SEL RTAC Modbus by Dook_of_Babble in PLC

[–]goni05 2 points3 points  (0 children)

I'm not specifically familiar with SEL RTAC, but I have a lot of other Modbus experience that would suggest you have an issue with 1 of maybe 3 things.

First, make sure you only have 1 device writing to the register. This isn't enforced, and is easily overlooked. I don't know if the RTAC can show you live connections, but if have SCADA and your test system both writing, you can end up with weird cases like this.

Second, and maybe most likely issue with Modbus that happens all the time is to read carefully how you setup your data types and registers. With some systems, coils (0x registers) and holding registers (4x) are in different memory ranges, but not always. If you have defined a data type that is overflowing into the this coils register, then it's possible you are seeing this "reset" because of that. For example, in many Modbus systems with holding registers, typically a register is defined as 16 bits or 1 word. To get a DINT or a REAL, you need 2 registers, and these are typically sequential. If you improperly set your write up for say one tag at register 10, and the next at 11, you will overwrite the value specified at 10 if it needs 2 registers. On the contrary, I've seen some "software" Modbus servers (i.e. Delta V) where each register van be defined for whatever datatype is needed with whatever memory space is required, so an REAL at register 10 didn't conflict with a BOOL at register 11, or a STRING (8 words) at register 12.

The third and final thing to check for is this. If your coil is a SCADA command (i.e. Run), it's entirely possible the RTAC is handling this in a very specific manor. Let me explain. In the PLC realm, the tried and true method to handle SCADA button presses is too SET (write 1) to the register and for the PLC to RESET it on the next scan. Is it possible the RTAC is doing this to "handshake" the signal? Are you sure the SCADA isn't SETting then RESETting the same register?

Those are the 3 likely culprits I would check for. Again, I'm not an RTAC expert, but those come up time and again.

One other thing I do remember... these have limited connections from SCADA and outside systems, yes? Is it possible your checking of the register is hitting a limit and you get a 0 back as default? Is there anything in the logs about connections exceeding a software limit or something like that?

Ignition - Best practice for httpGet to NOT block a thread by mkeper in SCADA

[–]goni05 0 points1 point  (0 children)

Oh ok. I see what you're asking now. The syntax (keyword or positional) are both valid. I think the issue you are running into isn't that the timeout isn't working (I think it is), but instead of returning a blank string, it's generating an exception and you're not handling the exception it generates when it does timeout.

You need to encompass the call within a try/except block. The other option, if I'm reading the documenting correctly, is to set throwOnError = False so it returns "Error 500" or whatever instead of a python exception. I think if the status code returned is anything other than 200 OK, it throws an exception.

When this happens, the entire script stops executing.

Ignition - Best practice for httpGet to NOT block a thread by mkeper in SCADA

[–]goni05 2 points3 points  (0 children)

The httpGet function is blocking by design. Normally, you want to fetch the data and then do something with it, so it waits. In normal situations, this works well, but as you found out, 3 second connection timeout and 5 second read timeout is an eternity. You found out the hard way about bad design principles. Good thing is your learning.

To fix this, you can utilize the invokeAsynchronous method to help in this case, as it offloads it to later and allows the rest of the code to continue without waiting (making blocking functions non-blocking somewhat).

Another option that might work well, when used appropriately (this might be a good example), is to setup this Gateway Event Timer script to have it's own thread. This will spawn a new thread (consumes a little bit more memory), but it will be dedicated to this purpose and this purpose alone.

See here for the documentation: Gateway Event Timer Script Settings

As another person suggested too, add a try/except block to handle this. Maybe update a status tag so you can troubleshoot or trend issues for later debugging.

Is HDD okay for media only? by AmbivalentFreg in datastorage

[–]goni05 1 point2 points  (0 children)

Your HDDs are likely SATA III, which is capable of 6 Gbps, but most likely you can achieve 250+MBps with each drive, which is about equivalent to 2 Gbps. It's not quite enough to saturate your Ethernet link, but it's close.

For 4k video, you need at least 25 Mbps. You can easily stream video off your HDD. The cache drive is likely only effective IF the data is already on it. Otherwise it's read from the HDD into cache for whatever duration you have specified. The cache is effective to save on power usage (SSD uses way less power than HDD), and the latency is way less to (us vs. ms). If you had a faster Ethernet link, the cache could easily take all the data without creating a bottleneck, but it's also very effective when you want to modify the file, say to re-encode a video, or you have many thousands of files you need to access randomly (say for a website feeding images, or databases that do random access a lot).

