Abstract: Systems and methods are provided to facilitate receipt of tag requests from one or more interfaces, based upon which a single tagset is compiled at a controller comprising all the requested tags for a given update rate, whereupon the single compiled tagset is subsequently forwarded to the one or more interfaces. A controller generates a superset of tags associated with an industrial process. Each interface can request a copy of the superset, from which the required tags are selected. The controller receives the requested tags from all of the interfaces and combines the requested tags into a single tagset, for a given update rate, comprising the various parameters associated with the tags. At the selected update rate, the tagset is forwarded to the interfaces. A masterset can be utilized to identify the sequence of tags in a tagset and check code can ensure continuity of the tags in the tagset.

Abstract: A system is provided in which a position for each device (relative to other devices) in a topology, and a corresponding device ID for each device, may be predetermined. Then, the predetermined position and corresponding device ID for each device may be compared to actual devices in a topology having preprogrammed device ID's and pre-assigned IP addresses. If the comparison produces a match, the pre-assigned IP addresses in the actual devices may be utilized. However, if the comparison does not produce a match, the condition may be reported for further action.

Abstract: IP addresses may be allocated to devices in an industrial control system by applying starting address information in combination with each device's relative position in a local network. The starting address information, which may include an IP subnet address, gateway address, subnet mask, subnet size, and/or local network group identifier, may be provided to a first positioned, or “initiator,” device in a local network. The initiator device may determine its IP address by applying the starting address information and knowledge of being the first positioned device. The initiator device may send the position information and at least a portion of the starting address information to a next device, which may determine its relative position based on the received position information, and which may apply its relative position with the portion of the starting address information to determine its IP address. This process may continue sequentially for each device.

Abstract: An improved system for establishing rules in a firewall for an industrial network is disclosed. Rules are established at an application level, identifying, for example, actions to occur between two devices. The action may be, for example, read data table or get attribute, and each action may require multiple message packets to be transmitted between the two devices in order to complete. A network device executing the firewall is configured to receive message packets from a sending device and to inspect the message packets to determine which action the sending device is requesting to perform. If the action corresponds to a rule in the database, the network device manages communications between the two devices until all message packets have been transmitted. Thus, a single action, or application, may be defined in the rules database to permit multiple data packets to be communicated between the devices.

Abstract: Selectively enabling communication of dual protocol packets from a source device directed to a service of an object class at target devices is provided. Steps can include providing an access control database including an entry correlating a source device, an object class and a service of the object class; from a source device, receiving a dual protocol packet including a frame and a field according to a first network communication protocol and an encapsulated packet of a second network communication protocol; obtaining from the frame, an identification of the source device; obtaining from the encapsulated packet, an identification and a service of an object class to which the encapsulated packet is directed; comparing the identification of the source device, the identification and service of the object class, and the entry of the access control database; and selectively transmitting the dual protocol packet as a function of the comparison.

Abstract: Systems and methods are provided to facilitate receipt of tag requests from one or more interfaces, based upon which a single tagset is compiled at a controller comprising all the requested tags for a given update rate, whereupon the single compiled tagset is subsequently forwarded to the one or more interfaces. A controller generates a superset of tags associated with an industrial process. Each interface can request a copy of the superset, from which the required tags are selected. The controller receives the requested tags from all of the interfaces and combines the requested tags into a single tagset, for a given update rate, comprising the various parameters associated with the tags. At the selected update rate, the tagset is forwarded to the interfaces. A masterset can be utilized to identify the sequence of tags in a tagset and check code can ensure continuity of the tags in the tagset.

Abstract: A method and apparatus for use with a plurality of resources integrated within a space for performing a process and a program run by a processor for controlling the process, the apparatus for associating the resources with the program and comprising a processor running a program to perform the steps of identifying at least a first reference point within the space, identifying the relative juxtaposition of at least a first resource with respect to the first reference point and associating the first resource with the program as a function of the relative juxtaposition of the first resource to the reference point.

Abstract: Systems and methods are provided to facilitate receipt of tag requests from one or more interfaces, based upon which a single tagset is compiled at a controller comprising all the requested tags for a given update rate, whereupon the single compiled tagset is subsequently forwarded to the one or more interfaces. A controller generates a superset of tags associated with an industrial process. Each interface can request a copy of the superset, from which the required tags are selected. The controller receives the requested tags from all of the interfaces and combines the requested tags into a single tagset, for a given update rate, comprising the various parameters associated with the tags. At the selected update rate, the tagset is forwarded to the interfaces. A masterset can be utilized to identify the sequence of tags in a tagset and check code can ensure continuity of the tags in the tagset.

Abstract: IP addresses may be allocated to devices in an industrial control system by applying starting address information in combination with each device's relative position in a local network. The starting address information, which may include an IP subnet address, gateway address, subnet mask, subnet size, and/or local network group identifier, may be provided to a first positioned, or “initiator,” device in a local network. The initiator device may determine its IP address by applying the starting address information and knowledge of being the first positioned device. The initiator device may send the position information and at least a portion of the starting address information to a next device, which may determine its relative position based on the received position information, and which may apply its relative position with the portion of the starting address information to determine its IP address. This process may continue sequentially for each device.

Abstract: A method for installing embedded firmware is provided. The method includes generating one or more firmware file instances and generating one or more digital certificate instances that are separate instances from the firmware file instances. The method includes associating the one or more digital certificate instances with the one or more firmware file instances to facilitate updating signature-unaware modules with signature-aware firmware or to facilitate updating signature-aware modules with signature-unaware firmware.

