Control System Devices: Architectures and Supply Channels Overview
Total Page:16
File Type:pdf, Size:1020Kb
SANDIA REPORT SAND2010-5183 Unlimited Release Printed August 2010 Control System Devices: Architectures and Supply Channels Overview Moses D. Schwartz, John Mulder, Jason Trent, William D. Atkins Prepared by Sandia National Laboratories Albuquerque, New Mexico 87185 and Livermore, California 94550 Sandia is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the US Department of Energy's National Nuclear Security Administration under Contract DE-AC04-94AL85000. Approved for public release; further dissemination unlimited. 1 Issued by Sandia National Laboratories, operated for the United States Department of Energy by Sandia Corporation. NOTICE: This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government, nor any agency thereof, nor any of their employees, nor any of their contractors, subcontractors, or their employees, make any warranty, express or implied, or assume any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represent that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government, any agency thereof, or any of their contractors or subcontractors. The views and opinions expressed herein do not necessarily state or reflect those of the United States Government, any agency thereof, or any of their contractors. Printed in the United States of America. This report has been reproduced directly from the best available copy. Available to DOE and DOE contractors from U.S. Department of Energy Office of Scientific and Technical Information P.O. Box 62 Oak Ridge, TN 37831 Telephone: (865) 576-8401 Facsimile: (865) 576-5728 E-Mail: [email protected] Online ordering: http://www.osti.gov/bridge Available to the public from U.S. Department of Commerce National Technical Information Service 5285 Port Royal Rd. Springfield, VA 22161 Telephone: (800) 553-6847 Facsimile: (703) 605-6900 E-Mail: [email protected] Online order: http://www.ntis.gov/help/ordermethods.asp?loc=7-4-0#online 2 SAND2010-5183 Unlimited Release Printed August 2010 Control System Devices: Architectures and Supply Channels Overview Moses D. Schwartz, John Mulder, Jason Trent, William D. Atkins Critical Infrastructure Systems Department 5628 Computer Sciences Department 5621 Sandia National Laboratories P.O. Box 5800 Albuquerque, New Mexico 87185-0671 Abstract This report describes a research project to examine the hardware used in automated control systems like those that control the electric grid. This report provides an overview of the vendors, architectures, and supply channels for a number of control system devices. The research itself represents an attempt to probe more deeply into the area of programmable logic controllers (PLCs)—the specialized digital computers that control individual processes within supervisory control and data acquisition (SCADA) systems. The report (1) provides an overview of control system networks and PLC architecture, (2) furnishes profiles for the top eight vendors in the PLC industry, (3) discusses the communications protocols used in different industries, and (4) analyzes the hardware used in several PLC devices. As part of the project, several PLCs were disassembled to identify constituent components. That information will direct the next step of the research, which will greatly increase our understanding of PLC security in both the hardware and software areas. Such an understanding is vital for discerning the potential national security impact of security flaws in these devices, as well as for developing proactive countermeasures. 3 Page intentionally blank 4 CONTENTS 1. INTRODUCTION.............................................................................................................................. 9 1.1 Background ................................................................................................................................................. 9 1.2 Purpose ....................................................................................................................................................... 9 1.3 Scope and Methodology ............................................................................................................................. 10 2. CONTROL SYSTEMS OVERVIEW .............................................................................................. 11 2.1 Control System Components ....................................................................................................................... 11 2.2 Typical Control System Architecture ........................................................................................................... 12 2.3 Programmable Logic Controllers ................................................................................................................. 13 3. INDUSTRY OVERVIEW ............................................................................................................... 16 4. PLC MARKET OVERVIEW .......................................................................................................... 17 4.1 Siemens ...................................................................................................................................................... 18 4.2 Rockwell Automation ................................................................................................................................. 19 4.3 Mitsubishi Electric ...................................................................................................................................... 20 4.4 Schneider Electric ....................................................................................................................................... 20 4.5 Omron ........................................................................................................................................................ 21 4.6 B&R Industrial Automation ......................................................................................................................... 22 4.7 General Electric .......................................................................................................................................... 22 4.8 The ABB Group ........................................................................................................................................... 23 5. CONTROL SYSTEM COMMUNICATIONS PROTOCOLS ...................................................... 24 5.2 Electric Sector ............................................................................................................................................. 24 5.3 Oil and Gas Sector ...................................................................................................................................... 26 5.4 Water Sector .............................................................................................................................................. 26 5.1 Building Automation Sector ........................................................................................................................ 27 5.5 Process Automation (Manufacturing) Sector ............................................................................................... 28 6. PLC COMPONENT ANALYSIS .................................................................................................... 32 6.1 Methodology .............................................................................................................................................. 32 6.2 Siemens Simatic S7‐200 .............................................................................................................................. 33 6.3 Honeywell Experion C200 Process Controller .............................................................................................. 37 6.4 Allen‐Bradley Logix 5561 ............................................................................................................................. 44 6.5 Allen‐Bradley MicroLogix 1100 .................................................................................................................... 50 7. SUMMARY ....................................................................................................................................... 53 8. REFERENCES .................................................................................................................................. 55 APPENDIX A: CONTROL SYSTEM MODEL .................................................................................... 56 APPENDIX B: VENDOR SURVEYS .................................................................................................... 57 APPENDIX C: ACRONYMS .................................................................................................................. 69 5 FIGURES Figure 1. Typical control system architecture. ............................................................................................ 12 Figure 2. Generic modular PLC architecture. ............................................................................................. 14 Figure 3. Chart