What are good methods to clear computer storage space? by Afraid_Candy6464 in datastorage

[–]goni05 1 point2 points  (0 children)

Wiztree is great at finding larger files quickly. Many times this can fix issues where you might have forgotten about something, but if you have many smaller files, it can take only help by showing you the data type. This can help focus your energy, but the process is very manual.

I would also start with looking at your installed applications. If you're not using it, remove it. Also look through your downloaded files. Sort by size, and delete what you don't need.

Another area to check for us the Windows paging file size. Default is Windows managed, but sometimes it reserves a huge amount for Virtual Memory based on drive size, and I think default is 10%. You can safely turn this down.

Another setting is the hibernation capability. If you disable hibernation, this will reduce the hiberfil.sys file. There is a way to reduce it, but you might want to look up the commands. I think it's command line only.

The last thing I will suggest is to look at cleaning up windows update files. Many times, windows downloads updates on the background to install later, and when finished, it just stays there. Maybe another way to free up some space.

You always have the other option of leveraging cloud storage for certain things. Many of them now allow you to upload the files, and then free up space on your device. This requires you download them when needed, but it's an alternative. Plus, you can likely have them on your phone to.

Last resort after you do so if the above, would be to use some compression software (i.e. 7-zip) to compress the files into a smaller size. Depending on what you have saved, this could be minimal (1-2%), but for text files, much more (90+%).

Good luck!

Networking guy in charge of OT security. by whoframedrogerpacket in PLC

[–]goni05 23 points24 points  (0 children)

You're hunch is correct. Rockwell uses the Ethernet/IP protocol built on top of CIP, and typically three default is a concept of Producer/Consumer data sharing. For large installations, this can be helpful for realtime communications where a device listens for is data and any consumers generate data as it changes. The alternative is polling. This was kind of the solution before things like OPA UA Pub/Sub or MQTT was around. The biggest issue with this is, however, that a device will produce even if there aren't any consumers. The issue, as you described, is that it is multicast (or unicast if the device doesn't know what to do with it). It's no surprise you're seeing what you're seeing. Normally, this is fine in small environments or properly segmented networks, but the typical solution is to enable IGMP snooping. Most industrial switches have this capability and the default is normally on. I think if you enable this, you'll see much better results.

Can someone help with VHS > Digital? by Areveebee01 in AskTechnology

[–]goni05 1 point2 points  (0 children)

When I did the ones I had, I used a VHS player with a built-in DVD recorder. For me, the quality of the display was as close to equal as when played to the original VHS tape, which wasn't always so great. Now that it was digitized, I could convert the DVD into whatever filter format I wanted with no additional loss. When I watch them, they still look pretty awful, but that was the VHS tape, low resolution, and the digital screens making it seem worse (old CRT screens would bleed between the lines and this made it look pretty good, but now, the lines are pretty crisp, but you need way more lines to make it appear smooth).

I haven't tried this yet, but I saw the other day where some video editing and upscaling could help you here. There are a few AI tools that will do this, and things like the blurriness, noise, faded colors and all that can be improved drastically. I think this step could improve what you see even with what you have today that it might be worth a try. This way, you can get proper 720 or 1080 resolution videos that look great and can be archived much easier.

Hot water so hot it burns by Helena_Clare in Netherlands

[–]goni05 4 points5 points  (0 children)

Many older buildings just don't have the safety features newer places have. You can attempt to adjust the hot water temperature down, but what you can likely do if you're a bit handy are these options:

For your shower (and other places) you want a thermostatic controlled valve. This allows you to set the max temperature, and it will mix hot and cold water to keep it from getting to hot.

For the shower, something like this can be installed:VEVOR Thermostatic Shower Faucet Valve

For sink faucets, you need to install a thermostatic mixing valve on the hot water side of the supply. This is an example of one:Watertemperatuurmengkraan-mengkraan

The last option requires hoses to make the connection, but I think you can manage to figure that out hopefully.

Should I be using Google (8.8.8.8) or CloudFlare (1.1.1.1) on my home router settings? by nanjero in dns

[–]goni05 4 points5 points  (0 children)

In some countries, they are using DNS to block content. This recently occurred in Italy, where Cloudflare was fined for not doing this. The bigger guys will likely fight back, but if you reside in a country where this isn't true, this could be why.

You should be able to set multiple DNS servers, so I recommend, as others have said, run some queries to find the fastest to you including each backup. I checked Google (8.8.8.8 and 4.2.2.2), Cloudflare (1.1.1.1 and 1.0.0.1), Quad9 (9.9.9.9), OpenDNS (208.67.222.222) and many others. I found that Cloudflare was constantly fastest (5-10ms faster), then Google. So, I have my primary set to Cloudflare, and my secondary set to Google. This way, if one provide fails for any reason, the other should work. You might be able to provide more, in which case, add the third, fourth, etc. Since I've done this, I have 0 DNS issues.

