IT in Manufacturing

Remote industrial automation ­services via the Internet

October 2015 IT in Manufacturing

Remote access for servicing PLCs, HMI panels or other industrial equipment is becoming a must-have for most OEMs (Own Equipment Manufactures) and system integrators in order to live up to their contractual obligations. It is not just about travel budget cost reductions; more critical is the contractual obligation for response time and up time, and with the increasing complexity of industrial installations, efficient use of critical engineering resources is vital. Optimising service offerings and resources requires selection of the right solution for remote access, to ensure focus is kept on the core business.

Identify the category of remote service that covers your needs

Remote monitoring

The term remote monitoring (or remote management) typically covers collecting specific predefined information from devices, and processing them on a central server. The main purpose is to perform preventive or predictive maintenance, and if a critical problem is detected, a technician will travel on site. Note that such solutions are typically not designed to allow establishing of connections through which you can service the equipment remotely. This type of solution is very common for utility installations.

Remote service via remote desktop

Several low cost, or even free solutions, exist for providing remote desktop access to equipment inside a network. Most of the solutions require that both ends are manned, which is typically not the case for a service PC at the factory. Solutions do exist that allow secure remote access to unmanned equipment inside local networks, but these solutions are typically not cheap. Add to this the administrative task of maintaining a Windows PC (with its frequent security updates) and the potential cost of software licences for the PLC or HMI programming software packages installed on the PC, and the setup may seem less ideal .

Remote service via port forwarding

Solutions in this category are typically based on a hardware unit at the site that acts as an Internet router to the equipment. The most simple solutions are based on the router having a fixed IP address on the Internet, which 'routes' or 'port forward' incoming connections to the equipment; pretty similar to the traditional dial-up modems. This type of setup is typically seen for video surveillance. The risk of exposing access to industrial equipment directly on the Internet, using unencrypted connections, combined with the need for fixed IP addresses, essentially rules these solutions out.

Remote service via data tunnelling

This is the kind solution that would fit most remote service needs. Traditional IT solutions based on VPNs have existed for more than a decade, but in recent years, VPN solutions ­specifically addressing the automation industry have multiplied. Most of them are just traditional VPN solutions packaged for automation use, by offering DIN rail mounting and 24 V power feed. Some vendors have taken a step further to disguise complex IT con­figuration from the users and eliminate need for changing firewall settings. These solutions typically involve a central M2M server, acting as a portal for user access control and data re­direction. At least one vendor, namely the Danish company Secomea, has evolved away from VPN completely, and instead uses a concept of encrypted proxy connections for solving challenges that VPN technologies by nature have difficulties to overcome.

What to watch out for in relation to the above category

Ease of deployment – a vital part of overall security

Ease of installation and configuration is essential for saving time, and for enabling non IT literate personal to deploy the solution. It should not be necessary to configure firewall or routing rules, or to install third-party software that are not an integrated part of the solution. Installation and initial configuration should be possible to do by the same engineer that handles the electrical wiring, and user access control and configuration of device access should be manageable by the PLC programmer, the OEM project manager or the site administrator.

Using the customer network, and security argumentation

Typically a factory, or its machines, would run in a network isolated from the corporate office network, but typically it will only be the office network that can connect to the Internet. When using a standard VPN enabled router for accessing the machine network, you would typically connect its WAN side to the office network, and the LAN side to the machine network.

IT departments will not be happy about a third-party connection between the networks, even if you argue that the router has a built-in firewall that prevents unauthorised access between the networks. So you will have to explain precisely how the solution works and why it does not compromise security. Such information should be provided by the remote access solution vendor.

Additionally the solution must be able to establish its encrypted tunnel connection to the Internet based on ports that are commonly open. This would be 'web' ports, such as 80 (http) and 443 (https). Do not expect IT departments to open specific ports on your request.

Network conflict issues

Maybe one of the most common issues when connecting multiple users and networks together is 'network conflicts'. When connecting networks statically via routers or VPN connections, all networks must have different 'IP subnets'.

