1. Secure Wireless Plant ETSI Hell’s Kitchen. June 2008
Patrick Wetterwald Innovation Engineering Manager

2. Sensor Networks are everywhere … with an endless scope of applications
Defense
Energy Saving (I2E)
Predictive maintenance
Improve Productivity
Enhance Safety & Security
Intelligent Building
Enable New Knowledge
Health
High-Confidence Transport and assets tracking
Improve Food & H20
Healthcare
Smart Home

3. So far … WAS (Wait And See) - The current Trend
Honeywell
Wireless HART
TrueMesh
gateway
gateway
gateway
Znet
ISA SP100.11a
gateway
gateway
Internet / Intranet
Smartmesh
gateway
MintRoute
gateway
Xmesh
MultiHop LQI
gateway
gateway
gateway
CENS Route
gateway
gateway
TinyAODV
gateway
gateway
L2N
L2N

4. #/Scale of Connected Devices
Early opportunities will be in Industrial, Transport and Retail; Consumer apps will come later H
Residential
Transport
Power
#/Scale of Connected Devices M
Retail
Buildings
Industrial
Healthcare
First Wave of Adopters …..
Second Wave
Third Wave L 1 2 3
Time (Years Out)
Source: Harbor Research

5. Industrial Applications
Pressure
Process temperature
Chemical composition
Energy usage
Machine health
Tank level
Equipment status
Calibration
Energy usage
Process
Control
Maintenance &
Operations
Safety & Security
Poison gas concentration
Emergency showers
Perimeter security
Emergency lighting

6. Oil and Gas Savings of a 5-node installation:  700’ conduit
“…this wireless technology enabled us to do things we simply could not do before, either because of cost or physical wiring obstacles. Through the trials, we found that Emerson's wireless approach is flexible, easy to use, reliable, and makes a step-change reduction in installed costs."
“Wireless truly is faster and cheaper.“
“It just worked!”
Brandon Robinson
EnCana
Dave Lafferty BP
Savings of a 5-node installation:
 700’ conduit
3000’ wire
2 guys, 2 full days of labor
no trenching or surveying for buried cable

7. Emerson Industrial Monitoring
Emerson Process Management uses Dust Networks SmartMesh-XT products for their family of SmartWireless® products, which includes sensors that measure temperature, pressure, and fluid level and a gateway to connect to legacy process control systems
"Wireless promises to enable us to put more monitoring in the plant at one-tenth the cost of wired technology."
John Berra
President Emerson Process Management

8. Wireless means interferences

9. Industrial Facilities may have LOTS of Wireless
This facility has: , , , RFID, 2.4 GHz video, walkie-talkies, etc … 4 sq. miles in size.

10. A Secure Infrastructure for Multiple Applications
OSHA would like automatic notification of a safety shower being activated to go straight to Emergency Services so EMT’s can be deployed immediately to the correct location. In this plant there are over 1000 showers. Wiring costs would be enormous
Wireless sensors on a mesh network coming back into the system are the answer.
WiMax link backhaul or Point to Point
Up to 50KM, depending on bandwidth and environmental conditions
WiMax ‘bubble’ can surround entire plant
Approx. 5KM Radius
WiFi ‘hotspots’ give mobility to workers
Live Video, VoIP, Realtime Tracking, Remote Access to data/HMI etc.
These integrated technologies allow for:
Reduced personnel / less transport
Faster response / intervention
More mobility / better communications
Superior remote capabilities
Safer working environment

11. Wireless Architecture
Process Network
Control Network
Security Network
Plant Network
Cisco Outdoor Industrial Mesh:
Self-Organizing Mesh
Emerson Controller
Self-Organizing Mesh
– TSMP
– WirelessHart
Wireless Field Devices

12. IEEE802.11 b/g Physical layer Only 3 non-overlapping channels
14 channels, 5 Mhz channel spacing, 22 Mhz channel width
Only 3 non-overlapping channels
1, 6 and 11 in North America
1, 7 and 13 in Europe
802.11a (5 GHz band) not considered here
Cisco white paper:

13. IEEE802.15.4 DSSS Physical layer Physical channel usage
16 channels, 5 Mhz channel spacing, 2 MHz channel width
250 kb/s data rate
Physical channel usage
Channel hopping permitted but not required
Coordinated channel use permitted
Dust uses both Channel hopping and coordination (between channels)
Xbow uses only one static channel

14. WLAN and 802.15.4 in the 2.4 Ghz band Transmitter power [dBm]
-25
-20
-15 -5 5 10 15 20 25
2400
2412
2437
2483.5
(US)
-10
Frequency [Mhz]
Transmitter power [dBm]
2462
Channel 1
Channel 11
Channel 6 11 12 13 14 16 17 18 19 21 22 23 24 26