Abstract: A high-speed security device for network connected industrial controls provides hybrid processing in tandem hardware and software security components. The software security component establishes state-less data identifying each packet that requires high-speed processing and loads a data table in the hardware component. The hardware component may then allow packets matching data of the data table to bypass the software component while passing other non-matching packets to the software component for more sophisticated state analysis.

Abstract: A high-speed security device for network connected industrial controls provides hybrid processing in tandem hardware and software security components. The software security component establishes state-less data identifying each packet that requires high-speed processing and loads a data table in the hardware component. The hardware component may then allow packets matching data of the data table to bypass the software component while passing other non-matching packets to the software component for more sophisticated state analysis.

Abstract: The present invention relates to systems and methods that employ scalable vector graphics (SVG) to view and effectuate an industrial device from a remote Web interface. The systems and methods can be utilized to retrieve an SVG XML markup language-based file associated with the device and execute the SVG file via basic ASCII drawing commands. Thus, a faceplate of an industrial device and/or other device-related information can be represented via SVG syntax and stored with the device. A user can employ a Web browser from a remote location (e.g., via a Web client) to retrieve the SVG file, wherein the file can be loaded within the Web browser and/or an open source software package. The SVG file can be executed to render an interactive graphical faceplate that can depict LEDs, alphanumeric displays, inputs/output, etc., trending mechanisms (e.g., graphs, charts, etc.), and capabilities to load parameters.

Abstract: Selectively enabling communication of dual protocol packets from a source device directed to a service of an object class at target devices is provided. Steps can include providing an access control database including an entry correlating a source device, an object class and a service of the object class; from a source device, receiving a dual protocol packet including a frame and a field according to a first network communication protocol and an encapsulated packet of a second network communication protocol; obtaining from the frame, an identification of the source device; obtaining from the encapsulated packet, an identification and a service of an object class to which the encapsulated packet is directed; comparing the identification of the source device, the identification and service of the object class, and the entry of the access control database; and selectively transmitting the dual protocol packet as a function of the comparison.

Abstract: A high-speed security device for network connected industrial controls provides hybrid processing in tandem hardware and software security components. The software security component establishes state-less data identifying each packet that requires high-speed processing and loads a data table in the hardware component. The hardware component may then allow packets matching data of the data table to bypass the software component while passing other non-matching packets to the software component for more sophisticated state analysis.

Abstract: Aspects of the present invention provide a device, method and system which utilize hardware-based granular evaluation of industrial control protocol packets to withstand traffic storms. In an embodiment, packet evaluation circuitry coupled to a port may be adapted to evaluate one or more protocol fields contained in each inbound packet before switching circuitry can send the inbound packet to the proper destination. The inbound packet may be sent by the switching circuitry if it is a particular message, or may be selectively inhibited from being sent by the switching circuitry if the inbound packet does not contain the particular message for being sent and if the total number of bytes of the inbound packet type exceeds a threshold for the outbound port during a given period of time. As such, critical industrial applications may continue to operate in the presence of a traffic storm.

Abstract: Method and apparatus for use with systems including networked resources where communication between resources is via dual packet protocols wherein a first protocol includes a frame that specifies a destination device/resource and a data field and the second protocol specifies a final destination device/resource and includes a data field, where the second packets are encapsulated in the first protocol packet frames, the method including specifying access control information for resources, for each first protocol packet transmitted on the network, intercepting the first protocol packet prior to the first protocol destination resource, examining a subset of the additional embedded packet information to identify one of the intermediate path resources and the final destination resource, identifying the access control information associated with the identified at least one of the intermediate path resources and the final destination resource and restricting transmission of the first protocol packet as a function of

Abstract: An improved system for establishing rules in a firewall for an industrial network is disclosed. Rules are established at an application level, identifying, for example, actions to occur between two devices. The action may be, for example, read data table or get attribute, and each action may require multiple message packets to be transmitted between the two devices in order to complete. A network device executing the firewall is configured to receive message packets from a sending device and to inspect the message packets to determine which action the sending device is requesting to perform. If the action corresponds to a rule in the database, the network device manages communications between the two devices until all message packets have been transmitted. Thus, a single action, or application, may be defined in the rules database to permit multiple data packets to be communicated between the devices.

Abstract: A method for installing embedded firmware is provided. The method includes generating one or more firmware file instances and generating one or more digital certificate instances that are separate instances from the firmware file instances. The method includes associating the one or more digital certificate instances with the one or more firmware file instances to facilitate updating signature-unaware modules with signature-aware firmware or to facilitate updating signature-aware modules with signature-unaware firmware.

Abstract: Systems and methods are provided to facilitate receipt of tag requests from one or more interfaces, based upon which a single tagset is compiled at a controller comprising all the requested tags for a given update rate, whereupon the single compiled tagset is subsequently forwarded to the one or more interfaces. A controller generates a superset of tags associated with an industrial process. Each interface can request a copy of the superset, from which the required tags are selected. The controller receives the requested tags from all of the interfaces and combines the requested tags into a single tagset, for a given update rate, comprising the various parameters associated with the tags. At the selected update rate, the tagset is forwarded to the interfaces. A masterset can be utilized to identify the sequence of tags in a tagset and check code can ensure continuity of the tags in the tagset.