The Question of Ethernet

Ian Verhappen and Andreas Agostin provide answers to some common questions surrounding the adoption of industrial Ethernet.

In its simplest terms, industrial Ethernet is nothing more than the same Ethernet being used in an office environment or your home other than it has been designed for high reliability in the harsh environment found in a typicalfield installation.

As far as the bits and bytes of information are concerned they will be just as happy on the low cost router or switch purchased at your local computer store as on an industrial unit from a reliable supplier of equipment designed for your environment.

This of course begs the question: What are some of the differences between an “office” switch and an “industrial” switch? The following summarises just a few of the key items manufacturers of industrial equipment take into consideration:

Temperature – Depending on the installation, this can range from -50 deg C to +70 deg C. The cold temperatures are for “cold start” conditions in winter, while the high temperatures would be for an enclosure in the desert sun with the added stress of the heat generated by the equipment itself.

Humidity – Industrial specifications normally require that the instruments be able to operate in 90+ percent humidity, non-condensing, meaning that as long as there is not water present to cause a physicalshort, the equipment should keep running.

EMI/RFI – Electromagnetic interference/Radio frequency interference refers to the extra shielding of the electronics to protect them from outside “signals” that are present in the industrial environment caused by other equipment such as variable frequency drives, high voltage lines, etc.

Installation/Mounting – Industrial equipment needs to be mounted in everything from cabinet racks to DIN rails in metal to fibreglass enclosures in the field.

Redundancy – This is the most common method used to provide high levels of reliability in control systems, and in the case of industrial Ethernet components, they typically will support redundant media (i.e. more than one port or route from the component to the balance of the network) and power (more than one source for each component – so that if one fails the other immediately takes the full load).

Area Classification – Ethernet components need to be installed in all areas, from General Purpose through to Zone 1 and, arguably, in the future, Zone 0, though with the changes in environmental regulations the number of Zone 0 installations will continue to decline. It is however “common” to be able to purchase Ethernet equipment for Zone 2.

Fault Notification – Because of the criticality of the Ethernet infrastructure to transmission of messages between different parts of a control system and the fact that the components are often redundant, it is possible for a single component to fail without causing the system to fail. So some form of communicating failure(s) is required and this is often done via a separate system with as simple achoice as dry contacts.

As an “end user” it is up to you to determine to what degree each of these forms of protection are required for your project. For example, you may not need the highest temperature specification but are susceptible to high EMF/RFI or humidity, so it remains your jobto select the appropriate device for your project.

There are at least as many forms of “industrial Ethernet” as there are fieldbus systems. This is because most of the fieldbus systems operate atthe User Layer, which, if we referred to the OSI model (see Figure 1)would be layer 8. As youcan see on the PhysicalLayer (Layer 1), Ethernetand Serial interface areboth recognized as validtransmission media.

For example, Profibus Trade Organization actually has three different versions of Profinet to serve the needs of the different markets in which Profibus is used, including a special version for thevery high speeds required for three-axis motion control.

Where to use it
As it stands today, wired (and fiber) Ethernet are not very common at the field level of the enterprise (in ISA-95 terms, Level 0 of the 4-layer model), though it is prevalent at Level 1 for communications between controllers and other data gathering/multiplexing systems such as PLCs, Remote I/O, Multiplexers (MUXs), and other high bandwidth devices. There are a number of field devices starting to come to market that incorporate Ethernet communications capability though they are typically data-intensive operations aswell.

However, if we consider changing the Ethernet media from physical (copper and fiber) to wireless a whole new range of opportunities present themselves including of course all the options under consideration from the sensor mesh networks such as WirelessHART, OneWireless, ISA-100, ZigBee, etc, through to complete SCADA systems using licensed radio.

In general, the longer the wavelength and lower the frequency the further the signal can be transmitted without having to be amplified or repeated (single hop). Because mesh networks operate at such low power and typically at the 2.4 GHz spectrum (in part because it is one of the few unlicensed frequency allocations around the globe) they have relatively small distances between nodes and the nodes frequently are also used as repeaters to pass the signal along to the next device in the network. Deeper coverage of this topic is beyond the scope of this article but it certainly confirms that Ethernet trulyis showing up everywhere.