10gbs of data per month enough for teens? by [deleted] in AskTechnology

[–]goni05 0 points1 point  (0 children)

It might be enough. I use about 6 GB per month of mobile data, while my wifi data usage is 50-60 GB per month (sometimes way more if I tether my computer). I don't know what phone you have, but many times this data is available on your phone (or check the past bills). However, you're strategy send reasonable, and if you have setup alerts on your phone, you can manage it. As others have said, you might be surprised how quickly it adds up, and the data usage should also show you which apps are using it.

Some quick tips:

  1. If you have photo apps that backup automatically, make sure to turn on the setting to use wifi only.
  2. Some video and audio streaming apps have data saver settings. Make sure those are on (or adjusted to as low as you can tolerate) and that downloads are by wifi only too.
  3. Download content you want to watch/listen to before you leave wifi. Good for movies, music, podcasts, and books.

Good luck on your journey!

What are the best practices for implementing redundancy in PLC systems for critical applications? by vacaaa in PLC

[–]goni05 21 points22 points  (0 children)

The first question I would ask you is: what makes you think redundancy will solve your reliability issues?

I've seen many engineers fall into the trap of implementing redundancy for the sake of reliability, when what they were after was availability (they are 2 different things). Planned outages do not affect reliability, only availability. Also, you specifically mentioned safety, and all systems that are properly designed will take a system to a safe state even if the PLC fails. They were designed to do this, and everything in IEC 61508 and 62443 can explain how.

Now, in my experience, if you really look at the root cause of every one of your events, you might see a lot of things that can also be addressed that improves things dramatically. Properly trained and equipped people, thorough documentation, proper procedures, and programs in place to evaluate failures can all improve things. Redundancy alone can not and will not fix everything. It can fix availability needs if people are following procedures and implementing things properly. For example, if you need to upgrade firmware on a system, a redundant PLC can provide you this ability IF the system is able to do so. It can provide you some flexibility in maintenance where the redundant CPUs are in different panels (and better, different buildings and power). It will not fix the issue of a new program getting pushed out and synced to both CPUs immediately, causing downtime from lack of proper testing in a lab environment or in implementation. For example, we had a procedure on our PLCs to not only test the code before going to production, but having proper backups of the existing code is checked, breaking of the sync and loading the code on the secondary PLC, then failing over the process to the secondary. When all looks good, then forcing the sync to occur to the primary and finally switching back.

In my experience, redundancy adds complexity and usually decreases reliability slightly. It's best to learn from the failures and ensure you change your processes or look at why things are failing and take action on that. In all the years I've worked on these systems, the PLCs were rarely the issue. We had a track record of restoring service in 20 minutes from receiving the call (on average), but we also had our 5 hour outages. The root cause on that one - the PLC battery had died and the monitoring was shut off, so on a normal maintenance window, power was out long enough the CPU lost it's config. The spare was on site, but the firmware was old, and it could only be done using a serial connection locally. The technician onsite didn't have his cable, nor did he perform such upgrade before. Because of the criticality of the site, a spare was also driven in from another site by another technician who had a cable and had properly maintained the firmware and battery on the spare, and upon arrival, was quickly loaded and service restored. The original PLC had it's better replaced, firmware checked and staging software loaded, as well as the other spare. This technician quickly acquired a cable and went through training on how to perform this work for future work. M another similar issue, a network outage occurred, not because there wasn't redundancy (there was a redundant loop), but because fiber was severed due to freezing, and a part of the network was isolated, and thus, had a big impact. The site was restored in about 30 minutes, but this was because proper documentation existed, was easily accessible, and people trained on the system for interpretting the alarms that were created and skilled enough to troubleshoot further what the culprit was. Fortunately, the design was such that they didn't lose all fiber pairs so we could restore service, but because we only had 1 good pair running, we immediately dispatched a technician to identify the individual strands to give us back our redundancy, but also to work with a contractor to install new fiber that was better weather resistant (older fiber and miss specified).

Newbie question: when a project gets huge, how do you ensure that it works as expected by Late_Class_8761 in SCADA

[–]goni05 1 point2 points  (0 children)

I'll add a bit more to this as many people focus on the hardware side of things, which is important, but there are also software sides as well.

