Patent Application
20180364671
Disclosed embodiments relate to industrial control systems, including safety controllers.
An industrial facility, such as an industrial processing facility (or plant), to implement a fault-tolerant industrial process control system can include a safety instrumented system (SIS) for monitoring and overriding the process control provided by the process control system to maximize the likelihood of safe operation of the processing plant. A safety controller as known in the art of process control is a device or combination of devices connected to each another which receive process signals from sensors and uses these signals to produce output control signals using logic operations and, if needed, by further data processing steps. These output control signals are coupled to control actuators which carry out specific actions on the various processing equipment.
A distinguishing feature of a safety controller in contrast to a conventional process controller is that the safety controller always ensures that potentially dangerous apparatus are being controlled is in a safe state, which is implemented by running safety control programs. This safety requirement even applies when a malfunction occurs within the safety controller itself or in a device in the processing system (e.g., an Input/Output (10) module, sensor or actuator, or processing equipment) which is connected to it. Safety controllers are therefore subject to stringent requirements for their own fail safety, which results in considerable additional effort during their design development and manufacture. Generally, safety controllers require special licensing from responsible supervisory government authorities before they can be used, such as from professional societies dealing with work safety or from a technical supervisory association. The safety controller must also comply with specific safety standards depending on their geographic location, such as in Europe defined in the European Machine safety standard EN 954-1 which is used as an essential base for the risk analysis of safety-related components of industrial controls.
A typical safety controller of a SIS (e.g., such as implemented by a programmable logic controller (PLC)) runs stored safety control programs and provides at least a maintenance override mode using a force (FRC) enable position which allows entering a maintenance override mode. The safety controller is generally located in a control room of the plant, but can also be located in remote locations such as well heads or unmanned platforms. A key switch provides the FRC enable ON position and a FRC enable OFF position for enabling the maintenance override mode to be implemented.
From government safety regulations it is generally mandatory to remove all maintenance overrides with a single hardware switch action. It is believed that in all known cases for removing active maintenance overrides the same key-switch is returned by the user to the maintenance disabled state by moving from the FRC enable ON position to the FRC enable OFF position for the single key-switch arrangement, and from the FRC reset OFF position to the FRC reset ON position for the 2 key-switch arrangement.
This Summary briefly indicates the nature and substance of this Disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.
It is recognized herein as more and more customers for a system have maintenance overrides that are active for a relatively long duration, such as during a plant overhaul, as part of a stand-by strategy, or due to long spare part delivery times, while the key-switch of the controller is in the FRC enable ON position enabling the maintenance override mode, the controller is susceptible to cyber-security risks. This cyber-security susceptibility is because while in the maintenance override mode all override enabled points in the plant including input/output devices (IOs), field devices and processing equipment are exposed to all attackers that have a forcing-capable communication path to the SIS, including the digital and analog outputs of IO devices that drive safety critical actuators coupled to processing equipment during such maintenance overrides. These cyber-security risks can comprise direct-access attacks (such as driving an input or output to an unsafe value) or tampering (changing parameters, such as the temperature of a burner).
Disclosed embodiments include controllers that comprise two FRC key-switches including a FRC enable key-switch with a FRC enable On position for entering the maintenance override mode, and a dedicated FRC reset key-switch that has a reset position for clearing (resetting) the ‘active’ maintenance overrides entered while in the maintenance override mode (while the FRC enable is On). In this disclosed arrangement, the FRC enable key-switch can be returned by a user to the FRC enable off (disabled) position which changes the safety controller state back to the run mode with no changes to the currently active maintenance override(s), yet new maintenance overrides cannot be added until the FRC enable key-switch is set to the maintenance override mode (where new maintenance overrides can be added) until the FRC enable is set to FRC enable ON again. This arrangement reduces the maintenance override mode time window (with FRC enable ON) to the time it takes to set a force (typically less than a minute) which reduces the cyber-attack time window from the time it take to complete the maintenance (typically weeks) to the time it takes to set the forces (typically minutes).
