PLC Training Org.

PLC Network to Smartphone HMI SCADA Cloud

PLC Network to HMI SCADA  

To the right is an infographic with the recommended learning path to get data from PLCs to Smartphones and other devices in-between. The fields of study required are...

  1. PLC Networking
  2. OPC UA
  3. SQL
  4. Client/Server Communications
  5. HTML5, CSS, JavaScript
  6. HMI SCADA
  7. Smartphone Programming

 

You will notice in the infographic Security training is emphasized, yet not in the list of fields to study. That is because each field of study will have its own specific network security curriculum to be mastered. You will also note that with each technology the data travels through, the security concerns increase and therefore require greater study and competence. Also, note before taking on training and a project of this nature, one should have at least 1 year of experience in the industry and a 2-year associates in this field as a minimum.

Below are a few more details on each field of study, including a summary of the technology and helpful tips in the learning path for PLC network communication to PC HMI/SCADA to the Smartphone or cloud. More accurately PLC to SQL to Smartphone. Start with PLC network and communication protocols and methods, then expand to HMI-SCADA, to SQL (and brand-specific topics like RSLinx OPC server), Excel OPC client, HTML5 and you’re ready for Smartphone applications.

PLC Networking Training:

It is obvious before learning a particular PLC network, one must first master the PLC (Programmable Logic Controller) as indicated by the PLC-Training.org 10 PLC learning phases. Also as indicated on this site the PLC should be mastered before going on to master the PAC (an Industrial Computer that emulates a PLC). Because, unlike networking computers together where only data and software is at jeopardy should mistakes be made or security breached, with PLCs or PACs, damage to man or machine are also at risk. When networking a PLC or a PAC, the difference between the two and the importance of distinguishing between the two becomes even more clear. You can learn more about the various CIP and RS485 PLC communication types in that section.

A PLC is a microprocessor device used to control equipment via electrician friendly Ladder Logic programming language. Often those not properly trained will also refer to an Industrial Computer (dual full processors) as a PLC, instead of its proper term PAC (Process Automation Controller). The term PAC was first defined by ARC Advisory Group in 2001. Although the PAC includes PLC like capabilities, its hardware architecture and software are designed to be more user-friendly to the IT/Computer Programmer. Differences include multitasking; multiple processor modules per rack, multiple programming languages like structured text, distributed control system (DCS), Tag-based addressing, motion control, standard PC networking like Ethernet.

OPC UA Training:

OPC standard is a software interface Open Platform Communication protocol standard that allows Windows programs to communicate with industrial hardware devices. Today's version, OPC UA (Unified Architecture) is a more secure cross-platform architecture not limited to Windows only. OPC UA (OLE for Process Control) is the latest, most powerful communications protocol for the industry. Using OPC UA, many data transfers can be quickly and effectively facilitated. (OLE is Object Linking and Embedding)

External and internal threats are concerns in critical control systems. OPC Security must be learned and applied to prevent accidental or intentional un-authorized OPC data access. OPC Security is a standard provided and maintained by the OPC Foundation.

The recommended minimum OPC UA training ...

 

SQL Training:

SQL (Structured Query Language) is a programming language used to manage data in a relational database on a server. Get data from a PLC into a SQL database may require even more advanced SQL training. A way to get process values from the production into your spreadsheet, ERP system or other PC software Intranet. (Also a way to expand your PLC memory and be a historian.) A more common approach when the device is a PLC is to use MS Visual Basics programming language or macros, OLE with MS Access or MS Excel, Excel OPC client, etc. You always need vendor-specific solutions like with Rockwell it would be RSLinx OPC Server, and have vendor-specific complicities, like it has to be Professional edition or better of RSLinx. Data is written and queried to/from the SQL database server via Ethernet.

But most automation controller vendors provide an add-on SQL function block for their PACs. Some PAC vendors/models may only communicate with the SQL relational database using an “unconnected” connection, others use the standard “connected” connections. On the HMI SCADA side, reading from and writing to the SQL database is much easier as it is just computer to computer communication, formats, and protocols. So if you already know how to get data from PLC to HMI SCADA, it will be much easier. With PACs, vendors and 3rd party software providers make integration software packages that really simplify the design, like PLCSQL Link software that you don't even need OPC servers or VB Scripts. While connecting a PLC or PAC to an SQL database can get complicated, the good news is the programming language is easy as ladder logic with basically 5 instructions. SELECT, UPDATE, DELETE, INSERT, and WHERE.  You can get free online SQL training from W3. Also, if you want to dive deeper into SQL and prefer learning from videos, Guru99 is a great resource.

Best practices must be applied to the entire software development lifecycle, user interfaces, networking and databases. 92% of all security vulnerabilities are now considered application vulnerabilities and not network vulnerabilities (according to NIS). The common SQL injection security vulnerability must be completely understood and accounted for. The SQL attack where a SQL command is submitted and executed by a web application, exposing the back-end database.

Client/Server Communications:

As well as learning the basics of OPC Server communications and SQL server communications, more importantly, one must learn the basics of common server operating systems (OS), Linux and Windows. We say more importantly, because once machine data is transmitting bi-directionally over computer networks, your security risk increase by many times. If that computer network is connected to the world outside your plant's physical location, that security risk increases by many times again. To oversimplify  PLC Industrial Network protocol - complicity(PAC plant internal Ethernet risk2)2 - PAC external network risk2x2 - PAC external network via internet/cloud/mobile risk2x2x2 ...

Security Risk...

  1. PLC only industrial network protocol - virtually none
  2. PLC/PAC internal Ethernet network - low risk
  3. PLC/PAC external private Ethernet network - medium risk
  4. PLC/PAC external Ethernet 'cloud' network - high risk
  5. PLC/PAC internet or mobile network - extremely high risk!

