Chapter 2:
The world of remote access
Understanding remote access means thinking networks, Internet, Cloud and automation securely together.
This chapter provides you with a sound, practical introduction to network technology (LAN/WAN, IP, subnets, Gateways, routers), Internet/Cloud computing and the basics of PLCs, automation and HMI.
Objective: To explain technical contexts in such a way that remote access architectures in industrial environments become comprehensible and plannable.
Everything you always wanted to know about working with networks
Context from Chapter 1:
Chapter 1 describes a router-based VPN solution in which a remote technician accesses devices that are connected behind a remote access router.
These devices are typically located in their own local area network (LAN), which in practice is often referred to as a machine LAN.
A LAN is a network for a manageable geographical area - such as a building, a factory or an industrial plant like a machine.
A WAN connects several LANs (and possibly other WANs) over longer distances.
The Internet is the best-known example of a very large WAN.
How automation devices are typically connected in the machine LAN
Devices such as PLCs, control panels, HMIs, industrial computers and other automation components (e.g. I/O peripherals or drives) are usually connected via hubs or switches using Ethernet cables (wired).
Most LANs use TCP/IP for communication.
Essentially, every device in a TCP/IP network needs a unique IP address
Understand IP address:
Why "32 bits" are important in practice
IPv4 - four octets, one principle
The IP version widely used today is IPv4.
It uses a numerical 32-bit address, divided into four octets, e.g. 5.39.46.101.
Figure 2-1 shows the basic principle.
Bit logic per octet (0-255)
An octet has 8 bits. Each bit is "on" (1) or "off" (0). The decimal number of the octet (0-255) is created by adding the set bit values.
The bit weighting in the octet is (from left to right): 128, 64, 32, 16, 8, 4, 2, 1 (each "on" or 0 "off"). In this way, any number from 0 to 255 can be represented by adding the active bit values.
Example from Figure 2-1:
The first octet is 5 because only 4 and 1 are active (0+0+0+0+0+4+0+1).
The second octet is 39 because 32, 4, 2 and 1 are active (0+0+32+0+0+4+2+1).
As an exercise, you can check whether you can calculate the third and fourth octets from Figure 2-1 using the same logic.
IP communication in practice:
Subnet mask & Gateway
IP address alone is not enough
In addition to the IP address, every IP-enabled device also works with a subnet mask and, in most cases, a Gateway.
The subnet mask is also 32-bit-based and is used to calculate the network address from the IP address.
This allows a computer to "know" whether a target IP is in the same network or not.
If the target is in the same network, communication takes place directly.
If the target is in a different network, communication takes place via the Gateway.
What a Gateway does technically
A Gateway has two or more IP interfaces and establishes the connection between two or more networks.
An Ewon Cosy is an example of a Gateway.
Example 1:
Communication in the same network
Device A should communicate with device B.
Although both devices are in the same physical network, the IP address + subnet mask determine whether they belong to the same network.
Device A uses 10.0.0.67 with the subnet mask 255.255.255.0.
The network address 10.0.0.x is created by masking.
This means that every device whose IP begins with 10.0.0 (e.g. device B) belongs to the same network and can communicate directly with device A.
Example 2:
Communication across network boundaries
In Figure 2-3, device A is supposed to communicate with device E.
However, device E is not in device A's network because it has the IP 10.1.0.19.
As a result, device A must send the message to the Gateway, and the Gateway forwards it to device E.
Why Gateways "need" two IP addresses
In both illustrations, the Gateway has two connections.
Each connection has an IP address that matches the network to which it is connected.
And for everyday industrial use, every automation device in the machine LAN must have a unique IP address.
Remote access in architecture:
Machine LAN, plant LAN ("WAN") and router
No connection between networks without a router
For remote access to be possible, the machine LAN is connected to the factory LAN - often referred to as a WAN in remote access terminology.
This coupling takes place via a router (see Figure 2-4).
A router connects a LAN to another LAN that uses a different network address share.
As remote access runs via the Internet, the WAN must be able to reach the Internet - typically via a factory router or a firewall.
IPv4 limits and the role of NAT
(Network Address Translation)
Why private IP addresses are common
IPv4 is limited: There are only just over four billion unique IPv4 addresses in total.
To bridge this limitation, private IP addresses are often used in LANs.
However, private IPs cannot be routed via the Internet.
They must therefore be translated into public IP addresses for Internet traffic - via NAT.
What NAT actually does
NAT assigns public IP addresses to private IP addresses for outgoing Internet traffic. In practice, this is usually done by the router.
Private IP ranges at a glance (for practical use)
- Range 1:10.0.0.0 - 10.255.255.255 → very large networks (over 16 million hosts possible).
