset OS Clients OS-LAN OS server BATCH flexible Clients Ethernet / Fast Ethernet Office LAN SAP R/3 Ethernet Internet/ 7 / Simatic IT OPC Server Framework Components Fast Ethernet Batch server Automation and Drives Office LAN Ethernet Plant Plant Information Maintenance Service Box PC PROFIBUS-DP DP/AS-I DP/EIB MODBUS ET 200 X ET 200 S AS 417 AS 416 AS 414 PROFIBUS-DP DP/PA Link PROFIBUS-DP Zone 2 ET 200M Ex-I/O HART PROFIBUS-PA Zone 1 OS OP ET 200iS PROFIBUS-DP AS 414 F/FH AS 417 F/FH ET 200M failsafe ET 200M DP/PA Link PROFIBUS-PA PROFIBUS-DP AS 414 H AS 417 H ET 200M DP/PA Link PROFIBUS-PA Y Link COx, NOx, etc. 01/

18 Interface to the IT World with SIMATIC IT Topology and Data Communication Automation and Drives SAP R/3 ERP PCS 7 OS SIMATIC IT Production Suite Server MES Client MES Planning level MIS/ MES MIS Execution level PCS 7 ES Controls Control level 01/

Interface to the IT World with @PCS 7 Automation and Drives Process data available through company with @PCS 7 Read access to OS data via Internet/Intranet (process, archive data, messages) Write

19 Interface to the IT World 7 Automation and Drives Process data available through company 7 Read access to OS data via Internet/Intranet (process, archive data, messages) Write access to OS data Communication with server applications IT server add-ons Company-wide availability of process data; leverages C/S technology; open for custom C/S applications 01/

Mastering complex telecontrol networks Control center A

cross-communication User monitoring Time synchronization

data storage RSM All networks unrestrictedly combinable

Analog ISDN GSM RSM Wide Area Network Radial radio

20 Mastering complex telecontrol networks Control center A Dedicated line Dial network Data routing, cross-communication User monitoring Time synchronization Archives for alarms and measured/metered values Local data storage RSM All networks unrestrictedly combinable Telediagnostics and teleprogamming FOC Radio relay WAN Analog ISDN GSM RSM Wide Area Network Radial radio Control center B DSL INTERNET GPRS RTU RTU RTU ESD RTU RTU RTU ESD RTU 01/

21 Feature: Remote access over the Internet SCALANCE S modules support secure Internet communication by means of DSL or GPRS. 01/

22 Feature: Secure SINAUT communication Company LOGO SCALANCE S modules support secure SINAUT communication by means of DSL or GPRS. Alarm Control Center SINAUT ST7cc/sc Control center TIM 3V-IE Adv Only required in case of direct slaveto-slave traffic between the GPRS stations SCALANCE S61x Remote station GPRS INTERNET DSL router SINAUT ST7 also with: analog phone network ISDN Dedicated line Radio WLAN DSL router MD740-1 Station Ethernet GGSN* 1 Station SCALANCE S61x TIM 3V-IE GSM provider APN *2 Ethernet TIM3-VIE 01/

23 SINAUT MICRO For small data volumes and public wireless networks Main control center INTERNET Communication via the GPRS service of a mobile radio network (GSM) Other possibilities: S7-200 station sends SMS S7-200 station GSM / GPRS Provider Teleservice with dialed connection S7-200 station Teleservice SMS 01/

24 Overview Gliederungspunkt TeleService 2 SIMATIC TeleService Consisting of integrated components: TeleService adapter TeleService software Function blocks (FBs) for remote maintenance, remote coupling, alarm using text messages, by or fax Adapter Bus connection MPI Profibus PPI PROFINET Ethernet TeleService Adapter II TeleService Adapter IE Analog x x x ISDN x x x Analog ISDN x x x x 01/

Gliederungspunkt Engineering 5 Router are available

25 Engineering Teleservice with WinAC Automation and Drives Engineering Station, PG WinAC Station Gliederungspunkt Engineering 5 Router are available for analog, ISDN, DSL LAN LAN Router WAN Router 01/

26 Remote maintenance for HMI WinCC flexible with Remote HMI for operator panels with Internet Explorer WAN TS Adapter TeleService Adapter II TeleService Adapter IE Engineering station PC/PG No Yes or with the application Remote Gliederungspunkt Maintenance 7 Ethernet PROFIBUS 01/

Integral web server Gliederungspunkt Overview 1 Omnipresent diagnostics Via integral PROFINET interface Read access via Internet browser

Module identification (MLFB, FW version, etc.

27 Integral web server Gliederungspunkt Overview 1 Omnipresent diagnostics Via integral PROFINET interface Read access via Internet browser Display optimized for PCs, Multi Panels, PDAs User-friendly access to diagnostics data anywhere Enhanced plant availability Web contents Module identification (MLFB, FW version, etc.) Operating status, diagnostics buffer Display of messages (Alarm S) Ethernet parameters and statistics Languages: now: DE + EN, later: FR, ES, IT, CN, JP (2 languages at the same time) S7-400 Internet Security (optional) S /

28 Call the web interface via pocket PC Automation and Drives By calling the web interface with a pocket PC, the call will be: Access 01/

29 Start page web page Gliederungspunkt Start page 5 Shows the real status of LEDs and mode selector switch Update by pressing F5 01/

