PLC Network on Office Network???

We are starting to get new machines that use Compactlogix and they use Ethernet for communications. We currently have some SLC 500's that use DH+ for communications. The DH+ network is on the office network via ControlLogix DH+ Module and Ethernet module.

Corporate has to assign IP Addresses to anything on the network and we don't want to have to assign an IP address to each Panelview, RFID reader, etc that use ethernet to communicate to the local Compactlogix.

What is the best way to put the PLC network on the Office network without having to assign IP addresses to everything? Is it possible to run two Ethernet modules on a Compactlogix, allowing one module to communicate to the network and the other module strictly for communicating between Panelviews, RFID readers, etc?

Are there any safety concerns about putting the PLC network on the Office network? Is there a possibility that if the office network goes down, will that also effect the PLC network?

Please let me know what everyone thinks. Thank you.

Create a separate, isolated network for your automation equipment. One that you control. Pick a nice Private Class A or B subnet (private being 'local, non-routable'...

For class A, Subnet 255.0.0.0, Private range 10.x.x.x/8
for class B, Subnet 255.255.0.0 Private range 172.16.0.0/12

Then, if you do want to exchange data with the office network, install a dedicated gateway router between the two.

I never ever ever ever advise mixing corporate IT with automation gear; it's generally just asking for troubles, especially when some network administrator starts monkeying around with switches and masks.

Also, do please invest in high quality, industrial switches (preferably managed) and components. The difference between a $50 Home/Office Supply Store Switch and a $500 real switch may seem extreme, until the first time the network goes down because of the 'inexpensive' one.

In addition, you could add an ENBT to the ControlLogix chassis connected to this private LAN and bridge to that network from your corporate LAN. Only use this for programming terminal, not for your SCADA system.

Oakley said:

In addition, you could add an ENBT to the ControlLogix chassis connected to this private LAN and bridge to that network from your corporate LAN. Only use this for programming terminal, not for your SCADA system.

Click to expand...

Is there any reason behind not using an ENBT card as a bridge for a SCADA system? I've been using one for years to bridge 4 DH+ networks to ethernet to communicate with a SCADA system.

Christoff84 said:

Is there any reason behind not using an ENBT card as a bridge for a SCADA system? I've been using one for years to bridge 4 DH+ networks to ethernet to communicate with a SCADA system.

Click to expand...

No, to me, it sounded like he was saying add a second ENBT. Configure one for the line and SCADA, and the second one as an interface to the Corporate LAN.

rdrast said:

No, to me, it sounded like he was saying add a second ENBT. Configure one for the line and SCADA, and the second one as an interface to the Corporate LAN.

Click to expand...

Yes, that is what I am thinking. First ethernet module networks between the Compactlogix, Panelview, RFID reader, etc. And the second ethernet module networking between Compactlogix and the network office for SCADA.

Would that work? Or is there a better way? I definately don't want the network office causing any problems to machines on the line.

rdrast said:

No, to me, it sounded like he was saying add a second ENBT. Configure one for the line and SCADA, and the second one as an interface to the Corporate LAN.

Click to expand...

Actually, if you want your SCADA system on your corporate LAN, then put dual nics in the server/workstation to do so. Don't put your IO server on the corporate LAN. If your corporate LAN were to go down, you would still be controlling/visualizing/historizing data.

We're starting to do a combo of all three....

Two ENBTs and a router/bridge

One ENBT is the 'machine' ethernet...Drives, Flex I/O, etc. that are isolated to that machine.

Second ENBT is the 'process' ethernet....HMIs and other ENBTs on other racks for the entire plant.

The process ethernet is connected to the corporate ethernet via router/bridge.

robertmee said:

We're starting to do a combo of all three....

Two ENBTs and a router/bridge

One ENBT is the 'machine' ethernet...Drives, Flex I/O, etc. that are isolated to that machine.

Second ENBT is the 'process' ethernet....HMIs and other ENBTs on other racks for the entire plant.

The process ethernet is connected to the corporate ethernet via router/bridge.

Click to expand...

Why connect your process ethernet to the corporate ethernet? Do you have a virtual drawbridge on your router to isolate in the case of virus attack on the corporate LAN?

It's locked down. We use terminal services to bridge between the two. The reason for the connection is that any engineer on the corporate network can get to any plant network for remote access, development and troubleshooting. This is a worldwide setup across multiple facilities.

Oakley said:

Why connect your process ethernet to the corporate ethernet? Do you have a virtual drawbridge on your router to isolate in the case of virus attack on the corporate LAN?

Click to expand...

Agree with Oakley on this one.
Just keep what is tied to your machine control, process control isolated from the office ethernet.
In case of wanting to do data collection and such, do it locally (machine network) and ONLY give them what they may need via their network.

There will always be the need to pass information from plant to business in a fully automated facility whether for inventory, WIPs, formulations, QC, SAP, etc. I do not agree that you must keep them totally isolated. You must take precautions as you are absolutely correct, you don't want virus proliferation on a business network making its way to your plant control. But it is quite doable.

Here is a depiction of what I was referring to.





Note: the ControlLogix gateway allows access to the process LAN from the corporate LAN. The SCADA system will always have connectivity to the process LAN for control, data acquisition, etc. The process LAN is also isolated from the corporate LAN - provides better throughput (no print jobs, email, internet, etc inteferring), and is isolated from network virus attacks.

d21x said:

Yes, that is what I am thinking. First ethernet module networks between the Compactlogix, Panelview, RFID reader, etc. And the second ethernet module networking between Compactlogix and the network office for SCADA.

Click to expand...

This is what we did for a customer with a ControlLogix system. We used 2 ENBT modules. Works great.

We have a small process network here directly connected to the corporate LAN through a ENBT card, however we've been instructed that they need to be seperated by a router/firewall. Is there any special port forwarding I would need to get online and program PLCs if my laptop is present on the corporate LAN but the PLC is on the process LAN?

The path would go Laptop on 10.x.x.x to router, to ENBT on 172.16.x.x to DH+ network.