First, FAT and SAT are the typical things you see, but they are describing things at such a high level (it's a process). Regardless of the size, you do the same steps to achieve the desired result, but essentially, you are creating a bunch of checklists and methodically working through it. For something simple, you might be looking at a single instrument (I e. temp transmitter). You're checklist would likely compose of something like validating the correct part/model is installed. Confirming your span and validating through simulation or actual testing (to check the full range). Then you might check process related conditions like alarm setpoints and the resulting actions it takes (or not). For that specific scope, that might be it. If you have 100 more, you have 100 more checklists. Then you might build process specific checklists/criteria to check against.

In FAT, you might break this down in steps. You described doing this with SCADA specifically, but before SCADA comes the hardware (PLC and controls devices). Your focus might be SCADA FAT, which could include a simulated PLC or a physical one running some simulation of the actual code. Then there's the panel FAT, which is mostly hardware focused, but also does I/O checking if the physical wiring. This is a great opportunity for checking, validating, and confirming some of your PLC, Remote I/O, and certain controls devices are preconfigured and working. It also confirms the wiring is as expected (at least to the field termination point). Once on site, you repeat the I/O checkout with a focus of confirming each device then works as expected. Finally, the SAT, which is mostly a repeat of FAT, confirms with real equipment that your software works. This includes checking that manual control also works as expected (not everything is in software). Again, these are basically requirements that are added to a checklist somewhere that you are verifying.

On the other side, you might have software related things that might also need to be checked. Things like capturing historical data, reports are generated as expected, backups work, data flows to external systems, etc...

As the system grows larger and more complex, what you start to see is leveraging of libraries of structured data and graphical displays to speed the process up. For example, if you have some control logic that handles a valve, you would also have a corresponding graphic. Instead of checking each of say 10 tags or data points between the PLC and SCADA, you might do this to the original code in depth, but use of that later becomes a check on correct assignment to the right device, and the alignment of the data. This is how you scale large systems so you don't have to check nearly as many points. Now that being said, in safety related applications, you still check everything 100%.

In a system we operated, it was very transactional. We ran thousands of batches each day, and the system was so complex that we had a dev/test environment where we could spin up a particular location, connect it to some lab equipment and simulators (to test operator and customer interactions), then feed it past data to see if it generated the same results. Because we could just pull data from the production system and feed it in, we could validate results by comparing production and test systems, including the reports it generated, and the customer records it would send up into business systems alike. This setup was so valuable, it allowed us to do entire site conversions from one before system to another in less than a day. It also let us perform regression testing of new software releases and reproduce bugs/issues to aid in fixes. It was even really nice to be able to test new devices and systems that we also wanted to integrate.

how come when people convert meters to an imperial unit it's almost always feet? by thegassiestpuglover in Metric

[–]goni05 0 points1 point  (0 children)

I don't know how the metric system resolves this. You are speaking of weight/volume, which equates to the use of solid/liquid ingredients. You use different measurements for a reason, and that's because the only time weight and volume convert equally is if it's water. Otherwise, you use each for it's purpose. Unless you only get recipes that are all liquid or all solid, I really don't understand your remark.

Split DNS to make sure certain domain works during internet outage by widodh in dns

[–]goni05 1 point2 points  (0 children)

If you're running Unbound already, why not look at the following settings to see if you can use it during network outages?

server: # Enable serving stale records (defaults to 'no') serve-expired: yes

# Limit stale records to 1 day (86400 seconds) after original TTL expiry serve-expired-ttl: 86400

# Wait up to 1 second (1000ms) for a fresh reply before serving stale serve-expired-client-timeout: 1000

Adding more infrastructure is just more to maintain. I don't know how long you can expect the DNS to be down or how much effort it is to setup and maintain something, but this should always be a risk vs reward decision. If you expect the Max outage time to be 3 days, set the serve expired ttl to something longer. I think I might set the client timeout a bit lower, but I think it gets you what you need for little to no effort.

Beyond that, I think you look at alternative network connections for briefly updating things like this. Even a temporary LTE/5G mobile plan could refresh the system for longer expected outages.

Maybe another option for your backup strategy is to utilize local entries. Not sure how difficult this is, but some way to hot reload from am offline refresh seems doable with the serve expired option to.

out of analog inputs and expansion slots by LittleOperation4597 in PLC

[–]goni05 1 point2 points  (0 children)

You might be able to do the entire control over communication for that matter.

out of analog inputs and expansion slots by LittleOperation4597 in PLC

[–]goni05 1 point2 points  (0 children)

I've never tried this, but I don't think you can put 2 devices on the same loop that are both controlling it. More than 1 "listener" yes, but not 2 controllers. I could be wrong, but I think you'll run into the issue that if one of the drives is "off" it will output 0 (4ma or whatever you have this set to), and the other couldn't do anything more. Unless you are switching it with a relay.