Disclosed embodiments are described with reference to the attached figures, wherein like reference numerals, are used throughout the figures to designate similar or equivalent elements. The figures are not drawn to scale and they are provided merely to illustrate aspects disclosed herein. Several disclosed aspects are described below with reference to example applications for illustration. It should be understood that numerous specific details, relationships, and methods are set forth to provide a full understanding of the embodiments disclosed herein.
One having ordinary skill in the relevant art, however, will readily recognize that the disclosed embodiments can be practiced without one or more of the specific details or with other methods. In other instances, well-known structures or operations are not shown in detail to avoid obscuring aspects disclosed herein. Disclosed embodiments are not limited by the illustrated ordering of acts or events, as some acts may occur in different orders and/or concurrently with other acts or events. Furthermore, not all illustrated acts or events are required to implement a methodology in accordance with this Disclosure.
Also, the terms “coupled to” or “couples with” (and the like) as used herein without further qualification are intended to describe either an indirect or direct electrical connection. Thus, if a first device “couples” to a second device, that connection can be through a direct electrical connection where there are only parasitics in the pathway, or through an indirect electrical connection via intervening items including other devices and connections. For indirect coupling, the intervening item generally does not modify the information of a signal but may adjust its current level, voltage level, and/or power level.
The safety controller 150 includes a housing 112. The safety controller 150 includes a disclosed multi-key switch 200 (see the multi-key switch 200 shown in
The processors 119a and 119b can comprise a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a general processor, or any other combination of one or more integrated processing devices. The safety controller 150 also is shown including a serial communication port 130 (such as an RS-232 port) that allows it to communicate directly with a programming terminal 132 shown by example in
Provided the FRC command was accepted in step 304, step 305 is reached which comprises reading the FRC reset key-switch 203 position and FRC enable key-switch 202 position. Step 306 checks whether the FRC enable key-switch 202 read in step 305 is in the ON position. If the FRC enable key-switch 202 is ON, the FRC CMD accepted in step 304 is accepted in step 308 thus becoming an active FRC CMD, otherwise the FRC CMD accepted in step 304 is not accepted in step 307 so that no action is taken in step 307. Step 309 comprises checking the FRC reset key-switch 203 position. If the FRC reset key-switch 203 is ON (from the read in step 305), then the active FRC CMD entered in step 308 is cleared in step 311, otherwise if the FRC reset key-switch 203 is OFF, then no FRC CMD resetting/clearing action is taken and the current FRC CMD is continued.
During a maintenance period multiple FRC CMD for different inputs and outputs are entered and those forces must remain active until maintenance is completed. Without this Disclosure the FRC enable key-switch in step 306 must be kept in the enable position while maintenance is ongoing. This means without this Disclosure a cyber-attack has a FRC CMD attack window open with the duration of the maintenance period. During this attack window an attacker is enabled to enter unintentional FRC CMD. The Disclosure allows the FRC enable key-switch 202 to be returned to the OFF position immediately after accepting a FRC CMD only to be set to the ON position when a genuine FRC CMD is expected. The FRC reset key-switch 203 assures that all forces can be removed when needed.
While various disclosed embodiments have been described above, it should be understood that they have been presented by way of example only, and not as a limitation. Numerous changes to the disclosed embodiments can be made in accordance with the Disclosure herein without departing from the spirit or scope of this Disclosure. Thus, the breadth and scope of this Disclosure should not be limited by any of the above-described embodiments. Rather, the scope of this Disclosure should be defined in accordance with the following claims and their equivalents.
Although disclosed embodiments have been illustrated and described with respect to one or more implementations, equivalent alterations and modifications will occur to others skilled in the art upon the reading and understanding of this specification and the annexed drawings. While a particular feature may have been disclosed with respect to only one of several implementations, such a feature may be combined with one or more other features of the other implementations as may be desired and advantageous for any given or particular application.
This application claims the benefit of Provisional Application Ser. No. 62/520,898 entitled “CONTROLLER WITH CYBER-SECURE MAINTENANCE OVERRIDE”, filed on Jun. 16, 2017, which is herein incorporated by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62520898 | Jun 2017 | US |