15. Radio co-existence issues
radiated power is 100 fold higher than
WLAN side-slopes always impact
channels falling in the guard band between channels (in purple) are also impacted
15, 20, 25 and 26 in North America
15, 16, 21 and 22 in Europe

16. Interferences simulations
Annex E.4.3 in standard
Results for non-coordinated/non hopping systems show that:
The and radios can not be mounted in the same rack (distance < 2m) even with large frequency offset
Low frequency offset requires 10’s of meters separation
Simulation results validated by Zensys study:

17. Interference simulations

18. ISA100.11a

19. Importance of message timeliness increases
Customer Requirements – SP100 Usage Classes
Usage classes of wireless data networks
Importance of message timeliness increases
Safety
Class 0 : Emergency action (always critical)
Control
Class 1: Closed loop regulatory control (often critical)
Class 2: Closed loop supervisory control (usually non-critical)
Class 3: Open loop control (human in the loop)
NOTE: Batch levels* 3 & 4 could be class 2, class 1 or even class 0, depending on function
*Batch levels as defined by ISA S88; where L3 = "unit" and L4 = "process cell"
Monitoring
Class 4: Flagging
Short-term operational consequence (e.g., event-based maintenance)
Class 5: Logging & downloading/uploading
No immediate operational consequence (e.g., history collection, SOE, preventive maintenance)
Alarms - Any class (human or automated action)
Wireless worker - Classes 3 – 5 (access is usually proxied)
For security, logging/accountability, and cache consistency, wireless worker access is proxied through the central control system
Exceptions may occur during commissioning and emergencies when local access may be required

20. Industrial monitoring and control
Today:
Competing standards,
Mostly wired fieldbuses
Ethernet/IP presence
CIP / EtherNet
Modbus/TCP
Foundation Fieldbus HSE
PROFInet
Invensys/Foxboro FOXnet
Wireless coming up
WiHART
One-wireless
ISA100.11a

21. ISA
Instrumentation, Systems, and Automation Society is a non-profit technical society for engineers, technicians, businessmen, educators and students, who work, study or are interested in industrial automation.
It was originally known as the Instrument Society of America.
ISA provides leadership and education in the instrumentation and automation industries, assisting engineers, technicians, and research scientists, as well as many others, in keeping pace with the rapidly changing industry.

22. ISA100.11a Working Group Charter
This project addresses:
low energy consumption devices, with the ability to scale to address large installations
wireless infrastructure, interfaces to legacy infrastructure and applications, security, and network management requirements in a functionally scalable manner
robustness in the presence of interference found in harsh industrial environments and with legacy systems
coexistence with other wireless devices anticipated in the industrial work space
interoperability of ISA100 devices

23. ISA100.11a key features Hybrid FHSS DSSS IPv6 and backbone Extensible
reused from TSMP/WiHART
Interference mitigation
IPv6 and backbone
Scalability, Scope
Open protocols, COTS
Network Convergence
Extensible
New PHYs (802.11LP, a CSS)
New app layers (WiHART)

24. ISA100.11a, IP technology and IETF
ISA a endorsed 6LoWPAN
IPv6 packets but not stack (ND, ICMP)
And the transit link is not covered yet
Really need draft-hui for better compression
Backbone Router 6LoWPAN
Proposing an IPv6 based best practice
To promote full IPv6 in ISA100.11a
And WSN in general by contagion
Have chairs and partners support
Also I-D on fragment recovery
6LowPAN sends up to 25 fragments
Over multihop lossy radio
=> Need Flow Control and recovery

25. IP Networking Technology for Industrial Automation

26. IP core Technology applies: The network as a standardized open “system”
Architecture Framework
Application Networking
Eventing, Location, Data Replication and Virtualization
Network Security
Virus Protection, Intrusion Detection, Attack Mgmt
Device Security
Authentication, Rogue Detection, Encryption
Management Plane
Scalability, Availability
Scalability, Availability
Discovery, Diagnostics, Inventory, Fault Isolation
Intelligence in the Network
Intelligence in the Network
Cisco’s core technology can help drive the business innovation that will support all the intelligent information network “interactions” that occur at the “edge” of the network through converged instrumentation.
Data Plane
Network Forwarding Path -
Filtering, QoS, Traffic Engineering
Provisioning and Configuration
Device Identification, Location and Personalities
Connectivity
802.11, , 802.3, 802.3af,
Cisco Confidential – Harbor Research Confidential

27. Virtualization needed
Virtualization: 1 to Many or Many to 1
One network supports many virtual networks
Process Control Network
Virtual
Office Domain
Virtual
Plant Control Domain
Virtual
Actual Campus LAN

28. IP to the Sensors Think of VoIP as a model… …but for a great many…
New services and applications
M2M, remote management
New Markets
Process Control for factories
Control and Automation
for home, building, cities
Larger Core Market
Open standards to the sensor
Lower cost
More connected devices and new applications
A wider Internet
Shaping the future
Internet of things
Think of VoIP as a model…
…but for a great many…
…of tiny devices, everywhere.

