Hi, I'm Steve Wenner, a network architect with the networks and security business unit
at Rockwell Automation. And I'm Akshath Srinivasan, a product
owner for Emerging Network Technologies. Today we'll be talking about the
fundamentals of EtherNet/IP networking in an industrial system.
We're going to first talk through
standard industrial Network Technology and some IIoT Technologies. We're going to
introduce the OSI 7 layer reference model.
We're going to talk about how CIP and EtherNet/IP apply on top of that OSI
model and then we'll talk through some industrial
IoT architectures and some key takeaways.
So first standard industrial network technology.
In the past, we've had all these different functions
working separately. Now we're looking to converge all these
and align them, so that we won't have disparate network
technologies, but instead a single industrial
network. Here is an example
of everything working in alignment.
So first you can see here. We have discrete
control.
process control
intelligent motor control here
as well as Information Technology up here
and they all work together in the same
network. So ethernet/ip and Industrial
protocol. The IP in ethernet/ip means industrial protocol not Internet Protocol. If
we look through and understand what that is. We have an organization called ODVA who
manages our standards, and they are an open organization with many principal members
including Cisco and Rockwell Automation and a few others. A big Focus for
interoperability through them as conformance and performance testing to make sure that
things will work together as a system when you put them together. So it's interesting
and important to focus on the difference between ethernet and IPs, and those two
different specifications and ethernet/ip being the protocol that enables set across
ethernet and IP.
We're built on standards. So we run with IEEE standards 802.3 to run standard
ethernet. We run 1588 for standard time.
We follow IETF standards with IP
and all of that is the basis for CIP and ODVA. Everything is
built on top of these standards. It's IT friendly and future ready because
that's what IT technology runs on as well and you're able to have multi-discipline
control and it's very established with many
products, many applications, and many different vendors.
Moving into the OSI 7 layer reference model.
We've got a bunch of different layers that are able to
abstract out different functions. These individual functions are transparent to
the function above it. And so they're built on standard. So we have
a physical layer initially that talks about how devices are connected
and it runs on standards on TIA standards. On top of that,
we've got our Network and data link layers running on IETF standards and
802.3 standards. As the very top is where we have CIP
right here. Then this is their application layer. So that
includes application presentation and session layers
and those are tied together with our transport layer and that's handled by TCP
and UDP again standards. On top of
CIP at the application Level. You can see that there's a bunch of different protocols
here. We've got CIP OPCUA modbus HART
HTTP. All of these Protocols can co-exist together because
they're built on top of the standards that
are beneath them to prop them up. But that doesn't mean they can talk to each other. So
Cohen's coexistence does not mean interoperability. So here you can see how
different layers breakdown and an example is if
Studio 5000 on a workstation is to interact with a
controllogix controller. So here
the process by which the data is transmitted through the layers is called,
Well, there's two processes and it's done by encapsulation and
decapsulation. So here
I'm going to explain how
encapsulation is done. So at each layer you have a header which is
added to the payload. It starts off with CIP
as part of the application layer with an encapsulation on top of it.
Then after that a TCP header is added on
and it becomes a segment. This is the data unit for the transport layer.
And this is followed by conversion to a packet which
includes the addition of an IP header.
Then in this in layer 2, we have an Ethernet header,
which allows a
data frame to be transmitted through Ethernet.
And of course, we have the physical layer which includes wires and electrical
signals. One of the nice things about that physical layer is that it is independent
because they're stacked on top of each other and they are transparent to the layer above
them. So that can be copper or fiber or for that matter. We can have the IP layer is
running across an independent data link layer if we'd like to transition to
something like Wi-Fi for example or 5G. And so the standard IP provides portability
and seamless routing across independent data link layers.
Now one thing to focus on is when we have
vendor-specific layers in here. You need to understand what
that means. Right if we have vendor specific in layer
four and in layer three items in the transport Network, that's going to limit
portability and
routability. You're going to need specific hardware that can support it, and
it's not built on open standards at that point
if we include that vendor specific area into the data link layer,
you're going to need nonstandard ethernet devices and and you're not going to be
following standards. So it won't be portable. That won't be giving you the interoperability
that standards and ethernet/ip will give you.