A typical issue is that two factories may use the same IP subnet. Most industrial remote access solutions solve that by dynamically establishing the connection on-demand, and close it again when done. The only limitation is that the service engineer cannot be connected to both factories simultaneously, which would typically not be necessary either.

More critical is the scenario where the engineer sits in an IP subnet that is identical to that of the factory (e.g. a user sits in subnet, and attempts to connect via VPN to a factory that uses the exact same subnet). For routed technologies this will simply not work. It could be solved by making alias addresses and applying NAT (network access translation), but it is not trivial.

Two-factor authentication

Typical VPNs for statically connecting office networks are based on x509 certificates that are manually exchanged between the VPN peers during the initial setup. In recent years SSL/TLS based VPN solutions have become popular, due to being 'firewall friendly' and automatic bidirectional authentication. The concern with many such implementations for industrial access is that the initial authentication is based on only a user name and a password.

Traceability and logging

Documented proof of who took access to what, and when. The purpose is not only to document if a given remote user may have been causing an issue on a machine, but also to document if a service provider is in fact fulfilling the service obligations.

Check if audit logging exists and how it can be accessed.

Dependence of third-party cloud services

As mentioned earlier, using a central M2M server is becoming essential for controlling user access and data connection redirection. Such services may be free, or be subject for maintenance fees. Investigate fees in relation to scaling the solution and make a strategy for which budget to place such cost on.

More importantly you should investigate if the M2M server is available only as a cloud service hosted by the vendor, or if you can migrate to an own M2M server. Major OEMs generally do not like to be dependent on a specific vendor’s existence for their server’s up-time and applied security measures.

For more information contact Bob Petrie, Throughput Technologies, +27 (0)11 705 2497,,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

A journey into the automation unknown
April 2020 , IT in Manufacturing
Jendamark’s reinvention as an Industry 4.0 technology leader in the automotive industry.

Implementing artificial intelligence in industrial manufacturing
April 2020, Omron Electronics , IT in Manufacturing
The introduction of AI solutions at the edge inside the machine now provides tools that enable you to look at that data and recognise patterns within it.

More efficient engineering with automatically generated dashboard
April 2020, Beckhoff Automation , IT in Manufacturing
Engineering 4.0: One-Click Dashboard eliminates an entire work step.

Engineering framework ready for continuous software development
April 2020, Siemens Digital Industries , IT in Manufacturing
With the new Totally Integrated Automation (TIA) Portal V16, Siemens has expanded its engineering framework with practical new functions for various phases from planning to engineering to commissioning. ...

How the IoT is affecting people
April 2020 , IT in Manufacturing
While the Internet of Things (IoT) may still be an emerging technology, it has become deeply entrenched in people’s lives and its proliferation is likely to accelerate further in the next few years. The ...

Schneider Electric introduces Asset Advisor for critical assets
Technews Industry Guide: Maintenance, Reliability & Asset Optimisation 2020, Schneider Electric South Africa , IT in Manufacturing
Schneider Electric has announced the availability of EcoStruxure Asset Advisor for electrical distribution and critical data centre assets, as part of the company’s EcoStruxure IoT-enabled system architecture ...

Why are half of all IIoT deployments failing?
April 2020 , IT in Manufacturing
The global IIoT business is arriving at a tipping point, with annual node shipments ser to grow to 224 million units in 2023, a 100 million unit increase from 124 million in 2018, according to IHS Markit. However, ...

Why should your business participate in the Fourth Industrial Revolution?
April 2020 , IT in Manufacturing
Organisations are pondering their level of participation in the Fourth Industrial Revolution by looking into the technologies and opportunities that these can bring. But what if you don’t participate? We ...

Digitisation and automation for mining: the only way forward
March 2020, SICK Automation Southern Africa , IT in Manufacturing
A global specialist for factory automation, logistics and process automation applications, SICK Automation has over 44 000 products for the most challenging industry applications that require high precision proximity detection systems.

2020 IT trends by Rittal South Africa
March 2020, Rittal , IT in Manufacturing
Rapid upgrades to data centres and rising energy consumption are key factors to consider.