Control Network Specifications

DeltaV Controller Firewall

The DeltaV Controller Firewall is designed to protect DeltaV controllers from Denial of Service (DoS) attacks originating from DeltaV workstations or other computers on the DeltaV Control Network.

Important

The DeltaV system requires a specific hardware and software version of the firewall IPD and a special configuration that includes the packet inspection rules and packet rate limits that have been tested with the DeltaV system. Firewall IPDs ordered from Emerson Automation Solutions are shipped with the supported software and are pre-configured to operate properly with the DeltaV system. To ensure that you have the proper firewall IPD configuration and the correct hardware and software versions, you must purchase the firewall IPD through normal Emerson channels.

A detachable screw terminal block is used to supply the required 24 VDC system power to the firewall IPD. The firewall IPD is installed close to the controllers on the DIN rail and can use the same system power supply as the controllers. To more tightly control physical access to the firewall IPD, it can be installed on a DIN rail with a 24 VDC power supply in the equipment room. A set of normally closed, potential-free relay contacts, also supplied on the detachable terminal block, monitor proper device functioning.

The ground screw connects to an instrumentation ground to provide a shield ground for the controller and firewall IPD communications cables.

The 10/100 BASE-T Ethernet port labeled Workstations is for DeltaV workstations only. Typically, the workstations are connected to a managed switch such as the DeltaV RM100 Smart Switch, and the switch is connected to the workstation port of the firewall IPD. The 10/100 BASE-T Ethernet port labeled Controllers is for DeltaV controllers only. Typically, the controllers are connected to a managed switch such as the DeltaV RM100 Smart Switch, and the switch is connected to the controller port of the firewall IPD. For controllers that are distributed over wider geographic areas, consider using one firewall IPD for each controller. This is a more secure arrangement because it eliminates the possibility of open switch ports on the controller side.

Table: DeltaV Firewall IPD specifications
Item Specification
Input voltage 24 VDC nominal (12-48 VDC)
Input current

TX/TX

  • 410 mA at 12 VDC
  • 110 mA at 48 VDC

TX/FX

  • 450 mA at 12 VDC
  • 120 mA at 48 VDC
Twisted-pair ports: controller (protected) and workstation (unprotected) 10/100 BASE-T Ethernet; 100 meters maximum Category 5(e) Screened Twisted Pair (ScTP)
Fiber-optic ports: controller (protected) and workstation unprotected 100 BASE-FX
Link budget
  • Multimode 50/125 µm - max attenuation 8 dB
  • Multimode 62.5/125 µm - max attenuation 11 dB
  • Wavelength 1300 nM
  • Single mode 9/125 µm - max attenuation 16dB
  • Wavelength 1300 nM
Alarm contacts Normally closed. Configurable to opened if:
  • Redundant power supply fails
  • Cables on either or both ports are disconnected
Controllers supported Eight (8)

If more than 8 controllers require protection, add more firewall IPDs in parallel to share the communications load.

Workstations supported All combinations of workstations up to normal DeltaV limits for workstations. Refer to the System Capacities table in DeltaV Books Online for complete information on workstation limits
Dimensions

Height: 13 cm (5.12 inches)

Width: 4.52 cm (1.78 inches)

Depth: 12.06 cm (4.75 inches)

Mounting DIN rail. The firewall IPD can be mounted on the same DIN rail as the controller.
Figure: Firewall IPD with one twisted-pair port and one fiber-optic port


Figure: Firewall IPD with two twisted-pair ports


The firewall IPD must be installed on the Primary and Secondary Control Networks to provide protection on both access ports of the controllers. Among the things to consider when determining the best location in which to install the firewall IPD are:

Note

Do not connect a workstation to the controller side of the firewall IPD and do not connect a controller to the workstation side of the firewall IPD. Incorrect connections will completely bypass firewall IPD protection for controllers.

Refer to DeltaV Firewall IPD Network Examples for examples of how to use the firewall IPD in a Control Network.

The firewall IPD can be managed from a Management station. Refer to the Managing the DeltaV Firewall IPD topic in DeltaV Books Online.

Subtopics:

Related information