DCS security issues

Thread Content

With the rapid advancement of science and technology, the level of automation in enterprises is also continuously improving, and investment in high-tech technologies is increasing as well. Over the past decade, DCS systems, which represent an important indicator of the level of automation in modern enterprises, have been widely used in large-scale enterprises in China, especially those in the process industry. 　　 The upgrade of conventional instruments to DCS systems, despite its many advantages, still presents several issues that those responsible for the design, installation, and maintenance of DCS systems must take into account: Conventional electric three-type instruments have a truly distributed structure, with each instrument being responsible for only one input or (and) output; therefore, in the event of a fault, it affects only that one input or (and) output signal. However, the DCS system is different. Although it operates on the principle of centralized management and decentralized control, with the smallest unit of control or monitoring being a channel (i.e., one input or output signal), the inherent characteristics of the DCS system along with stringent environmental conditions mean that failures do not occur in such a simple manner. Issues such as communication failures, power supply failures, or cable failures can affect the operational safety of individual devices, certain components, or even the entire system. Therefore, it is necessary for the developers and maintenance personnel of DCS systems to pay greater attention to the security issues associated with these systems, in order to minimize or avoid failures and ensure the safety of the operational equipment. 　　Based on years of experience in development and maintenance, I believe that the security of DCS systems boils down to two aspects: software and hardware. In terms of software, it mainly includes system software, as well as configuration and development application software. Since common DCS systems today, such as those from companies like HONEYWELL, YOKOGAWA, FOXBORO, ABB, and FISCHER_ROSMENT, have reached a high level of maturity in terms of system software development, their corresponding configuration software also provides comprehensive testing functions. The only potential issue may arise with sequential programs, interlock programs, or other applications written using the development languages or tools provided by the system (such as ladder logic, CL language, TCL language, etc.). Solving these issues generally poses no problems as long as strict checks are carried out during testing. Here, I would like to focus on the following analysis and discussion of potential security issues related to hardware: Generally speaking, the security of DCS systems can be considered from three aspects (or stages): 1. Security in terms of design; 2. Security in terms of integration; 3. Security in terms of maintenance. 1. Design safety refers to the hardware and environmental design considerations made by the design team and suppliers during the initial configuration of the system. This is crucial for the security of the entire DCS system, as it directly affects the two security factors mentioned below as well as the proper operation of the DCS system in the future. These include: ⑴ Environmental design: such as the layout of the DCS control room and cabinet rooms, floor patterns or floor materials, wall types, lighting methods, geomagnetic and electromagnetic interference, partition choices, sound insulation, maintenance of air purity, as well as design for constant temperature, constant humidity, and ventilation. Among these, particular emphasis should be placed on the design for constant temperature and ventilation. We believe that, while ensuring the hardware environment temperature of the DCS system remains at 23±2°C, it is advisable to avoid using centralized air conditioning or air conditioning systems with constant temperature and humidity control, in order to save costs and reduce the complexity of air conditioning maintenance. The reason for ensuring adequate ventilation is to supply fresh air while meeting the requirements for air cleanliness in the machine room, thereby preventing the air inside the operation room from becoming polluted and compromising the safety of the maintenance personnel. A typical design approach involves using a split-type air conditioner in combination with a filtering and air-exchange fan. Additionally, the choice of split-air conditioners is also crucial; imported or well-known domestic brands should be selected, with two units operating simultaneously. Of course, if funding permits, choosing a reliable central air conditioning system is also a viable option. However, two issues must be taken into account: first, the design location of the air intake and exhaust ducts for the air conditioner should, while considering the efficiency of air regulation, avoid being directly facing the cabinets, so as to prevent condensation water from falling into the cabinets with openings on their tops during summer and causing problems ； Secondly, since there are many heat sources in the cabinet room, it is necessary to consider the balance between cooling and heating supply in the cabinet room and the control room. 　　 ⑵ Power supply and power source design: 　　 Selection of UPS: A UPS with an appropriate power rating should be chosen based on the requirements of the DCS system. The capacity of the backup batteries for the UPS can be determined by considering the system’s ability to operate at full load for 30 minutes. Since UPS failures are inevitable, the type of UPS should be chosen such that it can be replaced online, thereby preventing any disruption to the operation of the DCS system due to UPS replacement or maintenance. For critical equipment, dual-machine hot standby should be considered; however, with current UPS systems that use this dual-machine hot standby approach, synchronization issues often arise, affecting the seamless transition to backup power. Therefore, the selection of a UPS should be done carefully. 　　 