29. The golden path Vision Steps Progress
Sensors and actuators using Internet technology
That’s Billions of devices in the next 10 years
Enabling new services and applications
Steps
Forming an alliance: IPSO (IP for Smart Objects)
IP for automation open standards (ISA100.11a)
Introduce sensors at IETF (6LoWPAN and ROLL)
Apply standards where needed (home, building, power grid)
Progress
ROLL requirement WG docs
6LoWPAN RFC 4944 now rechartering for ND
ISA100.11a targeted YE’08

30. IPSO (IP for Smart Objects)
Objectives of the Alliance
Promote the use of IP in Smart Objects by publishing white papers, case studies, issuing technology press releases, providing updates on standards progress and other supporting marketing activities
Organize focused interoperability testing events
But - the Alliance will NOT work on protocol specifications, algorithms, etc. – those activities will be done at the IETF and other standard organizations… ! 30

32. What is the HART protocol
What is the HART protocol? (Highway Addressable Remote Transducer Protocol)
Early implementation of Fieldbus. One of the most popular today.
Uses 1200 baud Frequency Shift keying (FSK) based on the Bell 202 standard to superimpose digital information on the conventional 4-to-2OmA analogue signal.
Maintained by an independent organization, the HART Communication Foundation, the HART protocol is an industry standard developed to define the communications protocol between intelligent field devices and a control system.
HART is the most widely used digital communication protocol in the process industries, with over eight million HART field instruments installed in over 100,000 plants worldwide.
HART is supported by all of the major vendors of process field instruments
HART preserves present control strategies by allowing traditional 4-to-2OmA signals to co-exist with digital communication on existing two-wire loops.
The HART Communications Protocol (Highway Addressable Remote Transducer Protocol) is an early implementation of Fieldbus, a digital industrial automation protocol.
HART’s claim to fame is that it can communicate over legacy 4-20 mA (A "mA" is a milliampere, or 1/1000 of an ampere) analog instrumentation wiring, sharing the pair of wires used by older field instrumentation systems.
According to some, due to the huge installed base of 4-20 mA systems throughout the world, the HART Protocol is one of the most popular industrial protocols today.
Analog current loops are used for any purpose where a device needs to be either monitored or controlled remotely over a pair of conductors. Only one current level can be present at any time.
4-20 mA is an analog electrical transmission standard for industrial instrumentation and communication. The signal is a current loop where 4 mA represents zero percent signal and 20 mA represents the one hundred percent signal.
The "live zero" at 4 mA allows the receiving instrumentation to distinguish between a zero signal and a broken wire or a dead instrument. This standard was developed in the 1950s and is still widely used in industry today.
Benefits of the 4-20 mA convention are that it is widely used by many manufacturers, relatively low-cost to implement, and it can reject many forms of electrical noise.
The protocol was developed by Rosemount Inc. in the mid-1980s as proprietary digital communication protocol for their smart field instruments. Soon it evolved into HART. In 1986, it was made an open protocol. Since then, the capabilities of the protocol have been enhanced by successive revisions to the specification.
There are two main operational modes of HART instruments: analog/digital mode, and multidrop mode.
HART was built off the Bell 202 early communications standard.
The “live zero” also allows low-power instruments to be directly powered from the loop, saving the cost of extra wires. Current loop is also much easier to understand and debug than more complicated digital fieldbuses.
Using fieldbuses and solving related problems usually requires much more education and understanding than required by simple current loop solutions.
Additional digital communication to the device can be added to current loop using HART Protocol. Digital process buses such as fieldbus and Profibus may replace analog current loops.

33. HART

34. WirelessHART™ Specification Released for Approval
New technology establishes wireless communication standard for process industry applications
(Austin TX USA – 17 April 2007) - The HART Communication Foundation (HCF) announces the completion of draft specifications for Wireless HART™ Communication and their release to HCF member companies for review and approval.
Wireless HART is the first open and interoperable wireless communication standard designed to address the critical needs of the process industry for reliable, robust and secure wireless communication in real world industrial plant applications.
“The combination of HART plus wireless is a major step for the industry. Wireless HART provides new capabilities for users to get information on process parameters and to monitor the performance of plant assets in areas that have previously been technically or cost-effectively difficult to achieve,” says Ron Helson, HCF Executive Director. “Wireless HART ushers in the next major technology life cycle and makes possible the next generation of HART-enabled productivity solutions.”