IT in Manufacturing


Remote industrial automation ­services via the Internet

October 2015 IT in Manufacturing

Remote access for servicing PLCs, HMI panels or other industrial equipment is becoming a must-have for most OEMs (Own Equipment Manufactures) and system integrators in order to live up to their contractual obligations. It is not just about travel budget cost reductions; more critical is the contractual obligation for response time and up time, and with the increasing complexity of industrial installations, efficient use of critical engineering resources is vital. Optimising service offerings and resources requires selection of the right solution for remote access, to ensure focus is kept on the core business.

Identify the category of remote service that covers your needs

Remote monitoring

The term remote monitoring (or remote management) typically covers collecting specific predefined information from devices, and processing them on a central server. The main purpose is to perform preventive or predictive maintenance, and if a critical problem is detected, a technician will travel on site. Note that such solutions are typically not designed to allow establishing of connections through which you can service the equipment remotely. This type of solution is very common for utility installations.

Remote service via remote desktop

Several low cost, or even free solutions, exist for providing remote desktop access to equipment inside a network. Most of the solutions require that both ends are manned, which is typically not the case for a service PC at the factory. Solutions do exist that allow secure remote access to unmanned equipment inside local networks, but these solutions are typically not cheap. Add to this the administrative task of maintaining a Windows PC (with its frequent security updates) and the potential cost of software licences for the PLC or HMI programming software packages installed on the PC, and the setup may seem less ideal .

Remote service via port forwarding

Solutions in this category are typically based on a hardware unit at the site that acts as an Internet router to the equipment. The most simple solutions are based on the router having a fixed IP address on the Internet, which 'routes' or 'port forward' incoming connections to the equipment; pretty similar to the traditional dial-up modems. This type of setup is typically seen for video surveillance. The risk of exposing access to industrial equipment directly on the Internet, using unencrypted connections, combined with the need for fixed IP addresses, essentially rules these solutions out.

Remote service via data tunnelling

This is the kind solution that would fit most remote service needs. Traditional IT solutions based on VPNs have existed for more than a decade, but in recent years, VPN solutions ­specifically addressing the automation industry have multiplied. Most of them are just traditional VPN solutions packaged for automation use, by offering DIN rail mounting and 24 V power feed. Some vendors have taken a step further to disguise complex IT con­figuration from the users and eliminate need for changing firewall settings. These solutions typically involve a central M2M server, acting as a portal for user access control and data re­direction. At least one vendor, namely the Danish company Secomea, has evolved away from VPN completely, and instead uses a concept of encrypted proxy connections for solving challenges that VPN technologies by nature have difficulties to overcome.

What to watch out for in relation to the above category

Ease of deployment – a vital part of overall security

Ease of installation and configuration is essential for saving time, and for enabling non IT literate personal to deploy the solution. It should not be necessary to configure firewall or routing rules, or to install third-party software that are not an integrated part of the solution. Installation and initial configuration should be possible to do by the same engineer that handles the electrical wiring, and user access control and configuration of device access should be manageable by the PLC programmer, the OEM project manager or the site administrator.

Using the customer network, and security argumentation

Typically a factory, or its machines, would run in a network isolated from the corporate office network, but typically it will only be the office network that can connect to the Internet. When using a standard VPN enabled router for accessing the machine network, you would typically connect its WAN side to the office network, and the LAN side to the machine network.

IT departments will not be happy about a third-party connection between the networks, even if you argue that the router has a built-in firewall that prevents unauthorised access between the networks. So you will have to explain precisely how the solution works and why it does not compromise security. Such information should be provided by the remote access solution vendor.

Additionally the solution must be able to establish its encrypted tunnel connection to the Internet based on ports that are commonly open. This would be 'web' ports, such as 80 (http) and 443 (https). Do not expect IT departments to open specific ports on your request.

Network conflict issues

Maybe one of the most common issues when connecting multiple users and networks together is 'network conflicts'. When connecting networks statically via routers or VPN connections, all networks must have different 'IP subnets'.

A typical issue is that two factories may use the same IP subnet. Most industrial remote access solutions solve that by dynamically establishing the connection on-demand, and close it again when done. The only limitation is that the service engineer cannot be connected to both factories simultaneously, which would typically not be necessary either.