317F-2 PN/DP (6ES7 317-2FK13-0AB0) SIMATIC ET 200pro* IM 154-8 CPU (6ES7 154-8AB00-0AB0) *Delivery planned: 12/2006 Firmware update possible for: 6ES7

30 SIMATIC Controllers with integral web server Automation and Drives SIMATIC S7-300 from firmware V2.5* CPU PN/DP (6ES EL00-0AB0) CPU PN/DP (6ES EH13-0AB0) CPU 315F-2 PN/DP (6ES FH13-0AB0) CPU PN/DP (6ES EK13-0AB0) CPU 317F-2 PN/DP (6ES FK13-0AB0) SIMATIC ET 200pro* IM CPU (6ES AB00-0AB0) *Delivery planned: 12/2006 Firmware update possible for: 6ES EH13-0AB0, 6ES EK13-0AB0, 6ES EL00-0AB0, 6ES FH13-0AB0, 6ES FK13-0AB0 SIMATIC S7-400 CPU PN/DP (6ES EM05-0AB0) CPU PN/DP (6ES ER05-0AB0) CPU 416F-3 PN/DP (6ES FR05-0AB0) Products 01/

31 Gliederungspunkt Highlights 1 SIMATIC WinCC flexible Innovative HMI Concepts Sm@rtAccess Automation and Drives Distributed operator stations Coordinated control and monitoring of distributed machines A configurable picture object (Sm@rtClient display) shows the screen content of the respective HMI system (Sm@rtServer) Only one station at any time possesses control rights Sm@rtServer Sm@rtClient Sm@rtClient Sm@rtClient Ethernet Central changes Time savings Reduced load on the field buses 01/

Gliederungspunkt Highlights 1 SIMATIC WinCC flexible Service & Diagnostics via the Web Sm@rtService Remote control and monitoring of an operator station via the

32 Gliederungspunkt Highlights 1 SIMATIC WinCC flexible Service & Diagnostics via the Web Sm@rtService Remote control and monitoring of an operator station via the Internet/Intranet or LAN With the Internet Explorer or by means of the Sm@rtClient application Engineering Station PC/PG Automation and Drives Ethernet PROFIBUS 01/

33 Gliederungspunkt Highlights 1 SIMATIC WinCC flexible Service & Diagnostics via the Web Sm@rtService Automatic generation of s Triggers: Alarm of a certain alarm class Event, e.g. value change of a tag Contents: Alarm text with process tags Date/time address for reply SMTP-Server ISDN/DSL Modem/Router WWW, MES; Office area Automation and Drives Internet Service Provider Ethernet PROFIBUS 01/

34 Automation and Drives Corrective Maintenance Remote Diagnostics with the WebNavigator Remote Access to WinCC Systems Corrective Maintenance Gliederungspunkt System Diagnostics 2 Gliederungspunkt Process Diagnostics 3 Remote Diagnostics Gliederungspunkt Preventive 5 Maintenance Gliederungspunkt Increase of Quality 6 and Productivity Statistics Analysis Simple application no new configuration Remote control or remote monitoring from different workstations Access protection via user administration Separate screens only for remote access possible Application Examples: 1. Intranet or Internet access to the WinCC system 2. Remote diagnostics of individual or multiple plants/ machines (e.g. unoccupied control rooms) 3. Remote control via Panels (thin clients) 4. Connection of mobile devices such as Mobic / PDA Internet Production plant 01/

35 Example: Remote Control through Web Technology (WebNavigator) Corrective Maintenance Gliederungspunkt System Diagnostics 2 Gliederungspunkt Process Diagnostics 3 Remote Diagnostics Plant operator Access to the WinCC stations Intranet Internet Internet Advantage Information for the production management Remote diagnostics from the office Remote diagnostics by maintenance personnel Gliederungspunkt Preventive 5 Maintenance Central Server Gliederungspunkt Increase of Quality 6 and Productivity Statistics Analysis Production 01/

36 Automation and Drives Example: Remote Control or Diagnostics through Web Technology (WebNavigator) For better control of distributed plants Corrective Maintenance Gliederungspunkt System Diagnostics 2 Gliederungspunkt Process Diagnostics 3 Remote Diagnostics Gliederungspunkt Preventive 5 Maintenance Gliederungspunkt Increase of Quality 6 and Productivity Statistics Analysis Special Purpose Association Internet Either remote control or remote diagnostics of individual or multiple WinCC stations, e.g.: Access to multiple works Control rooms in the field of water / waste water (unoccupied control rooms) Physically distributed WinCC computers in building services or energy supply applications Water Treatment Plant 1 Water Treatment Plant 2 01/

37 Corrective Maintenance Gliederungspunkt System Diagnostics 2 Gliederungspunkt Process Diagnostics 3 Remote Diagnostics Gliederungspunkt Preventive 5 Maintenance Gliederungspunkt Increase of Quality 6 and Productivity Statistics Automation and Drives Example: Remote Control through Panels as Thin Clients (WebNavigator) Full SCADA functionality also direct on machines Plant Operator at the Panel Access to the entire System of the WinCC Server Local Production Unit Access to WinCC stations also from local Panels Low-priced on-site solution Rugged hardware in the production Central Server Analysis Production 01/

TIM 3V- IE ADVANCED. Function

TIM 3V- IE ADVANCED. Function TIM 3V- IE ADVANCED Function The TIM 3V-IE Advanced enables one or more SIMATIC S7-300 or control center PCs (e.g. SINAUT ST7cc or ST7sc) to exchange data with other SINAUT ST7 or ST1 stations via any