The post How to Integrate Industrial and Information Networks first appeared on the ISA Interchange blog site.
The benefits of converging industrial and information networks with a validated secure architecture based on standard Internet Protocol (IP) technologies are well established. The benefits include greater connectivity and integration across plants, easier data sharing across the enterprise, and better visibility into real-time operations.
Bringing together information technology (IT) and operations technology (OT) networks is complex because of the gray area between IT and OT roles and responsibilities within the company. IT and OT professionals must have a common understanding of a host of techniques and technologies to overcome this complexity and establish a converged infrastructure that is secure and manageable by all critical stakeholders.
The techniques and technologies used in network design can be simplified by leveraging the ISA/IEC-62443 Zones and Conduits Model developed by the ISA99 committee. The three design areas are:
Several considerations must be made to ensure the network infrastructure addresses your data, security, and availability requirements at the cell or area network level. Machines and process skids are seeing high growth in number and criticality of IP connections. One of those considerations should be logical segmentation, which is the process of dividing end points into subnets and virtual local area networks (VLANs). A key recommendation for industrial networks is to create smaller layer 2 networks to improve performance with the maximum of 200 devices within a zone or VLAN.
Segmentation allows for smaller layer 2 domains, which helps constrain broadcast and multicast traffic. It also helps manage the network’s real-time communication properties and supports the network’s traffic-flow requirements. With segmentation, manufacturers and industrial operators can meet their security requirements by limiting remote expert or original equipment manufacturer network access to only specified machines.
Organizations often accomplish physical segmentation within the cell/area zone network by using separate cabling and switches. This common approach in Ethernet networks can become a hindrance to network performance if not properly planned. For example, physically separating input/output (I/O) and human-machine interface traffic without connecting the I/O traffic to an interconnected layer 3 switch can limit overall connectivity and even cause delays. Networks should, at a minimum, be connected to a layer 2 or layer 3 switch, rather than a controller, to interconnect.
VLANs are a very effective way to execute segmentation: specifically, for segmenting different traffic types—industrial and nonindustrial—as well as creating smaller layer 2 networks. Establish VLANs in a one-to-one relationship with subnets to make routing easier and more straightforward. Devices on a single VLAN are typically assigned IP addresses from the same subnet, and they do not require a layer 3 switch or router to communicate among each other within the VLAN. Using a layer 3 switch or managed switches with layer 2/3 functionality allows communication between VLANs. A management VLAN should be established for management across multiple cell/area zones.
Additionally, using structured cabling for interswitch links and more critical runs in your cell/area zone is a best practice network design approach. Point-to-point cabling is the norm for connecting end-point devices in close proximity. However, more critical connections can benefit from using industry standards designed to ensure a testable, scalable infrastructure. A structured cabling approach has better organization and testability with patching fields, permanent links, and patch cords that are validated as a high-performance system for rising data rates and high availability. Structured cabling built on TIA-1005 or ENXXX standards have the bandwidth and noise immunity for challenging cell or area zone deployments to ensure uptime.
The Internet of Things (IoT) has created an explosion of smart IP–enabled devices that were not traditionally connected to the network. This has created an opportunity to deploy a more flexible architecture with mobile access to data and connectivity within the production environment. Wireless network technology is one of the key enablers for realizing the value of IoT. Wireless technology offers new capabilities, such as “bring your own device” and wireless security cameras, to protect assets and lower installation and operational costs.
Wireless local area networks are significantly different from wired LANs, and they should be designed for your security, reliability, bandwidth, and throughput requirements. For example, Wi-Fi Protected Access 2 with Advanced Encryption Standard encryption is the only mechanism recommended for control and automation wireless applications, and it should be used in combination with other security methods, such as preshared key authentication.
Wireless channel packet rates should be limited to 2,200 packets per second to help avoid packet delays, and they should be reduced in areas that experience interference and radio-frequency issues. Also, avoid the more heavily used 2.4-GHz band for industrial control applications because you may encounter interference. The 5-GHz band provides dedicated bandwidth and less interference. Conducting a site survey will also help you identify and curtail other potential interference within a production environment.
Virtualization is another key network technology in the connected industrial enterprise. Virtualization breaks the previously unbreakable link between hardware and software, so you can keep industrial applications running beyond the life cycle of their hardware. Virtualization also abandons the traditional one-to-one approach, meaning multiple applications and operating systems can run from a single server.
Source: ISA News