Industrial networks: CAN, industrial Ethernet, OPC UA and cybersecurity

A modern plant has thousands of measuring and control points spread over hundreds of metres. Connecting them one by one to the PLC with a pair of wires each cost enormously in cables and wiring errors; industrial networks carry everything on a few cables. Unlike office networks they must be deterministic: a command must arrive within a guaranteed time, always. In this lesson we look at the CAN bus with the proof of its arbitration and the trade-off between speed and length, industrial Ethernet and EtherCAT with a cycle-time calculation, OPC UA and plant cybersecurity.

The CAN bus

CAN (controller area network), born in the 1980s for cars, is used in cars, agricultural machinery, medical equipment and automation (CANopen). All nodes are on the same twisted pair, and the bus has two levels: dominant (0) and recessive (1). If even a single node transmits 0, the bus is 0: it is a wired AND. Every message starts with an identifier indicating its content and priority.

Theorem. If several nodes start transmitting together, the message with the numerically lowest identifier wins, and its transmission continues without any damage or delay.

Proof. Each node transmits the identifier starting from the most significant bit and compares each transmitted bit with the one read on the bus. As long as all transmit the same bits, the bus coincides with what each transmits. At the first bit where the identifiers differ, the nodes transmitting 0 see 0, those transmitting 1 see 0 (because dominant prevails): the latter detect the difference, stop transmitting and will retry later. The nodes left are those with 0 in that position and equal in all previous ones, i.e. with a lower identifier; repeating the argument on the following bits, only one remains, the one with the minimum identifier. For the winner the bus has always carried exactly its bits: its message has suffered no alteration. ∎

Unlike the original Ethernet, where collisions destroyed packets (Telecommunication Networks lesson on Ethernet), CAN collisions waste no time, and the most important messages have a computable maximum delay, with the same fixed-priority analysis as real-time systems.

Speed and length. Arbitration works only if every node sees, within the same bit, the dominant bit of the farthest node: the bit must last longer than the round-trip time of the signal on the cable, plus the transceiver delays. With about 5 ns/m of propagation, at 1 Mbit/s (1 µs bit) the maximum length is about 40 m; at 125 kbit/s it reaches 500 m. CAN FD increases the speed only in the data part of the message, after arbitration.

Industrial Ethernet

Ethernet has won in the factory too, with protocols guaranteeing its determinism: PROFINET, EtherNet/IP, EtherCAT, POWERLINK, and the TSN (time-sensitive networking) standard, which adds to ordinary Ethernet clock synchronisation (IEEE 802.1AS) and time windows reserved for critical traffic.

EtherCAT uses an elegant idea: a single frame leaves the controller and passes through all the nodes in a line; each reads on the fly the data addressed to it and writes its own into the frame as it passes, with a delay of a few hundred nanoseconds, without storing it. The frame returns from the last node with all the responses.

Example. 100 nodes with 8 bytes of data each: 800 bytes plus about 40 of header. At 100 Mbit/s transmission takes µs; add the node traversal delay, of the order of a microsecond per node counting both directions, and cable propagation. A complete cycle fits in about 200 µs: 800 inputs and outputs updated 5000 times a second, with a single frame.

OPC UA

At the upper levels of the pyramid (lesson on architecture) it is necessary to exchange not only values, but their meaning: units, ranges, alarms, machine structure. OPC UA (IEC 62541) offers an object-based information model, independent of manufacturer and operating system, with client-server and publish-subscribe services, and built-in security (authentication, encryption, signatures). Companion specifications define standard models for whole categories of machines (machine tools, robots, injection moulding machines), so an MES reads machines from different manufacturers in the same way.

Cybersecurity

Plants used to be isolated, and their protocols were born without authentication: anyone who reaches the network can send commands to a PLC. With plants connected to corporate networks and the Internet, attacks have become real (Stuxnet in 2010 sabotaged centrifuges by modifying PLC programs). The IEC 62443 standard organises the defence:

• division of the plant into zones with different security levels, connected by controlled conduits (firewalls, demilitarised zones between office and plant networks);
• no direct access from the Internet to field devices; remote access for maintenance only through controlled and logged points;
• authentication of users and devices, updates, an inventory of components;
• secure protocols where possible (OPC UA with encryption) and traffic monitoring, which in a factory is very regular and makes anomalies stand out.

In Europe the NIS2 directive and the Cyber Resilience Act make these requirements mandatory for many sectors and products.