When to use it
Ethernet solves the bandwidth “problem” associated with most fieldbus solutions. In many cases, the bandwidth constraint of a fieldbus system is not truly a constraint when you consider that these systems are targeted to transmit data in a very harsh environment over relatively long distances and so to operate at slower speeds to insure that the signal is not degraded in the process.

Couple this with the fact that because of the process cycle time, most field devices do not have to update more rapidly than the kilobyte speed of their associated bus and in many cases the fieldbus remains the better solution.

As can be seen from the comparisons in Table 1, industrial Ethernet still has some limitations. However, new developments in the area of standards, including security, reconciliation across the various industrial Ethernet consortiums, and removal of limitations regarding installations in classified areas, have lowered the industrialEthernet adoption barriers.

Why it’s important
Recent studies by ARC Advisory Group, VDC Research Group, and others, indicate that the industrial Ethernet market will grow at a compound annual rate (CAGR) in the range of 30 percent over the next three years.

Despite its limitations (Table 1), Ethernet is becoming more important in the digital plant of the future if for no other reason than like our desktop environment in which the microprocessors continue to get smaller, faster and consume less power, the same ishappening to increasingly smart field devices.

All this information needs bandwidth to be able to get from the field to the balance of the control system, which includes not only the DCS or control portion but the asset management system and the safety system as well. Ethernet is certainly being used for communications between each of these systems and the business enterprise as it becomes the “common denominator” for all forms of digital communications.

However, because Ethernet is now the common denominator, it also has many of the same vulnerabilities as the office environment and is therefore susceptible to such things as data storms, viruses, and other forms of intentional and unintentional consequences.

Compounding the problem is the fact that most control systems are not inherently protected from these forms of failures. Work done by CERN when selecting the PLCs to be used on the supercollider found that at least 25 percent of PLCs could be compromised with the most commonly used security test tools on the internet.

Fortunately, manufacturers are aware of many of the limitations described above and are developing solutions to at least minimisethe impact they have on a control system.

What’s new
Security is becoming a significant issue in part because the systems used in the office environment and plant environment are becoming more similar, with Ethernet, Microsoft, and Windows software ever more common. Not only is security being regulated by industrial groups such as NERC (North American Electrical Reliability Corporation) but standards are being written by Standards writing bodies like ISA’s ISA-99 committee. The regulations prepared by NERC are being considered for adoption in other parts of the world while the work bring done by ISA is being considered by the IEC.

Both groups are supportive of the “defence in depth” principle that basically implements several layers of protection between the potential methods of attack and the control system. Having multiple layers will not only provide more protection, but in the event that one of the layers is compromised, it will give you the opportunity to catch and stop the attack before it is able to get to the sensitive parts of the system.

A key component of “defence in depth” is the use of a DeMilitarized Zone (DMZ). The DMZ is installed and configured so there is no direct connection between the office/corporate LAN and the Process Control Network (PCN). All data requests from the LAN are through mirror historians in the DMZ and if the data is not on those servers they can request it from the Real Time systems on the PCN.

Figure 2 shows that the common misperception that the only connection, and hence potential path of attack, is between the LAN and PCN is certainly not true – since not only is it possible to inadvertently configure this single firewall in correctly, but there area large number of alternate ways into the PCN.

The PCN is like a house. It may give you a sense of security to lock your front door, but if you leave the back door and all your windows open the thief will simply take an alternate route in to your treasures.

Fortunately there are products and tools available to assist in managing such a network as shown in Figure 2. One tool that can help determine the level and type of protection required is the “Zone and Conduit” concept proposed in the ISA-99 standards.

This model is similar to what has been used for years in the safety system market: break the entire system into zones (this is something you are likely already doing by breaking your network into VPNs); for each zone, determine a target Security Level SLT (similar to SIL in safety); compare it against the calculated Security Level SLC; and if the two are not the same, then some additional form of security protection is required.

