MSimon wrote:ladajo wrote:I would agree. I would setup an isolated netwrork to link the PLCs together, and do it that way.
Of course, you run a risk if you look to upgrade the programming software, or the PLC operating system.
But, if you build what you need, and get the job done, you could resist the "desire" to get more guchi with upgrades.
The problem is always management.
"I heard that you could _____ with a simple upgrade. What will it cost? How long will it take."
BTW machines with Wireless connections always scared me. I would say: "What if......" and management would tell me "encrypted". "And besides wires are expensive and take longer to develop". So I would say: what will one plant shut down cost? And management would tell me. "Not going to happen."
And then one time in aircraft development. I said - "Why are you using IP? It is well known and thus easily hackable. Why not roll your own? (I was a serial bus hardware and protocol expert)."
And they told me - "IP developers are cheap because it is well known. And besides no one is going to hack it."
This is where professional discipline comes in. The only thing you need to upgrade on a dedicated laptop is the PLC development software, which is usually updated at most 1-2 times per year. These updates usually come on CD's as well (which you can request from the PLC makers like Siemens).
My point is that stuxnet propagates itself either through careless practices (like not using a dedicated laptop for the PLC program development) or malicious intent (which is possible in the case of the Natanz facility as there were no doubt Russian engineers involved in this). Neither Russians nor Iranians are known for their fastidiousness in these matters, unlike, say, the Japanese.
BTW, I did all of my control system work in Japan and Taiwan, using Japanese PLCs (Mitsubishi, Omron, Yokogawa, and Izumi Idec). There are five major manufacturers of PLCs in Japan.
The "specialized assembly language" used to program PLCs is ladder logic. Ladder logic has been incorporated into more sophisticated programming environments called the 61131 tools that make use of function blocks (e.g. PID loops), flow charts made of the same, and structured text (which is similar to ladder logic).
I find ladder logic easy to understand and to program (its almost graphical to me) whereas I don't understand and absolutely hate "C" language programming. Most software people tell me they are just the opposite to me.
One more point, the SCADA or user panel interface. These are also created by a development tool similar to that used to program the PLCs. These environments are also updated by their respective manufacturers maybe once or twice per year and the updates made available on CDs.
You want the upgrades on CD's anyways because that way you have a back up in case your computer crashes or gets damaged by some other means.
You want to use a dedicated PC for the SCADA system as well. Some factory managers like to connect the SCADA PCs into the company LAN which, in turn, is connected to the outside internet through various firewalls. I usually try to convince them not to do this.
Safe computing practices.