Safety Controller Dual-Key Override for Cyber-Secure Maintenance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial safety controllers in maintenance override modes are susceptible to cyber-security risks due to prolonged exposure of input/output devices and processing equipment, allowing potential attackers to access and manipulate safety-critical systems during extended maintenance periods.
Innovation Solution
A safety controller with a dual-key switch system, featuring a dedicated FRC reset key-switch that allows immediate return to the FRC enable OFF position after maintenance overrides are cleared, reducing the maintenance override mode duration and thus minimizing the cyber-attack window from weeks to minutes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single key-switch is used for enabling maintenance override mode, then the ease of operation is improved, but the cyber-security risk increases due to prolonged exposure of safety-critical systems
Solution Approach 1:
The single key-switch is segmented into two separate key-switches: a first key-switch for enabling maintenance override mode and a second key-switch for disabling it. This segmentation allows independent control of enable and disable functions, reducing the time window for cyber-attacks by requiring separate actions for mode changes while maintaining operational ease through dedicated controls for each function.
2Productivity
If maintenance override mode is enabled for extended periods during plant overhaul, then the productivity is improved, but the device complexity increases due to additional security measures
Solution Approach 1:
By segmenting the key-switch into two separate switches, the system enables extended maintenance operations (improving productivity) while implementing a security measure that requires two distinct actions to enable and disable the override mode. This simple segmentation approach provides security without requiring complex authentication systems or additional security hardware.
3Device complexity
If a single key-switch is used for disabling maintenance override, then the device complexity is minimized, but the time required to remove active overrides increases
Solution Approach 1:
The disable function is segmented into a separate second key-switch, allowing operators to quickly disable maintenance override mode by simply moving the second key-switch without needing to navigate through menus or perform additional steps. This segmentation reduces the time to remove active overrides while keeping the device complexity low by using simple hardware switches.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
A safety controller 150 includes an interface circuit 157 coupled to IO devices coupled to field devices coupled to processing equipment, a primary controller 118a including a primary processor 119a and a secondary controller 118b including a secondary processor 119b each for implementing control loops that automatically take actions by sending control signals to the actuators, and a bus 154 coupling the interface circuit 157 and a mode-switching multi-key switch 200. The multi-key switch includes a force (FRC) enable key-switch 202 having a FRC enable On position for entering a maintenance override mode and an OFF position, and a FRC reset key-switch 203 having a FRC reset position for removal of maintenance overrides. Following entry of a first maintenance override and the FRC enable key-switch is then returned to the OFF position, there are no changes to the first maintenance override while new maintenance overrides cannot be added until the FRC enable key-switch is set to the FRC On position again.