Similarly, if there is communication required between zones, suitable protection must be put in place to insure that the message is of the same security level as it crosses the boundary. The most commonly used tool to protect boundaries are properly configured firewalls.

A number of manufacturers offer firewall products suitable for use in industrial settings that are fully compliant with the relevant IEC standards and designed for deployment in the industrial environment.

This leaves one other significant roadblock to the adoption of “Ethernet everywhere” and that is the issue of power in the field, preferably via a single cable as has been done with “loop powered” field devices for many years. The solution in this case is Power Over Ethernet (PoE).

One of the enablers to the wider adoption of PoE is the IEEE 802.3af standard. While a number of manufacturers of industrial switches offer PoE-compliant units, what is lacking to date are actual PoE field devices yet as can be seen from Figure 3, a number of usefulproducts requiring less than 13 watts could certainly be designed, including wireless access points and security cameras.

The IEEE 802.3af standard is based on 30 V signal and, therefore, is not suitable for intrinsic safe (IS) applications, or at least not at levels that would be useful to power field devices. Fortunately, as shown in Figure 4, a range of products that have been used in the mining industry for many years have now been approved for use in the hydrocarbon industry. The system is somewhat like traditional IS installations with an Isolator at the boundary between the Safe and Hazardous areas and then an IS Power Supply is required to go to each of the devices mounted in the Classified Area.

As an alternative to running a separate DC power cable to each device, PoEx (Intrinsically Safe Power over Ethernet from MTL Instruments) can supply up to 500 mA (gas group A or 200 mA gas Group B) at 12 volts to each of the ports from the managed 5-port switch shown in the diagram into any area classification including Zone 0. Having an IS solution is often more economic than mounting similar equipment in either a purged or explosion proof enclosure.

Informed choices
Will Ethernet mean the end of other forms of industrial communications? Certainly not in the foreseeable future since not only is there a significant installed legacy infrastructure, but there is not always a need to have the power and bandwidth of Ethernet to control the process in a reliable safe manner.

Like any technology, engineers and plant operators must make an informed choice on not only which technology – Ethernet, fieldbus, wireless – to deploy but also which protocols and levels of security will be required for each of these options.

Despite the fact that the digital age communicates with all 1’s and 0’s, our choices are no longer as simple as Yes or No but will like the processes we control with analog readings, continue to cover the complete spectrum of options.

lan Verhappen (iverhappen@mtl-inst.com) is an ISA Fellow and Director Industrial Networks at MTL; Andreas Agostin (aagostin@mtlsing.com.sg) is the Industrial Networks Regional Sales Product Specialist at MTL and isbased in Singapore.

------------------------------------------------------------------------------

--------------------------------------------------------

The Path to Power

Alvis Chen discusses the evolution of Power over Ethernet technology and describes the benefitsof adopting PoE switches for industrial networking.

Power over Ethernet technology, which allows data and electric power to be simultaneously supplied to remote devices over an Ethernet network, is one of the hottest topics in Ethernet networking applications today. According to recent IDC forecasts, total market sales for PoE devices are set to reach US$1.14 billion in 2009, a 65 percent annual growth rate.

One application is security for industrial facilities, which has become more and more important in recent years. IP surveillance technology (e.g. video compression and streaming) and the performance of security devices (e.g. IP cameras, sensors, and card readers) have become more sophisticated and reliable, prompting rapid growth in the PoE device market.

In 1999, the IEEE started to standardize the number of proprietary implementations that were available at the time. The IEEE 802.3af standard, approved in 2003, establishedcommon specifications for implementing PoE networks.

How PoE works
PoE networking requires power sourcing equipment (PSE), such as a switch or hub, to provide power to various devices. The IEEE 802.3af standard designates 15.40 watts as the maximum continuous power output allowed per power sourcing device.

It also required powered devices (PD), which are powered by the sourcing equipment in a PoE network and may include IP cameras, IP phones, and wireless access points. The maximum power usage of powered devices (PD) is 12.95 watts according to the IEEE 802.3af standard.

