Safety Controller Dual-Key Override for Cyber-Secure Maintenance

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Industrial safety controllers in maintenance override modes are susceptible to cyber-security risks due to prolonged exposure of input/output devices and processing equipment, allowing potential attackers to access and manipulate safety-critical systems during extended maintenance periods.

Innovation Solution

A safety controller with a dual-key switch system, featuring a dedicated FRC reset key-switch that allows immediate return to the FRC enable OFF position after maintenance overrides are cleared, reducing the maintenance override mode duration and thus minimizing the cyber-attack window from weeks to minutes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a single key-switch is used for enabling maintenance override mode, then the ease of operation is improved, but the cyber-security risk increases due to prolonged exposure of safety-critical systems

Engineering Contradiction:
Improveease of operationVSAvoidcyber-security risk
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The single key-switch is segmented into two separate key-switches: a first key-switch for enabling maintenance override mode and a second key-switch for disabling it. This segmentation allows independent control of enable and disable functions, reducing the time window for cyber-attacks by requiring separate actions for mode changes while maintaining operational ease through dedicated controls for each function.

Inventive Principle:
Principle #1Segmentation

2Productivity

If maintenance override mode is enabled for extended periods during plant overhaul, then the productivity is improved, but the device complexity increases due to additional security measures

Engineering Contradiction:
ImproveproductivityVSAvoiddevice complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

By segmenting the key-switch into two separate switches, the system enables extended maintenance operations (improving productivity) while implementing a security measure that requires two distinct actions to enable and disable the override mode. This simple segmentation approach provides security without requiring complex authentication systems or additional security hardware.

Inventive Principle:
Principle #1Segmentation

3Device complexity

If a single key-switch is used for disabling maintenance override, then the device complexity is minimized, but the time required to remove active overrides increases

Engineering Contradiction:
Improvedevice complexityVSAvoidtime to remove overrides
Core Design Contradiction:
Device complexityVSLoss of time

Solution Approach 1:

The disable function is segmented into a separate second key-switch, allowing operators to quickly disable maintenance override mode by simply moving the second key-switch without needing to navigate through menus or perform additional steps. This segmentation reduces the time to remove active overrides while keeping the device complexity low by using simple hardware switches.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP3416005B1Safety controller with cyber-secure maintenance override
Publication Date: 2021.12.22 HONEYWELL INTERNATIONAL INC
  • EP3416005B1 patent drawingFigure 1A~1B
  • EP3416005B1 patent drawingFigure 2
  • EP3416005B1 patent drawingFigure 3

AI summary

A safety controller 150 includes an interface circuit 157 coupled to IO devices coupled to field devices coupled to processing equipment, a primary controller 118a including a primary processor 119a and a secondary controller 118b including a secondary processor 119b each for implementing control loops that automatically take actions by sending control signals to the actuators, and a bus 154 coupling the interface circuit 157 and a mode-switching multi-key switch 200. The multi-key switch includes a force (FRC) enable key-switch 202 having a FRC enable On position for entering a maintenance override mode and an OFF position, and a FRC reset key-switch 203 having a FRC reset position for removal of maintenance overrides. Following entry of a first maintenance override and the FRC enable key-switch is then returned to the OFF position, there are no changes to the first maintenance override while new maintenance overrides cannot be added until the FRC enable key-switch is set to the FRC On position again.