- Range 2:172.16.0.0 - 172.31.255.255 → medium to large networks (approx. 1 million hosts possible).
- Range 3:192.168.0.0 - 192.168.255.255 → small to medium-sized networks (approx. 65,000 hosts possible).
The global supply of unique IPv4 addresses was exhausted in 2016.
Many companies are therefore increasingly switching to IPv6.
IPv6 uses a 128-bit hexadecimal address and offers 3.4 × 10^38 unique addresses - i.e. over 340 undecillion.
The Internet and Cloud Computing
From ARPANET to TCP/IP to the Internet
In the 1960s, DARPA developed ARPANET as the first packet-switched network - the forerunner of the Internet.
TCP was created in the late 1970s, followed by IP.
TCP/IP enabled ARPANET and other networks to connect to each other worldwide.
In the late 1980s, this interconnected network became known as the Internet.
Today, the Internet and the World Wide Web are ubiquitous, connecting devices and networks to vast amounts of information and resources worldwide.
For many millennials, the Internet feels almost indispensable.
Cloud milestones & major providers
Amazon officially launched Amazon Web Services (AWS) in 2006, giving the term Cloud a massive boost.
Other major Cloud providers include Microsoft Azure, Oracle Cloud, Google and IBM.
What "Cloud" originally meant - and how NIST defines it
Originally, "Cloud" stood for the network "wrapper" that enables LAN Internet connections (often shown as a cloud in the diagram). According to NIST, Cloud computing includes five characteristics: On-demand self-service, broad network access, resource pooling, rapid elasticity, and metered service.
Cloud service models (web-compatible explained)
- IaaS (Infrastructure as a Service): Provision of computing, storage and network resources; operating systems and applications are used by the customer, the Cloud infrastructure itself remains outside their control (e.g. AWS).
- PaaS (Platform as a Service): Provision of a platform for running/deploying supported applications; infrastructure management remains with the provider (e.g. IBM Bluemix).
- SaaS (Software as a Service): Access to applications that run in the Cloud; no control over infrastructure (e.g. Gmail).
- CaaS (Connectivity as a Service): Inter-network connectivity as a service - scalable and economical, especially for SMEs, without complex multi-vendor relationships (e.g. Ewon Talk2M).
This image helps to understand: The Internet is the route, the Cloud (and the web) are the destinations that can be reached via this route.
Connecting automation devices without an Ethernet interface
Protocol diversity is a reality - interoperability is the challenge
There are many protocols in industrial environments because the applications are highly specialized.
However, many of these protocols are proprietary and not standardized, which makes interoperability in networked industrial environments difficult.
EtherNet helps - and TCP/IP transports transparently
Good for practical applications: Most automation devices now have Ethernet ports. This means that PLC/automation protocols (as in Table 2-1) can often be transmitted transparently via routers thanks to TCP/IP.
When devices are "old": Serial instead of Ethernet
Older automation devices without an Ethernet port usually have serial interfaces - typically RS232 or RS485.
For remote access to such devices, the LAN/WAN router should ideally also act as a protocol gateway and translate Ethernet protocols into serial counterparts.
It follows from this: An automation router should offer integrated Gateway functionality and support the protocols listed in Table 2-1.
Supported PLC protocols
- Allen Bradley - Rockwell Automation: DF1 (serial) / Ethernet Industrial Protocol, EIP (EtherNet)
- Siemens, VIPA: MPI/Profibus (serial) / ISOTCP (Ethernet)
- Schneider: Modbus/Unitelway (serial) / Modbus (Ethernet)
- Omron: Fins Hostlink (serial) / Fins TCP/UDP (Ethernet)
- Mitsubishi: Programming protocol (serial) / MC protocol (Ethernet)
- Hitachi: H protocol (serial) / H protocol (Ethernet)
The history of the SPS
Why PLCs were invented in the first place
PLCs are now established across all industries, but the first PLC systems were developed for US car manufacturers.
Before the introduction of PLCs, manufacturing processes were controlled by many hard-wired relays and timers.
This technology worked, but thousands of components often had to be rewired for each process change - a costly and time-consuming effort.
Historical trigger (1968)
In 1968, the automatic transmission department of General Motors was looking for a better way to implement changes in production processes.
Bedford Associates from Massachusetts was awarded the contract and developed the first PLC, which became known as the Modular Digital Controller (Modicon).
Dick Morley, one of the developers, is described by "Manufacturing Automation" as the "father" of the PLC.
Programming then and now
Note: Early PLCs used ladder logic, based on the circuit diagrams of previously used analog control technology.
Modern PLCs can be programmed in different ways - but their purpose remains the reliable, programmable control of manufacturing processes.
to top
Contact
Request form