Power over Ethernet can be installed using either a PoE midspan system or PoE switches. Figure 1 shows a PoE midspan system where an existing Ethernet switch is connected to an intermediary power source to inject power into the Ethernet cables that connect to various powered devices. In this setup, the PoE midspan hub serves as thepower sourcing equipment.

The benefit of using a midspan solution is the ability to quickly upgrade an existing Ethernet network for PoE applications. On the other hand, newer PoE switches offer a more integrated solution by incorporating the midspan hub’s PSE function.

Power over Ethernet uses standard Category 5 (CAT-5) Ethernet cablesas specified by the IEEE 802.3af standard . Although CAT- 5 cables are composed of four twisted pairs, only two of these pairs are used for 10BaseT and100BaseT data transmission.

There are two ways to use CAT-5 cables to simultaneouslytransmit data and power:

• Power through the spare pair
In Figure 2a, the twisted pair on pins 4 and 5 is connected to form the positive electric power supply, while the pair on pins 7 and 8 is connected to form the negative supply. Each pair can accommodate either polarity.

• Power through the signal pair
DC power can be applied to the center tap of the isolation transformer without upsetting the data transfer since CAT-5 pairs are transformer coupled at each end. As shown in Figure 2b, the twisted pair on pins 3 and 6 and the pair on pins 1 and 2 can be of either polarity.

The IEEE 802.af standard specifies that all power sourcing equipment (PSE) and powered devices (PD) must be compatible with both of these methods above. However, only one of the methods may be used at a time.

Since powered devices may require different power ranges, IEEE 802.3af has classified PDs according to their power consumption. By providing the power sourcing equipment with its power range, the PD allows the PSE to supply power with greater efficiency. Table 1 shows the different PD classes and the PSE power output for each corresponding PD power range.

More power – IEEE 802.3at
In September 2005, the IEEE 802.3at task force began work on a new standard known as PoE+, which would allow standard Ethernet CAT-5 cables to supply up to 24 watts of power by using both twisted pairs. More power enables Power over Ethernet applications to accommodate self-powered devices including thin clients, PTZ cameras, WiMAX transmitters, and videophones.

The objectives for the 802.3at standard include the following:

• Operability on Category 5 and higher infrastructure
• Adherence to relevant 802.3af power safety rules and limitations
• 802.3at PSE backwards compatible with 802.3af PSE
• Maximum power within practical limits provided to PDs (at least 24 watts)
• Indication that an 802.3at PSE is required when connecting an 802.3at PD to a legacy 802.3af PSE

Some manufactures also provide non-standard power sourcing equipment and proprietary powered devices. It should be noted that interoperability between different brands may not be possible since these solutions are nonstandard products.

In addition, PoE+ is likely to support two-pair power up to 30 watts and four-pair power for over 30 watts. Even if the risk of overheating in the products themselves is resolved, heat generation in the cabling’s core temperature may still be an issue.

Although these concerns are not a cause for great alarm, system integrators should be aware of these issues when planning PoE+ cabling infrastructure installation and using nonstandard PoE products.

Switching benefits
PoE switches offer a more integrated solution compared to a traditional midspan system. And there are a number ofbenefits that PoE switches offer industrial applications:

Cost Saving
Industrial PoE switches only require a single CAT-5 cable for the network connection. This feature significantly reduces the power line installation cost for electrical wiring, conduits, and outlets throughout the industrial environment. It also reduces future maintenance costs, saving a great deal of money especially when wiring PoE technology for large systems.

In addition, industrial PoE switches also provide maximum flexibility for device installation. For industrial network applications such as mining, offshore oil platforms, and seaport monitoring, it is difficult to provide extra power for outdoor devices. With industrial PoE switches, system integrators can install PoE switches almost anywhere without the need for DC/AC power inputs.

Reliability
Using just one CAT-5 cable instead of separate cables for data and power improves overall network reliability and deployment flexibility. Although Power over Ethernet technology provides improved flexibility, it comes with added concerns such as power consumption and heat dissipation in PSE and PDs.

