The DeltaV Firewall IPD protects DeltaV controllers from Denial of Service (DoS) attacks that originate from DeltaV workstations or other computers on the DeltaV Control Network that are located on the unprotected side of the firewall IPD. For information on installing the firewall IPD and for specifications, refer to DeltaV S-series and CHARMs Hardware Reference.
The firewall IPD blocks the SLS 1508 unlock command that prevents changes to an SLS 1508 configuration. A pushbutton or a set of discrete input contacts on the front panel of the firewall IPD disable the unlock command for 30 minutes to allow changes to an SLS 1508 system. Unlike the SLS 1508, the CHARMs Smart Logic Solver (CSLS) uses a physical keylock switch to block the CSLS unlock command to allow changes to the CSLS configuration.
The workstation side of the firewall IPD supports all combinations of workstations up to the standard DeltaV workstation limit. The controller side of the firewall IPD supports a maximum of eight controllers. For DeltaV systems with CHARMs I/O, up to 16 CIOC Carriers per controller can be placed on the protected side of the firewall IPD. Therefore, up to 8 controllers and 128 (8 x 16) CIOC Carriers can be placed on the protected side of the firewall IPD. The CIOC Carriers should be placed on the same side of a firewall IPD as their assigned controllers. Firewall IPDs can be added in parallel to share the communications load if the number of controllers requiring protection exceeds eight. Do not add firewall IPDs in series.
To maintain protection for controllers, only controllers should be connected to the controller side of the firewall IPD and only workstations should be connected to the workstation side of the firewall IPD. While it is recommended that controllers and their assigned CIOCs are installed on the protected side of the firewall IPD, it is possible to install a controller and its assigned CIOC on the unprotected side of the firewall IPD if the controller does not need protection. Always keep controllers and their assigned CIOCs on the same side of a firewall IPD.
Using a firewall IPD will not adversely affect DeltaV communications as long as the number of controllers, simplex or redundant, on the protected side of each firewall IPD does not exceed eight, and all CHARMs I/O and the controllers to which they are assigned are on the same side of the firewall IPD.
Other than the configuration changes outlined in KBA NK-1600-0290, do not change the firewall IPD configuration unless you are specifically instructed to do so by Emerson. Changing the configuration may adversely affect communication with controllers.