Now when it comes to
the different layers, we have different models that we use. So
some terms can get confusing for example in the OSI 7 layer
model. We have connections, layers, and routing
but these are also
terms that are used in the Purdue model. So in
terms of network terminology a connection refers to
for example, a TCP connection between two devices
with a handshake. And then
layers versus levels. So we have
seven layers here
as I mentioned before have
different payloads, and
after each level the payload is encapsulated into a different
data unit and so on then in terms of routing that's a layer 3
function
which allows packets to be delivered
between sub-networks. So that's a great explanation of how these
terms relate to networking. If I were a controls engineer, I would think
the connections are my owner connection from my controller to my I/O
or my levels are going to be the Purdue model level. So maybe level two being my controller
layer level.
Or routing. I'm thinking about CIP routing, and that's the ability to
send traffic through a backplane only CIP and come out in a different standard
whether it's
Ethernet or just come out as controlnet or devicenet
so the overloading of these terms means that when we
talk to people we need to understand what they think it is and be very clear with
our communications.
So here we have security that we can use at different levels
of the OSI model. Coming from the bottom up, on
the physical layer, we have
blackouts lock-ins.
Which is physical security, and then in the data link layer to we have
things like Port Security and MACsec.
Followed by layer 3. We have ipsec and ACLS. So
it also includes vpns
in layer four we have TLS (transport layer security) and dtls
datagram transport layer security.
And another example of this is banking,
online banking. Now for the application layer and
presentation session layers,
this is when CIP security comes in
in the presentation session layers, and on top of that we have
factorytalk policy manager for the application layer.
You know coming into the CIP application layer. We're going to talk a little bit about
what CIP does to give the application that
additional Edge or that model to allow for that consistent communication.
So here you have two different plants, for example, where
all devices have their own data models, and
this means that devices cannot communicate with each other.
So we need to incorporate translation layer
in between. But with
CIP here we have the ability to have a uniform
data model between the devices and there's no need for
separate translation layer.
So the first application built into ethernet/ip is CIP safety that we're going to
talk about today. And this is the ability to have functional safety across ethernet
that gives you the same level of security as an SL3 system needs.
It provides failsafe Communications between nodes. It sends traffic
multiple times. So that way it can validate that the safety data is accurate.
It has additional CRCs added to give you the
ability to make sure that the the packets haven't changed in line
and there's packet or there's timestamps on all your packets to ensure that the
traffic gets there in a timely manner. The focus of CIP safety is to be able to
say that my device will fail safe and we put it in a
safe State when we have an error or a fault.
There are profiles being built in CIP safety to be able to share that data.
It has an object library
and standard services and messages associated with it, so that devices can communicate
together seamlessly on that same data model.
CIP Sync is another feature which
allows CIP to enable time-sensitive applications.
And this is done by using PTP or
Precision Time protocol. The thing about PTP is it's very precise
down to the microsecond or nanosecond level even.
Different applications that this could be used in
are for example time, input time stamping, scheduled outputs,
and coordinated motion.
Integrated motion or coordinated motion on ethernet/ip takes a unique approach.
Traditionally, you would be focused on network scheduling and having a time slot for
your data to arrive. Because of CIP sink and the ability to have that tight time
synchronization across CIP, we're able to not use a traditional approach and any great
motion with ethernet/ip again using standard unmodified ethernet. We have predetermined
execution plans that are sent to the devices in a timely manner basically
telling the device go to this position at this time.
We do that through the use of CIP sync and PTP
and data prioritization with QOS in our network devices.
We've got common interfaces and profiles built again
for integrated motion as well to allow devices to communicate properly
together
without interoperability issues.
CIP security is a feature that acts in the application layer, and it defines
secure communications for ethernet devices.
This is added on top of the
TLS (transport layer security) encryption in layer 4,
which is an optional feature. And this
supports NIST standards
of zero trust. Overall, CIP security is a part
of holistic defense-in-depth philosophy
which
allows for security at different layers of the OSI model.
Here we can see
that CIP security acts between different
devices, controllers, and endpoints
as well as between workstations, controllers, or different
endpoints.
On the left, you can see the CPwE architecture,
and if you want to read more about security you can
go here. Alright moving into industrial iot
architectures, how do we enable this? How do we get this one network that runs all of
these different applications to actually work and we're going to be able to use
to manage infrastructure to enable that.
So Steve if I wanted to
run a plant and I have
high traffic, I have a lot of devices
to communicate between, and I also need gig ports for fast communication.
What kind of switches would I need? Well, I would recommend the full and high
performance managed switches. At the full performance level you're going to
get gig ports. You are going to get the connectivity
that enables this with a lot of end devices and a lot of data.
You're only going to get layer to connectivity. So if you need to route between
subnets, you're going to need to move up to the
high performance line in the 5800s.