This is because power sourcing equipment and powered devices in industrial mission-critical applications must be operable at all times without any interruption. Industrial-grade PoE solutions are usually higher quality than commercialgrade products and offer longer MTBF time, wider operating temperature, fan-less design, and reliable PoE management.

Safety
The 48 VDC power design makes industrial PoE switches compliant with Underwriters Laboratories (UL) Safety Extra- Low Voltage (SELV) classification to provide users with a safe working environment. As an additional safety precaution inthe Power over Ethernet network, users can set the power limitation for eachport on the industrialPoE switch.

Without this function, the PD would immediately request overload current from the PoE switch if its power supply circuit fails (e.g. the power circuit in a PoE camera shorts out due to excessive humidity), which will shut down the Ethernet switch and all related network communication.

As a result, power limit configuration can protect PoE switches from providing too much power, even when requested by the powered device. An industrial PoE switch will not only safeguard against excessive power output, but also send alarm messages to the network administrator.

Security
Industrial outdoor security and IP surveillance for mines, military bases, or power substations are the most common PoE applications. When an anomaly in the PoE network occurs, the control center must receive a warning message immediately. Some industrial PoE switches include an auto-warning function that can send warning messages to the control center via email or SNMP trap.

Advanced Management
For higher level security, industrial managed PoE switches provide network administrators with advanced monitoring and control capabilities. Users can remotely enable and disable the power output from the switch to powered devices.

Therefore, some industrial PoE switches provide a PoE failure recovery function. This function will check the status of the device continuously, and when there is no response, the PoE switch will reset the device by powering it on and off until it returns to the default working status.

The industrial PoE switch also provides an advanced scheduling function for the PoE network. Many PoE surveillance applications only need to be active during nights and weekends. Hence, users can set up the PoE switch’s schedule to enable or disable the PoE device at the appropriate time. By disabling PoE surveillance during the day, more network bandwidth can be used for data transmission. At night, the network bandwidth can be used exclusively for surveillance-related PoE data communication.

Alvis Chen is Business Development Manager, Moxa IndustrialEthernet Infrastructure Business Divison.

--------------------------------------------------------

--------------------------------------------------------

Plugging into Protocols

Mark Hoske elucidates the often mystifying world of industrial Ethernet protocols.

The definition of Ethernet actually refers to the cabling system for transmitting data between connected devices. On the ISO stack Ethernet is only the bottom two layers (layer 1 and 2) in the protocol stack. Rather like the RS-485 standard used by most fieldbuses, the key is what happens on the layers above.

While a few industrial systems can pack data into standard Ethernet packets to take advantage of commercial Ethernet, most industrial solutions require custom software at the OSI Layer 3 (and higher layers) and Media Access Control (MAC) hardware modifications to support multiple fieldbus and industrial Ethernet standards and real-time performance requirements.

Therefore, all “industrial Ethernet” protocols are an enhancement of the IEEE 802.3 standard. Put another way, all industrial Ethernet solutions – Profinet, EtherNet/IP, EtherCAT, etc – are standards based, but none can lay claim to be the industrial Ethernet standard because there is no recognizedstandards group.

Three categories
Ethernet protocols can be divided into three categories: non-realtime; real-time protocols; and hard real-time.

• Non-real-time protocols provide open connectivity over standard Ethernet but have lower response times.
• Real-time protocols use device broadcast configurations to minimize cycle times or packet prioritization techniques such as IEEE 802.1D/Q for Quality of Service (QoS) to reduce switchinduced jitter. EtherNet/IP and Profinet RT are two examples.

• Hard real-time protocols use custom hardware on the devices and either require special Ethernet switches or eliminate Ethernet switches through daisy chaining of devices. Hard real-time protocols can perform high-level motion control. EtherCAT andProfinet IRT are two examples.

These developments represent a huge leap from just a few years ago, says Mike Hannah, product business manager, NetLinx, Rockwell Automation, when Ethernet’s collision detection and lack of determinism made it unsuitable for plant floor use.

“Technical advancements like higher-speed throughput, message prioritization, and industrial switching hubs have made Ethernet a viable network throughout the entire enterprise,” Hannah says.

