I have an application where one ControlLogix needs to read data from another ControlLogix. The second PLC is part of a validated pharma process and it needs to be possible to guarantee that the first PLC can only read and never write data to the second PLC. I have seen so called “Data Diode” switches that understand the Ethernet/IP protocol and enforce the one way data path buy they are very expensive. I’m wondering if there are any less expensive solutions that will achieve the same goal.
Alternative to Data Diode switches for ControlLogix to ControlLogix comms
- Thread starter sanger
- Start date
dmroeder
Lifetime Supporting Member
I don't know much about Pharma rules but the Producer/Consumer model of exchanging data is one way communication. Of course, it would require you to modify your validated PLC in order to create the Produced tag.
Another method, might depend on your firmware revision, would be to find the tags you want to read and change their external access property to Read Only. Then you could use a message from your non sensitive PLC to read the tags from your pharma validated PLC.
Another method, might depend on your firmware revision, would be to find the tags you want to read and change their external access property to Read Only. Then you could use a message from your non sensitive PLC to read the tags from your pharma validated PLC.
Any modifications to the protected PLC will open up a whole can of worms so options that avoid that are preferred.
drbitboy
Lifetime Supporting Member
Does the controlled CL have a web server?
rdrast
Lifetime Supporting Member
Can you not just issue a MSG Read instruction in the non-validated PLC?
AustralIan
Member
Get your Linux admin to install a deep packet inspection filter on the firewall that only allows the particular ethernet IP cip service you want to allow (and allow all responses).
Might be a bit if wireshark poking around.
If you are the Linux admin yourself, I am sure you could set this up for free with one of the open source networking packages.
Might be a bit if wireshark poking around.
If you are the Linux admin yourself, I am sure you could set this up for free with one of the open source networking packages.
TheWaterboy
Lifetime Supporting Member + Moderator
If the protected, validated PLC does not have this write protection built in, I would imagine that the validation spec would dictate what you can and can't connect it to. Just connecting it to anything might be a problem.
But if not maybe an EIP gateway would work. You set it up to only read and then use the second PLC to read from the gateway.
But if not maybe an EIP gateway would work. You set it up to only read and then use the second PLC to read from the gateway.
harryting
Lifetime Supporting Member
I used an EIP to EIP gateway from Anybus before for similar purpose. I did it to avoid "IT entanglement". It acted like a virtual interposing relay board. If you have V20 or higher then you can use EDS and treat it like a IO. You can still exchange data both way but this prevent one from communicate directly to the other PLC.
Similar Topics
Greetings All,
I recently decided to start freelancing in Controls and Automation part time, most of my experience has been with Rockwell...
Recently I have requested a quote from Magnetek for their Impulse Drives but can't raise a response from them.
I've requested a quote FOUR TIMES...
Hello All,
Its been a long time since i've been in the trenches actually doing development. When i was developing I used PicsPro extensively for...
Hello friends,
I'm asking a new question here, after thinking a lot about my problem, I wondered if it wouldn't be easier for me to install new...
Hi all. I'm a uni researcher using FactoryTalk Studios SE (just basic knowledge). Have some previous experience with Factory View32 years ago and...