Power supply options: include 220V AC distribution panels and 220V→24V (or 12V, 5V) power supplies. For control systems, redundancy in AC/DC conversion power supplies must be ensured. The outputs of the redundant power supplies should be connected in parallel through Schottky diodes (unless the source specifies that they can be connected in parallel directly), and it should be avoided that the redundant power supplies are powered by a single AC distribution panel. Generally, the configuration of such power supplies is provided by the DCS system supplier. It should be noted, however, that care must be taken to avoid design layouts in which multiple AC power supplies are placed too closely together, resulting in poor heat dissipation. Additionally, the spare power supplies of the same type that should be provided by the supplier must amount to no less than 20% of those actually installed (at least one spare unit of each type is required). In addition, when selecting a 24VDC power supply, it is necessary to consider one with a fault alarm output function, so that the DCS can monitor and issue alarms in real time via DI cards ； If indeed no fault output alarm is generated, considering the use of parallel-connected relays to connect to the DCS indirectly should be an option. 　　 ⑶ Selection of ventilation and cooling equipment: The ventilation capacity of all equipment in the entire system must be ensured. In particular, AC/DC power supply equipment, control equipment, and high-power diodes. Whether to add cooling equipment such as fans to the front and rear doors of the cabinet should be determined based on the heat dissipation requirements of the equipment inside. Due to the issue of condensation water, it is advisable to avoid using direct top exhaust methods (especially for DCS system cabinets), and it is best to have temperature monitoring and alarm functions inside the cabinets. 　　 ⑷ Filtering equipment: While ensuring proper ventilation and cooling for the heating devices, it is necessary to prevent dust and corrosive gases from entering the cabinets or equipment. Therefore, attention must be paid to the use of filters. 　　 ⑸ System wiring: It should include specialized communication, power, and signal wires and cables as well as grounding wires provided by the DCS supplier, along with power supply cables (including 220V AC cables and 24V DC cables), signal and grounding system cables provided by the design department. The quality of the connections for these communication, power, signal, and grounding wires and cables in the system must be checked. 　　 220V AC cables: Mainly used to supply power to various subsystems and peripherals such as monitors and printers. The cross-sectional area of the power supply conductor should be determined based on the actual power consumption; generally, a three-core solid copper wire with a cross-sectional area of not less than 2.5 mm2 should be used. When the power supply distance is short (such as inside a cabinet or in adjacent cabinets), two or three single-core solid wires can be used. When the power supply distance is long, it is advisable to consider using armored shielded cables. To avoid interfering with other signals, all AC wires and cables should be routed in raceways or ducts (shielded insulated cables can be laid flexibly depending on the actual situation), and the protective metal boxes or ducts must be reliably grounded. 　　 24V DC wire: The power supply for the monitoring devices in the DCS system is generally 24V DC provided internally by the system. The 24V power supply required during integrated installation is generally used for the input and output of drive relays, I/O devices such as field transmitters, or as external power for certain terminal boards in the DCS system. Generally, ordinary wires with a cross-sectional area of not less than 1 mm2 or copper mesh shielded cables can be used; when the equipment’s load current is high, the cross-sectional area can be increased to 2.5 mm2 as appropriate. 　　 I/O input/output signals: For ordinary signal lines, it is advisable to use shielded cables, such as the K-series or J-series specialized computer control cables. When funds are limited, consider using BVV or RVV series unshielded cables, and try to avoid using ordinary wires ； The selection of thermocouple wires or cables can be determined based on budget considerations. 　　 Ground wire: It should be configured according to system requirements. 　　 Terminal selection: For AC power distribution, grounding, and powering multiple devices with 24V, an O-type connection is recommended to improve the quality of the connection. For I/O wiring and single-supply of field transmitters, a Y-type or type I power supply is recommended to facilitate disconnection and maintenance. Additionally, the crimping quality at the ends must be ensured. Special attention should be paid when tubular types (such as Widmer) are not used. The length of wire to be stripped and the type of crimping tool to be used should be selected in accordance with the type of connector to be used. Special care must be taken during crimping to avoid pressing on the insulated part, and any excess exposed wire should be cut off to prevent it from making contact with other metals. 　　 ⑹ Configuration settings: The number of I/O configurations for the device circuits should not exceed 80% of the maximum I/O capacity of the same type of cards available in the system. The number of I/O cards in the system is determined based on this criterion, which facilitates future configuration adjustments. Additionally, to avoid the inconvenience associated with adding I/O configurations during system operation, some of the spare channels could be configured as temporary circuits that can be used whenever needed. 　　 ⑺ Subsystem or node configuration: The system configuration should ideally not exceed 60% of the maximum configuration allowed by the system. For the redundancy design of the control system, redundancy configuration using card trays or within cabinets is preferred, with as few cables as possible between cabinets. The number of spare cards or devices should be no less than 20% (including the specialized devices such as power supplies and fans that are difficult to obtain, as mentioned above). 　　 ⑻ Selection and arrangement of cabinets: Standard cabinets of 800X800X2200 are generally chosen, but it is necessary to decide whether to use side panels based on the wiring requirements of adjacent cabinets, taking into account the security requirements of different systems; attention should also be paid to reducing the width of the cabinet when side panels are not used. Cabinets should be arranged to facilitate construction and maintenance, and status indicators or alarm signals should be easy to monitor; cabinets should also be protected from direct sunlight. 　　 ⑼ Layout of the control panel and auxiliary control panels: Protection should be provided below the countertop and the bottom guards of these panels to prevent debris from entering inside them. The layout should be based on aesthetics and simplicity, while also taking into account the ease of use for operators. In particular, the location of the auxiliary control panel should be adjacent to the corresponding operating station. The control panel should be protected from direct sunlight and reflections from the CRT, which could affect operation; these aspects should be taken into account in the design of the machine room. 　　 　　2. Integrated security: Safety considerations during the hardware integration and on-site installation of DCS systems. 　　 This mainly includes the installation of cabinets, control panels, and cable trays for the DCS system, the installation of communication systems, power supply systems, I/O signal systems, and grounding systems, as well as the installation of other auxiliary equipment. 　　 ⑴ Cabinet installation: According to standards, the cabinet bottom plate should be made of insulating material and secured to the cabinet base using insulating bolts, in order to ensure safe separate grounding of the system. However, in our conventional construction, insulation separation is generally not provided as it is difficult to implement using this method. Therefore, for DCS systems that require two grounding points, safety is ensured by grounding them both indoors (at the cabinet base) and outdoors (at the safety grounding post) ； For DCS systems that require only one ground connection, safety and system integrity are achieved by grounding at both ends: indoors (at the cabinet base) and outdoors (at a properly grounded stake). The instability in the system’s grounding is caused by a potential difference (which can be large or small) existing between the indoor and outdoor areas. For DCS systems that require only one ground, the signal reference of the DCS system is actually in an unstable state at all times. Of course, since the potential difference can be ignored, in practice it generally does not pose a threat to the safety of the system. However, when there are unexplained abnormal issues in the system, attention should be paid to grounding problems. 　　 ⑵ Console installation: The consoles generally do not need to be fixed in place, but they should be connected to each other using connectors. 　　 ⑶ Tray installation: The use of trays is primarily intended to ensure the shielding and isolation of cables, thereby preventing signal interference. Therefore, generally, two types of trunking boxes are required: one for signals (including DC signals below 24V or power supply cables) and another for power supply (220V AC). For 220V AC power supply, it is sometimes possible to consider installing the wires in a galvanized pipe in an overhead manner, but in this case it is essential to ensure that the wires pass through bends or tees without damaging their insulating coating. However, for large-scale installations, laying too many trunking boxes due to the numerous I/O cables can be counterproductive and interfere with cable installation. Therefore, whether and how to install cable trays should be determined flexibly based on the actual scale of the installation and the design of the machine room, as there is no one-size-fits-all approach. 　　 ⑷ Communication network system: The communication network cables for the system are provided by the supplier. During installation, attention should be paid to the routing location and direction of these cables. To prevent external contact, they should be routed along the corners of the cabinets, avoiding parallel routing with power supply cables (especially unshielded 220V AC cables); wiring should preferably be done inside the cabinets ； The A and B cables of the redundant network should be arranged separately and at a certain distance from each other ； For network connectors with specific torque requirements, construction shall be carried out in accordance with those requirements ； The network shielding wire must be connected correctly. If possible, the entire network should be shielded; at the very least, plastic pipes should be used to provide protection against water and rodents. 　　 ⑸ Power supply system: includes 220V AC power cables and 24V DC distribution wires. Slot boxes or separate conduit wiring should be used to avoid running cables in parallel with signal lines (especially 220V AC supply lines). O-rings should be used for the connector noses, the crimping process must be of high quality, and burrs on the wire cores should be removed to prevent short circuits. 　　 ⑹ I/O signals: The shielding of the signal lines should be grounded to avoid interference, but it must be grounded at only one end. 　　 ⑺ Ground wire: An O-type wire nose should be used. For systems that perform a 4-20mA→1-5V conversion on the safety barrier, special attention should be paid to the signal grounding of the safety barrier. Because the loss of the signal reference ground could lead to the failure of signals in the entire related system. 　　 ⑻ Other equipment: includes auxiliary control panels, ESD, etc. 　　3. Ensuring safety: Safety considerations during routine maintenance and repairs: This primarily includes routine maintenance checks, the provision of spare parts, and prompt handling of failures that occur: ⑴ Routine maintenance: To ensure the proper operation of the DCS, it is essential that the system operates in an appropriate environment, which is reflected in the temperature range within the machine room and the level of air cleanliness. The optimal operating temperature of the DCS system should be maintained within the range of 23±2°C. Clean air helps prevent poor ventilation, which could lead to excessively high surface temperatures in cooling devices such as high-capacity power supplies and CPU cards, thereby causing the system to shut down or experience failures. To this end, routine inspections should focus on checking the operating condition of air conditioning equipment, power supply equipment, and fans (including those inside the power supplies), as well as cleaning the filter devices on a regular basis. By checking visually (to see if the status indicators are normal), listening (to hear if there are any abnormal sounds from the power supply and fans), and touching (to feel the surface of the power supply to check for abnormal temperatures), potential faults in the equipment can be detected in advance, allowing timely action to be taken to prevent accidents. 　　 ⑵ System configuration modification: Try to avoid making changes to the configuration while the system is running. Due to certain reasons that require system configuration changes and updates, it is necessary to create a system backup promptly. This is done to avoid the situation where, in the event of a hard drive failure and loss of data recovery, there is a mismatch between the controller’s real-time database and the backup database on the engineer station, which could lead to serious issues preventing any modifications to the database. In such cases, the only solution is to perform the download offline. 　　 ⑶ Stocking of spare parts: Based on the maintenance experience with similar DCS systems and standard practices, appropriate types and quantities of spare parts should be ordered at the time of system procurement. However, in practice, the uncertainty in the types of system failures that occur may lead to imbalances in spare parts inventory. Therefore, it is essential to replenish the inventory of spare parts at any time during the DCS system maintenance process, based on the actual consumption of such parts. Generally speaking, for various types of power supply equipment, dedicated fans and backup batteries, controller CPU cards, I/O LINK cards, peripheral cards, I/O cards especially control cards, operator station CPU cards, dedicated monitors, etc., at least one spare part must be ensured. Special attention should be paid to the hard drives of dedicated systems; it is necessary to ensure that there is a backup of the drive used for system startup, in order to prevent the entire system from coming to a halt due to damage to the startup drive that makes technical recovery impossible. 　　 ⑷ Timely handling of faults: This involves the frequency and timing of routine inspections. Since most current requirements call for inspections to be carried out once per regular working day, this results in a maintenance window of 24 or 48 hours during legal holidays when no inspections can be performed. Therefore, the safe monitoring of the dead time system must be carried out with the assistance of operators. The main equipment and cards in an elephant system can be monitored through the system’s alarm status. The operating condition of air conditioning units can be monitored indirectly by operators using thermometers ； Monitoring of power supplies and fan devices will not be possible; therefore, maintenance personnel can attempt to integrate certain devices equipped with external contact point alarms into the DCS system via digital I/O, creating separate monitoring screens for operators to monitor. 　　 Once maintenance personnel detect a system failure or receive information about it, they should address it promptly. For handling faults that may affect the security of the entire system, two or more people should consult together to avoid human errors. At the same time, the use of devices such as anti-static bracelets is necessary to prevent damage to integrated circuit devices. 　　 It can be said that as long as attention is paid to and the security issues of DCS systems are properly addressed in these three aspects, thereby avoiding human-induced risks to the equipment, coupled with the high reliability of the DCS systems themselves, their security will be more reliably ensured, and the prospects for the application and development of DCS systems will be very promising.