Contrologix through the Internet

[jimdi4 2]

Hello, I have gotton a proposal for a job where "if the customer gets a phone call in the middle of the night that his process has a problem he could get online through the internet and fix it at home"... ...his process is being spec'd out with a new Contrologix and RSView ME... I believe i need to have a DHCP sever onto an in house Intranet, that takes the intranet through a Router/Firewall to the internet... I have set up numerous PLC's with Contrologix but never had any request to tie the network to the internet for distant troubleshooting. I had set up PLC 5's and SLC's 500 with analog phone lines and modems but I'm new to the Internet protocol for PLC distant trouble shooting and setup. Anyone offer any suggestions...What additional software or advice can you give....Since this is a proposal I can switch things around now, I was doubtlful the RSview ME can do this, but I don't know for sure..Would RS view supervisory be cleaner? Edited 30 Apr 2008 by jimdi4

[paulengr 44]

For the front-end side of things, the safest way to do this is with VPN, which is where you run a piece of software to tunnel through the internet and connect your machine to the corporate network. As soon as you google for VPN, you will find plenty of free and non-free software to do this function. You will need one server running in the DMZ (unprotected zone of the firewall) to serve as the VPN server. Some of the software that does this will auto-load itself so there's no installation involved. ME can't do it by itself. But you can get a "Station" license which is essentially just the RS-View ME software/license as a PC application instead of being embedded in the Windows CE box. Here are three alternatives. First, skip RS View ME and go for a CTC Parker HMI. The box is essentially nothing more than an Adobe Flash system (InteractX). You program it by connecting to it with your web browser and you can set up supervisor accounts...supervisors can look at the same screens as the operators via it's internal web browser. It just downloads the Flash application onto their PC when they connect. So everyone is using the exact same interface all the way around. This backend interface is free since it's just a function of the CTC HMI's. Second alternative is to put either a real PC or a "thin client" out on the plant floor instead of RS View ME. I like Inductive Automation's software but you can usually get "web based" stuff from any other HMI vendor. With FactoryHMI, you connect to the HMI server via applet or via a desktop app (which auto-installs from a browser link). The software+hardware is about the same price as FactoryTalk Studio ME + one 10" Panelview Plus. In this configuration, you can make the plant floor machine an industrial PC, or you can buy for instance a Neoware (now part of HP) C50 and run Firefox directly on the C50 with Java. In this configuration, instead of a thin client (basically a server running a mutli-user version of Windows and treating the plant floor hardware as a graphics terminal), you run "serverless"...the plant floor PC connects to the FactoryPMI server directly and runs "bare hardware" (no real operating system outside of Firefox/Java). It's very secure because normally you boot directly into the web/Java site with no desktop or other features available. Boot up time is also very quick compared to industrial PC's running Windows. Later if you want to upgrade to a more traditional HMI/SCADA system, you're already done with FactoryPMI. It is a direct competitor in terms of features and functionality to RS-View SE. With InteractX, you just get their "level 2" version and your existing HMI development will convert straight over to the full blown system. I already have a huge Cimplicity installation here (another competitor to RS-View SE). At this point it would be very costly to switch over so I'm already testing the waters with the above Neoware ("thin client") boxes. So far it is working out very well. If I need a console-based version, I can run those on the thin client server. Anything else that can go 100% web based can also be used without modifications to the hardware. The hardware is so cheap (except for industrial displays) that it's disposable (we do not attempt to have it repaired).

[jimdi4 2]

>First I want to thank you Paul for all your suggestions and thoughts and speedy responses, very good ideas..I am learning at a rapid rate here and I found some things... For the front-end side of things, the safest way to do this is with VPN, which is where you run a piece of software to tunnel through the internet and connect your machine to the corporate network. As soon as you google for VPN, you will find plenty of free and non-free software to do this function. I saw something called Fortinet any thoughts on using this for the VPN? You will need one server running in the DMZ (unprotected zone of the firewall) to serve as the VPN server. Some of the software that does this will auto-load itself so there's no installation involved. What about PC anywhere? Here are three alternatives. First, skip RS View ME and go for a CTC Parker HMI. I do have experinece using CTC parker stuff, and I like that idea, but we are tryingt to keep the same supplier, Allen Bradley as the overall platform....I used the CTC without the Flash system but with a hardrive... Edited 1 May 2008 by jimdi4

[Nathan 7]

Paul's responses were solid with respect to running HMI/SCADA applications remotely. I think you have a few other things to consider based on your OP. 1. Having a technical Engineer/Integrator troubleshooting the process at home is more likely to require access to the PLC programming software than the HMI (which may or may not be working). 1a. A VPN connection would get the remote computer on the network. The host could run PLC programming (or any) software locally and connect to the process. 1b. Running remote control software to a PC that has the correct applications set up is also possible. PCAnywhere or Gotomypc are an option. If you have a network connection already (VPN) then you can have this service by running Remote Desktop, VNC, or Dameware. I prefer the latter options for reasons concerning security and flexibiliy. Keep in mind that a remote user won't work effectively in the middle of the night unless everything is already installed and configured. 2. RSView SE is more of a distributed application, meaning that you could install the software on other remote machines and expect central project changes to propogate. I think ME is more about Panelview Plus integration. I've heard some nasty things about RSView SE from integrators who really like (and still use) the old single user RSView 32. I've also heard cases of it working well. I recommend that you do your homework with respect to the software versus your requirements and evaluate it if possible. 3. A simple VPN solution is to get a home/"small business" router that acts as a VPN endpoint. A Windows 2003 Server with 2 network cards also works really well. Neither are too difficult to set up. Much depends on your infastructure. I don't think DHCP has anything to do with what you're talking about.

