Thank You Sponsors!
















How to Integrate Industrial and Information Networks

The post How to Integrate Industrial and Information Networks first appeared on the ISA Interchange blog site.

This excerpt from InTech magazine was written by Dan McGrath, P.E., solutions manager for Panduit

The benefits of converging industrial and information networks with a validated secure architecture based on standard Internet Protocol (IP) technologies are well established. The benefits include greater connectivity and integration across plants, easier data sharing across the enterprise, and better visibility into real-time operations.

Gateway physical segmentation example: two NICs for network segmentation.

Gateway physical segmentation example: two NICs for network segmentation.

Bringing together information technology (IT) and operations technology (OT) networks is complex because of the gray area between IT and OT roles and responsibilities within the company. IT and OT professionals must have a common understanding of a host of techniques and technologies to overcome this complexity and establish a converged infrastructure that is secure and manageable by all critical stakeholders.

The techniques and technologies used in network design can be simplified by leveraging the ISA/IEC-62443 Zones and Conduits Model developed by the ISA99 committee. The three design areas are:

  • cell or area zone
  • production site operations
  • enterprise zone integration

Designing for the cell or area zone

Several considerations must be made to ensure the network infrastructure addresses your data, security, and availability requirements at the cell or area network level. Machines and process skids are seeing high growth in number and criticality of IP connections. One of those considerations should be logical segmentation, which is the process of dividing end points into subnets and virtual local area networks (VLANs). A key recommendation for industrial networks is to create smaller layer 2 networks to improve performance with the maximum of 200 devices within a zone or VLAN.

Segmentation allows for smaller layer 2 domains, which helps constrain broadcast and multicast traffic. It also helps manage the network’s real-time communication properties and supports the network’s traffic-flow requirements. With segmentation, manufacturers and industrial operators can meet their security requirements by limiting remote expert or original equipment manufacturer network access to only specified machines.

Organizations often accomplish physical segmentation within the cell/area zone network by using separate cabling and switches. This common approach in Ethernet networks can become a hindrance to network performance if not properly planned. For example, physically separating input/output (I/O) and human-machine interface traffic without connecting the I/O traffic to an interconnected layer 3 switch can limit overall connectivity and even cause delays. Networks should, at a minimum, be connected to a layer 2 or layer 3 switch, rather than a controller, to interconnect.

VLAN spanning multiple switches

VLAN spanning multiple switches

VLANs are a very effective way to execute segmentation: specifically, for segmenting different traffic types—industrial and nonindustrial—as well as creating smaller layer 2 networks. Establish VLANs in a one-to-one relationship with subnets to make routing easier and more straightforward. Devices on a single VLAN are typically assigned IP addresses from the same subnet, and they do not require a layer 3 switch or router to communicate among each other within the VLAN. Using a layer 3 switch or managed switches with layer 2/3 functionality allows communication between VLANs. A management VLAN should be established for management across multiple cell/area zones.

Additionally, using structured cabling for interswitch links and more critical runs in your cell/area zone is a best practice network design approach. Point-to-point cabling is the norm for connecting end-point devices in close proximity. However, more critical connections can benefit from using industry standards designed to ensure a testable, scalable infrastructure. A structured cabling approach has better organization and testability with patching fields, permanent links, and patch cords that are validated as a high-performance system for rising data rates and high availability. Structured cabling built on TIA-1005 or ENXXX standards have the bandwidth and noise immunity for challenging cell or area zone deployments to ensure uptime.

Designing for production site operations

The Internet of Things (IoT) has created an explosion of smart IP–enabled devices that were not traditionally connected to the network. This has created an opportunity to deploy a more flexible architecture with mobile access to data and connectivity within the production environment. Wireless network technology is one of the key enablers for realizing the value of IoT. Wireless technology offers new capabilities, such as “bring your own device” and wireless security cameras, to protect assets and lower installation and operational costs.

Wireless local area networks are significantly different from wired LANs, and they should be designed for your security, reliability, bandwidth, and throughput requirements. For example, Wi-Fi Protected Access 2 with Advanced Encryption Standard encryption is the only mechanism recommended for control and automation wireless applications, and it should be used in combination with other security methods, such as preshared key authentication.

Wireless channel packet rates should be limited to 2,200 packets per second to help avoid packet delays, and they should be reduced in areas that experience interference and radio-frequency issues. Also, avoid the more heavily used 2.4-GHz band for industrial control applications because you may encounter interference. The 5-GHz band provides dedicated bandwidth and less interference. Conducting a site survey will also help you identify and curtail other potential interference within a production environment.

virtual environment design

Virtualization is another key network technology in the connected industrial enterprise. Virtualization breaks the previously unbreakable link between hardware and software, so you can keep industrial applications running beyond the life cycle of their hardware. Virtualization also abandons the traditional one-to-one approach, meaning multiple applications and operating systems can run from a single server.

Click here to continue reading Dan McGrath’s article at InTech magazine.

About the Author
Dan McGrath, P.E., solutions manager for Panduit, helps lead Industrial IP Advantage, which is a coalition launched by Panduit, Cisco, and Rockwell Automation promoting standard, unmodified Ethernet and Internet protocols for industrial applications. McGrath has more than 25 years of experience in automation and industrial networking for global manufacturing operations. He holds a B.S. degree in electrical engineering and has attained professional engineer and ASQ certified quality engineer certifications.

Connect with Dan:


Source: ISA News