 

Because of the high risk of harming man or million-dollar equipment, working this area of system integration one should at least hold a Microsoft Certified Solutions Expert (MCSE) certification, or at the absolute minimum, be working closely with a certified network administrator. (LPIC-2 if working with Linux server OS) It is scary, the number of plant maintenance and engineers you see in our industry's online discussion forums, stumbling through networking PLC/PACs without the previously recommended certifications. Relying on anonymous forum members they do not know, with unknown and unverified certifications for advice on how to network their company's PLCs to their Smartphone! It's a hacker's virtual who's who of soft targets list. This is mostly due to industrial companies not having and/or enforcing company policies concerning their PLCs and industrial controls. With federally regulated industries like food & drug, utilities, transportation, etc. being the exception to the rule, as enforced policies and procedures are mandated.

HTML5, CSS3, JavaScript Training:

All of today's web browser-based applications (including websites) should be designed and program using and conforming to HTML5, CSS3 and JavaScript to be more secure and multi-device compatible. Using these standards, you write the program, design the user interface once and it will work properly in all modern browsers, tablets, and Smartphones. While if you were just designing a website or computer application, certification may not be necessary. But if designing a live machine interface like HMI SCADA, certification is recommended.  HTML5 Developer Certification proves fundamental knowledge of web development using HTML5.

In getting HTML5 certified, you should learn most security considerations. Some additional advice would be turning off your server signature, disabled directory browsing, block access from libwww-perl, your DNS server should use an SPF record.

Recommended for Designing Industrial HTML5 Applications...

  1. Introduction to designing user interfaces
  2. CSS basics and managing user interfaces
  3. JavaScript basics, functions, variables and APIs
  4. JavaScript animations, canvas/SVG and user data handling
  5. XML, SQL, PHP, W3.CSS

 

HMI SCADA Training:

HMI and SCADA training requirement has already been covered on this site as HMI SCADA Training is the 10th learning phase on this site. But for this just discovering PLC-Training.org for the first time via this white paper, we'll touch a little on the topic. Just note afterward you should explore the section linked to above as well as it's associate HMI SCADA Training Best Practices section. For those who have not stopped to think about, first the basics. Acronyms in our industry can be necessary PAC to differentiate the device is an industrial computer architecture not a single dedicated microprocessor like the PLC is. But other times in our industry, acronyms and terminology can hide important basic facts. Like the "internet" and the "cloud". Often people lose sight of the fact that when your sensitive data is on the 'secure cloud', it actually transfers to from the 'cloud' via the internet. (A website stores the data on the server, accessed via the worldwide network called the internet. The 'cloud' does the same. Basic difference one is open to the public, the other is not.)

HMI (Human Machine Interface) and SCADA (Supervisory Control and Data Acquisition) acronyms also made an important distinction. SCADA was HMI with Data Acquisition. Another important fact about SCADA, it ushered in the concept of machine data on local computer networks. But what the two acronyms also did as well as the phrase "SCADA systems", was to push to the back of decision-makers mind, that actually HMI SCADA is just computer software on a computer, on a network. Which once you think of it that way, the first thought and concern should be, computer/software equals virus susceptible. Losing sight of this fact is what made the Stuxnet virus able to damage a nuclear plant. Nowadays, as computer technology becomes less expensive, HMIs right on machines are becoming SCADA software by definition, yet referred to as HMI making the risk even less thought about. Most none federally regulative industries have less enforced security procedures than you might on your computer at home. Many do not even have backups of all their HMI programs in the facility, often due to understaffing, but equally so due to not thinking of an HMI as a computer. It is often similar to to the process of how to back up a PLC program.

Smartphone Programming Training:

There are two approaches to getting your HMI SCADA onto the Smartphone, as a web page or as an App. Depending on which of the two approaches you take, will dictate the Smartphone programming training you need. Regardless of the approach you will first need to be certified in mobile app certification and cloud networking. If you decide to use the web page approach,  see  HTML5, CSS, JavaScript training requirements above.

Then depending on which mobile platform you will be programming on, you will seek programming training for that specific platform. Like the two most popular Android and iOS (Apple). We only linked to the Android mobile app certification training above because it is by the most popular asked for by employers. Another advantage of being certified in Android OS programming is that OS works with Multiple Vendors and the core programming language is Java, so a smaller learning curve if you did the JavaScript training recommended above in the HTML5 section. If you are seeking iOS (Apple) programming training it uses Objective-C programming language, and only works with Apple products. So as with all things Apple, you will be limited in your applications, capabilities, options and job opportunities.

Besides the HTML5, CSS, JavaScript training requirements mentioned above, you will need a  bachelor's degree in software engineering. To include object-oriented programming (OOP), Java programming, Objective-C and C++ programming, user-interface (UI) design, database & OS fundamentals to name a few.

Also, extensive education of the mobile security vulnerabilities needs to be studied and taken into account. In short, the mobile security vulnerabilities are errors in design or implementation that expose the mobile device data to interception and retrieval by attackers. Mobile code security vulnerabilities can also expose the mobile device or the cloud applications used from the device to unauthorized access. Security vulnerabilities of the infrastructure layer, the hardware, operating system, and application layers must be completely understood and taken into account when designing interfaces to industrial equipment.

 Disclaimer: While we do not recommend connecting live industrial machines with potential for damage to man or machine, to the Cloud, Internet or Smartphone's (as in most cases the reward does not justify the risk), this whitepaper is provided as a recommended educational background should one decide to pursue such a project anyway.