[BobLfoot 302]

Let me say that during my time working for a System Integrator we used several different schema for remote access. By far the best and most reliable was the VPN or RDP option where the PLC Programming Software and any HMi software was running on a PC within the local intranet of the PLC and we used remote access from our PC to control it.

[finfin 0]

If you already are going to have a computer dedicated and permanently connected to the system with RSLinx and all of the other software installed... then a "PCAnywhere" or a "Gotomypc"type connection would be fine. Otherwise I would loose that extra software (the PCAnywhere type) link and have all of the RS-software on my company laptop and take it home every night. Secondly; the VPN is much nicer IF YOU HAVE A HIGH SPEED INTERNET CONNECTION AT HOME. If not... I would use a RADES modem or RADKIT modem depending on what I was connecting to.

[BobLfoot 302]

in my experience Rockwell Software on the PC at work and remote into it runs circles around the Rockwell Software on the same laptop connected from home. It has to do with bandwidth and amount of data being sent. And yes I was using a 1.5 mb DSL.

[Nathan 7]

That's unfortunate, but probably true. I wouldn't conclude that as the general case, but I've heard that about Rockwell Software before. It's amazing how tight recent versions of RDP run. I've had positive experiences in a SEVERELY bandwidth constrained environment. Almost enough to convince those geeky shell based users I strongly second BobLfoot's advice on both posts - his experiences as an integrator getting remote access to customer sites sound nearly identical to mine. You really don't want to get billed for connecting and configuring time when a slick setup beforehand can greatly expedite remote troubleshooting. Too much is at stake. finfin - could you give more details about the RADES modem and RADKIT. Edited 2 May 2008 by Nathan

[paulengr 44]

There are so many ways of implementing VPN that the reason I didn't even mention any particular brand or model or anything is because of this problem. The original post was talking about Panelview Plus (ie, RS-View ME). The only thing that RS-View ME preserves is the "look and feel" of the Panelview Plus programming interface, which is trying to preserve the "look and field" of Panelbuilder, which isn't necessarily a good thing. I can't think of a good way of making this "internet accessible" with the possible exception of running Station ME on a PC and using VNC or Dameware to screen scrape it. With CTC Parker, you preserve the Panelview Plus model (plant floor machines) but pick up the ability to access it remotely through a "zero install" interface, which also means there are very low administrative costs. If you are going to use a full blown SCADA/HMI package, RS-View SE wouldn't be my first choice for the reasons Nathan suggested. RS-View SE is sort of the Windows Vista of the HMI world...it is universally disliked by pretty much everyone except Rockwell, but at least on the current version, it's not "bad". There are only a few bugs and issues to work around. Plus, it does not natively support web-based (zero install) remote access. So it fails to meet the requirements at least with the basic system. So I suggested FactoryPMI as an alternative specifically because it is the best HMI package for the intended audience (remote end users). If it was my shop, I'd be recommending Cimplicity Webview licenses simply because we already have a SCADA system (Cimplicity). The others (Wonderware, Citect, Fix, RS-View) do offer some sort of remote access system with additional licenses. But if you haven't even bought a system and your intention is specifically for remote users and plant floor users, then I'd start right out with an HMI that is specifically designed for that environment.

[jimdi4 2]

Thanks everyone for your input. I am glad to see the "High End" people "chimed in" with responses... When I grow up I want to be like you guys... Again Thanks!

[bguinn 0]

I use a program called Logmein. It is a free remote desktop similar to PC anywhere. The only problem you have to have a PC running the needed software any licenses. It was a free download and is somehow connected to my email address. Depending on how strong the companies firewall is you could remote desktop without them going thru the trouble of setting up a VPN. I only need an ethernet connection. Just go to www.logmein.com, and see if it is what you are looking for.

[Nathan 7]

Ha ha, you to recommend FactoryPMI twice without my prompting! Everyone knows it's my favorite - I thought I was carrying the banner alone! We do seem pretty well aligned lately, despite the fact that we keep commenting on each others comments.

[finfin 0]

Nathan, The radkit modem is AB's industrial strength modem that connects serially to the PLC. The RADES modem is an AB modem that connects to the PLC's via Ethernet. This will connect to 4 PLC's or HMI's directly through its 4 Ethernet ports and may also serve as a 4 port switch.

[Nathan 7]

Thanks for the info - I have a few more questions. Do you generally connect directly with a PC modem, or via a PC serial port and another similar radkit/RADES? Would you then set up a direct connection via RSLinx? Do they support permanent connections/demand dialing/round robin schemes, etc? What kind of security does it support to protect against a "war dialing" attack?

[finfin 0]

The RADES modem requires a user name and password to get past the modem. The radkit does not. I generally connect via my Internal Modem. If you want to configure the remote modem, I think you need to connect with a local radkit connected serially to your PC. I have never connected a PC directly to a local RADES modem. ... might be fun. Round Robin... you can call up a RADES (Ethernet connected) modem and see the network. A radkit (serial connected) lets you see one PLC (or HMI), the PLC may be setup for passthrough to other nodes on that PLC's network; but that would rely completely on that PLC. I hope that helps.