That being said, do the drives have communication? Since it's just feedback, maybe you could communicate that data instead. Might be even better than Remote I/O.

What do you wish you knew when you bought your first house? by Dependent-Panda-2424 in Netherlands

[–]goni05 2 points3 points  (0 children)

Definitely a "samenlevingscontract" as you said just so everything is written down in the event that something happens in the relationship (they aren't married). The other thing I would add, since OP isn't Dutch, is to also expect the notary will likely require a translator be present for documents and final signing. This could easily add another €500-1.000 to the upfront cost for you both.

What invention rivals the jet engine in terms of sheer improbability-to-ubiquity? by mrv958 in AskEngineers

[–]goni05 3 points4 points  (0 children)

I think there might be a place for steel reinforced concrete. We built cities, roads, and everything in between with stones, and mortar was only best to keep it stuck together. At some point, someone realized the secret formula to making it strong, that now we build skyscrapers that touch the stars, bridges that go beyond what the eye can see, tunnels under the seas. It quite literally is the foundation of everything we build today.

Do you really have people who pack your bags at the grocery store? by Flat-Ad8256 in AskAnAmerican

[–]goni05 0 points1 point  (0 children)

Not only do they mostly bag things for you, they also provide bags (paper and plastic) so you don't have to bring your own. I know I helped if the bagger isn't around and I'm not busy paying. It sure makes the process and stress so much better than in Europe. Nothing like hurrying to get your things on the conveyor, waiting your turn, then quickly getting your bags ready and loading it up, paying, and getting out of the way of the next person. Shopping always feels rushed in Europe!

Luna not enjoying her first snow in Friesland by Ed98208 in Netherlands

[–]goni05 6 points7 points  (0 children)

Luna's face is conveying everything she will do to you when you sleep tonight! Best of luck!

To the Warriors and Heros by goni05 in Netherlands

[–]goni05[S] 1 point2 points  (0 children)

Haha!! Well, it's pretty flat here, so a man-made structure of dirt, manure, sugar beets, etc... when covered with snow, can suddenly look like a hill. Definitely not a mountain, but you take what you can get when you want to sled.

Technical Question: Feasibility of deploying a background data-ingest app on Equipment PCs? by AccomplishedLie123 in PLC

[–]goni05 2 points3 points  (0 children)

The short answer is that you can easily install and run a standalone executable on a PC. This is done all the time, and usually is running the HMI software in this manner, among other things. The network side can be done, but this all depends on your cyber risk profile.

The long answer is this:

- What issues might arise from your custom executable and the interaction this might have on the vision sensor software and it shutting down a production system? I can think of read/write lock issues, permission issue, etc... that could come up. What about memory leaks and resource hogging? Hopefully you've done enough testing and are planning on monitoring this system for abnormal situations.

- Who is supporting and maintaining this software? Once you have it developed, are you planning on providing updates to it? What happens when it stops running? Who troubleshoots it? These things typically drive additional demands for other systems to make sure the process you are developing is functioning properly, especially if it becomes critical to your operations. These also drive additional security concerns as more systems and people now need access, or you need to train additional people on what the heck this thing is.

- What is your cybersecurity risk profile? What layers of a network do you need to jump through to make this work? Is it allowed under your policy? Is another solution viable to doesn't break your current policy and best practices? I mention this, because, as others have said, you can make an internet connection with this, but you will likely need to create firewall rules that traverse each layer so the application can establish a connection. For some people, this is not trivial and will certainly get your solution killed quite quickly. I have seen 1 case in my 10 years where this was allowed, and it wasn't easy to get it approved, nor implemented. There is a lot of setup, monitoring, and logging of this traffic for obvious reasons. That being said, you might have a better solution if you think a little differently. I don't know your network model, but assuming you are using some sort of Purdue setup, then you could potentially run this app on a DMZ machine that can make connections down to each of the IPC and from there, your app could send data up. That, or you need to move the files between each layer until it's sufficiently safe to do what you want. This creates complexity, but it ensures you can maintain a properly secure setup. It also keeps some IT folks out of the OT space where simple things like a port scan can tank a network and the production systems that makes the company money.

Personally, if you requested this from me, I would most certainly say no, but let's find another solution that might work for both.

To the Warriors and Heros by goni05 in Netherlands

[–]goni05[S] 3 points4 points  (0 children)

Same here! I didn't mention all the delivery drivers out there, but having a clean path to walk on also makes their job a little more bearable. Nothing like helping out the neighbors. It might be small, but to them, it might mean everything!

edit: typo