More critical is the scenario where the engineer sits in an IP subnet that is identical to that of the factory (e.g. a user sits in subnet 192.169.0.10/24, and attempts to connect via VPN to a factory that uses the exact same subnet). For routed technologies this will simply not work. It could be solved by making alias addresses and applying NAT (network access translation), but it is not trivial.

Two-factor authentication

Typical VPNs for statically connecting office networks are based on x509 certificates that are manually exchanged between the VPN peers during the initial setup. In recent years SSL/TLS based VPN solutions have become popular, due to being 'firewall friendly' and automatic bidirectional authentication. The concern with many such implementations for industrial access is that the initial authentication is based on only a user name and a password.

Traceability and logging

Documented proof of who took access to what, and when. The purpose is not only to document if a given remote user may have been causing an issue on a machine, but also to document if a service provider is in fact fulfilling the service obligations.

Check if audit logging exists and how it can be accessed.

Dependence of third-party cloud services

As mentioned earlier, using a central M2M server is becoming essential for controlling user access and data connection redirection. Such services may be free, or be subject for maintenance fees. Investigate fees in relation to scaling the solution and make a strategy for which budget to place such cost on.

More importantly you should investigate if the M2M server is available only as a cloud service hosted by the vendor, or if you can migrate to an own M2M server. Major OEMs generally do not like to be dependent on a specific vendor’s existence for their server’s up-time and applied security measures.

For more information contact Bob Petrie, Throughput Technologies, +27 (0)11 705 2497, [email protected], www.throughput.co.za



Credit(s)



Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Looking into the future of machine vision
Omron Electronics IT in Manufacturing
Artificial intelligence (AI) is driving a significant transformation in all areas of industrial automation, and machine vision is no exception. Omron’s AI-powered machine vision systems seamlessly integrate state-of-the-art algorithms, enabling machines to analyse and interpret visual data meticulously.

Read more...
Driving digital transformation in the truck industry
Siemens South Africa IT in Manufacturing
Tatra Trucks, a leading truck manufacturer in Czechia, has adopted the Siemens Xcelerator portfolio of industry software including Teamcenter software for product lifecycle management and the Mendix low code platform to help increase production volume and strengthen its ability to manufacture vehicles that meet specific customer requirements.

Read more...
Opinion piece: Digital twins in manufacturing – design, optimise and expand
Schneider Electric South Africa IT in Manufacturing
Digital twin technology can help create better products, fast. It can also transform the work of product development. This strong statement from McKinsey reinforces how far digital twins have come in manufacturing.

Read more...
Asset tracking is key to driving operational excellence and sustainable growth
Schneider Electric South Africa IT in Manufacturing
Asset tracking plays a critical role in the success of industrial businesses. By effectively managing and monitoring assets, companies can optimise their operations, ensuring that resources are used efficiently. This leads to improved productivity and reduced costs.

Read more...
Siemens democratises AI-driven PCB design for small and medium electronics teams
Siemens South Africa IT in Manufacturing
Siemens Digital Industries Software is making its AI-enhanced electronic systems design technology more accessible to small and mid-sized businesses with PADS Pro Essentials software and Xpedition Standard software.

Read more...
Predicting and preventing cyber-attacks with AI and generative AI
IT in Manufacturing
The speed at which cyber threats are evolving is unprecedented. As a result, companies need to implement state-of-the-art technology to protect their data and systems.

Read more...
Real-world lessons in digital transformation
IT in Manufacturing
Synthesis has helped businesses across multiple industries with their digital transformation by solving their unique integration challenges.

Read more...
Enhancing cyber security for industrial drives
Siemens South Africa IT in Manufacturing
The growing connection between production networks and office networks as part of IT/OT integration and the utilisation of IoT have many benefits for industrial companies. At the same time, they also increase the risk of cyber threats. Siemens ensures that your know-how and plants are protected at all times.

Read more...
Immersion cooling systems for data centres
IT in Manufacturing
The demand for data centres in Africa is growing. The related need for increasing rack densities brings with it escalating cooling requirements.

Read more...
Transforming pulp and paper with automation and digitalisation
ABB South Africa IT in Manufacturing
The pulp and paper industry in South Africa is undergoing a significant transformation from traditional manual processes to embracing automation technologies. Automation in pulp and paper mills aims to improve various production stages, from raw material preparation to final product creation.

Read more...