So that's that's what I would recommend for that situation.
Okay, so I could you also use that as
a layer between OT and IT?
You absolutely could. Yep. Anything that's routing between networks.
The layer 3 switches will be able to do that.
Okay, what if I needed a low-cost option
for maybe a machine
where not too much traffic is flowing through the switch? Well,
we have our lightly managed switches that are low cost. They are
just as a few ports because we don't want to
connect a bunch of things to them. They do have QOS, so that helps with some
prioritization for your data. But other than that, they're not super
configurable. They're basic switches to get you into the managed switch
area and show you the visibility in your network to understand when things are
potentially going wrong. So how would I put all of this together?
So you see on here, we talk about connectivity and adapter. So we're going to
need some adapters. We're going to need some connectivity enablers. So if we have
different technologies, like field bus or devicenet, you know, we can we can pull that
into our network with these connectivity enablers. We have remote access. So if
I need to connect over Wi-Fi or cellular we can do that as well. And then we're going to
put it all in the topology similar to this and this is how you put it all together.
So moving from this into key takeaways. Okay. Okay. So that was a lot right there.
Could you delve into the details?
Might need some help. Sure. So
inside of that picture. There's really three basic topology is that you're looking at.
You've got a star topology, a linear topology, and a ring topology.
Okay. So how do I know which one to use? Well, so
I think the default would be a star. So if you don't have any reason to do anything
else, I would pick a star topology. It's got the highest throughput and it's
fairly simple to build.
When you're looking for some type of resiliency-
-so if you have a cable that breaks, how do you still remain
connected to that device?-If you want resiliency look at a ring,
then we've got DLR that supports that. A linear topology? I
It wouldn't recommend as much that is really
a ring that is not connected at the end. And so
that limits your ability to have that resiliency
and you have the weakness of having devices Daisy chained off each other.
So that's when I would focus on star or ring,
and honestly why I wouldn't use linear. Now you can put them all together. You don't
have to pick one or the other for your plant. You can put them all together in your system
and pick the topology that makes the most sense for that area of that plant.
How would it look like if I had multiple
sites or different areas, for example? So if we cut our plant up, we really
should logically segments are plant in to cell areas and zones,
and that limits disruption and allows you to limit the amount of change in the amount of
troubleshooting that needs to be done, and it also gives you logical points to limit access
if you need for security reasons. So we break that up into a cell area zone, as you can see
here with the different boxes. If we go forward, we can see
that we show this as part of a larger drawing, and
this is the part at the bottom. These are your cell area zones. And if you
want to have more of them, you can expand that out too many,
many different cell areas and zones, and this is what it would look like when you
connect it to an Enterprise production system.
So in this diagram, where would my factorytalk
software run?
Well, the factorytalk software is going to run up in your level 3
site ops. So this goes back to our levels versus layers.
We're talking Purdue model now, so we're back up at level 3 site ops.
That's where your engineering teams are going to sit
and where all of your industrial applications would live.
Okay. How would I get that data to the Enterprise
and into ERP system?
So the Enterprise and your Erp system is really
going to sit up in the corporate Network in your
your it side of things. And so that's really listed up here at the
Enterprise Zone. Now those are connected
through an industrial DMZ. And that is this red section in the middle.
What that does is, that allows you to have that connectivity to IT
while minimizing the risk of being connected to IT.
It also gives you a point where you can control the
flow in and out of data and also the ability to
disconnect it to completely isolate your OT networks if there's an incident.
So some key takeaways for today. We've got single industrial Network
Technology, right? We're trying to get a convergence of these Technologies onto a
single Network. We're using that as an ability to create data models for the
different applications and for different devices. So you've got no data mapping and it
simplifies your design. ODVA and ethernet/ip is established. It's
used and built by many, many different vendors
and we have Cisco, Endress+Hauser, and Rockwell Automation as principal members.
There's risk
reduction there because of conformance testing and defined QOS priorities to make
sure that it's going to work on your standard and modified ethernet and it's built on
standards. That's how all of your it technology runs, and we're just utilizing
those standards and building OT applications on top of it and it's future
ready because it's built on those standards. As we expand Technologies in it
to take over different ways of connecting whether it's through advanced ethernet
physical layer or single pair Ethernet or even Wi-Fi, we're able to adopt those
standards because we're built on the standards for today. So thank you for joining
us through the fundamentals of ethernet/ip. If you have any feedback, we would appreciate
you providing that through the EventROK app, and if you have questions,
Please send them through the app as well. Thank you very much.
Thank you.