Industrial networking applications require a high level of determinism to ensure that data is reliably transferred on a consistent, repeatable basis, says Chuck Lukasik, director, CCLink Partner Association.

“Without such deterministic data transfer, the processing or manufacture of quality products is not possible,” Lukasik says. “Control engineers and quality engineers rely on real-time, accurate data exchange within their control systems and between their control systems and plant information systems.

“Although there have been efforts to apply commercial unmodified Ethernet to the plant or factory floor, the inherent non-deterministic nature of commercial Ethernet and nonruggedized commercial media do not deliver the required level of high-speed reliable data exchange needed for today’s manufacturing systems.”

Unmodified Ethernet allows data collisions to occur, detects them, and provides for retransmission, so determinism cannot be guaranteed without the use of additional hardware (Ethernetswitches), which complicates network design, Lukasik says.

CC-Link IE: no switches
To ensure high-speed real-time data exchange, CC-Link IE, a Gigabit speed Ethernet, has been optimized to ensure deterministic data exchange without the need for Ethernet switches but still maintaining the Ethernet physical layer.

For continuous data exchange without interruption or data errors in the industrial environment, noise-immune fiber optic media should be used. CC-Link IE guarantees determinism by using a token-passing communication technique.

A typical network of 32 stations (industrial controllers, computers, HMIs, etc) can each transfer 4 kB of data for a total of 128 kB in only 60 microseconds. All network stations are connected by a fiber optic loop rather than a star configuration.Up to 120 stations can be connected on one network.

Profinet: performance layers
Just as there are environmental factors that influence the hardware selection for industrial Ethernet devices, various performance factors influence how Ethernet itself is used, acknowledges Carl Henning, deputy director, PTO, Profibus and Profinet North America.

Profi net uses four steps that build on each other: TCP/IP, real-time, bandwidth reservation, and scheduling. These steps collectively are all part of the current Profinet specification and not separate versions. They all work on the same network, representing increasing levels of performance.

Profinet uses TCP/IP for configuration and diagnostic information transfer. To avoid the delays and variations inherent in TCP/IP and UDP/IP, Profi net real-time skips these layers. Like all serial fieldbuses (including Profi bus and DeviceNet), Profi net RT uses layers 1, 2, and 7 of the ISO 7-layer stack, skipping layers 3 and 4. This Profinet technique allows submillisecond response times for I/O.

When sub-millisecond response times are not fast enough and no jitter is acceptable, such as for motion control, additional measures must be taken. Profinet uses bandwidth reservation andcan use scheduling.

EtherNet/IP: unmodified
ODVA’s approach to industrial Ethernet has been to rely on standard, unmodified Ethernet for its industrial Ethernet network solution, EtherNet/IP, says Katherine Voss, executive director of ODVA.

EtherNet/IP is the adaptation of the common industrial protocol (CIP) to standard the TCP/IP Suite in conjunction with the IEEE 802.3 standard and a standard Ethernet infrastructure, according to Voss. End-users or OEMs can also review ODVA test data to determine how rugged or commercial a product needs to be for the application, she adds.

“The flexibility of deploying standard Ethernet allows the end user to take advantage of the full range of capabilities possible with today’s Ethernet and Internet. If the application calls for web browsing, for example, it can be easily incorporated.

“By relying on standard Ethernet, the user can be assured that an investment is protected and well positioned by taking advantage of future advancements in commercial of - the - shelf technology , as well as in EtherNet/IP,” explains the ODVA chief.

No special hardware or software is required to build an EtherNet/IP device, allowing other protocols using standard, unmodified Ethernet to co-exist in the same device (such as Modbus TCP).

“Approaches incorporating proprietary and non-standard technology require extra hardware, software, or both for the device to function correctly and co-exist with standard Ethernet TCP/IP traffic. EtherNet/IP makes it possible to integrate control networks with the standard Ethernet networks used for quality, MES, or ERP systems in the plant, saving users money and allowing them to achieve the proven benefi ts of Ethernet andInternet technologies,” Voss says.

--------------------------------------------------------