Let's take a look at the types and features of representative DCS protocols (Yokogawa, Honeywell & Emerson)

-



OT protocol used in OT sites (Oil&Gas/Refining/Chemical/Power Generation etc.) where DCS is the main focus


DCS Protocols of Yokogawa, Honeywell, and Emerson

VendorProtocolTCP/UDPRemarkEncryption
YokogawaVnet/IPUDP 12345High-speed, deterministic redundant network for process control. Uses Layer 2 switching.No native
YokogawaEthernet-based FCS (Field Control Station) ProtocolTCP 8888Proprietary protocol used for communication between control stations and operator terminals.No
YokogawaFF-H1 (FOUNDATION Fieldbus H1)Serial (31.25 kbps)Digital, two-way communication for field devices and process instruments.No
YokogawaFF-HSE (FOUNDATION Fieldbus High-Speed Ethernet)TCP/IP-basedHigh-speed, Ethernet-based backbone for process automation networks.No
YokogawaModbus TCP/IPTCP 502Industry-standard master-slave protocol for data exchange.No
HoneywellExperion Control Network (ECN)TCP/UDP (proprietary)Used for Experion PKS (Process Knowledge System). Supports redundant communication.No native
HoneywellSafety Manager ProtocolTCP/UDP (proprietary)Used for Honeywell Safety Instrumented Systems (SIS). Integrated into Experion DCS.No native
HoneywellModbus TCP/IPTCP 502Master-slave protocol for third-party device integration.No
HoneywellOPC UA (for Experion)TCP 4840Secure protocol with structured data modeling for interoperability.Encrypted (TLS, certificates)
EmersonDeltaV Control NetworkUDP 18520Proprietary deterministic control network with redundant switching for high reliability.No
EmersonOPC UA (for DeltaV)TCP 4840Uses secure data modeling for interfacing third-party systems.Encrypted (TLS, certificates)
EmersonEtherNet/IP (for DeltaV)TCP 44818 / UDP 2222Uses CIP (Common Industrial Protocol) for cyclic messaging.No by default, but TLS available
EmersonHART (Highway Addressable Remote Transducer)Serial (Bell 202) / TCPDigital-over-analog 4-20mA protocol. Common in instrumentation and valve control.No
EmersonPROFINETTCP 34962-34964 / UDP 34962Uses Real-Time (RT) & Isochronous Real-Time (IRT) for industrial automation.No

Recap

  • Yokogawa uses Vnet/IP for high-speed deterministic control, while Emerson uses DeltaV Control Network and Honeywell uses ECN.
  • Honeywell's Experion DCS and Emerson’s DeltaV DCS support OPC UA for secure interoperability.
  • Most traditional DCS protocols lack encryption, except for OPC UA and some secure EtherNet/IP implementations.
  • FOUNDATION Fieldbus and HART are widely used across all three vendors for field device communication.

#CPS #OT #XIoT #IoT #IIoT #IoMT #CPSSecurity #OTSecurity #IoTSecurity #CPS보안 #OT보안 #IoT보안

Comments

Post a Comment

Popular posts from this blog

Don't confuse DCS, PLC and SCADA in front of OT specialists

-
Image
DCS, PLC and SCADA are not the same. If you keep talking only about PLC security in front of the Oil&Gas industry executives where DCS is the main focus, they will not recognize you as a proper expert. We need to understand the characteristics of OT systems such as DCS, PLC, and SCADA accurately, also respect each OT culture uniquely and finally approach the sites in the right way. Don't be confused, here’s a clear and accurate explanation of DCS, PLC, and SCADA . 1. Distributed Control System (DCS) Concept A DCS (Distributed Control System) is an automated control system used for large-scale industrial processes that require continuous operation and high reliability. It consists of multiple controllers distributed throughout the system, which communicate with each other to manage complex processes. Key Features Used in large-scale, continuous processes (e.g., oil refineries, power plants). Decentralized control architecture with multiple controllers working together. Pr...
Read more

Top 20 Threat Scenarios & Playbooks for OT Security

-
Image
A comprehensive list of 20 threat scenarios in OT security along with detailed descriptions and detection rules that can help identify and respond to these threats. This playbook-style table covers different types of attacks—from unauthorized access to insider abuse—with corresponding rules and indicators to alert security teams. # Threat Scenario Detailed Description Detection Rules & Indicators 1 Unauthorized Remote Access Attempt An attacker uses stolen or weak credentials to access OT networks remotely. - Log Analysis: Monitor VPN/RDP logs for unusual login times, geolocation mismatches, and failed/successful login bursts. - User Behavior Analytics (UBA): Alert on deviations from normal remote access patterns. - Anomaly Detection: Trigger an alert when a remote session is initiated from an unusual IP or geographic region. 2 Malware/Ransomware Infiltration in OT Network Malicious code is introduced into the OT network via compromised endpoints or phishing, potentially encr...
Read more

Let's create our own ICS Labs in the VMs!

-
Image
Let's create our own ICS Labs in the VMs: A Step-by-Step Guide Building an Industrial Control System (ICS) lab in a virtualized environment allows security researchers, engineers, and penetration testers to safely simulate industrial networks, study threats, and test security defenses. Below is a detailed step-by-step guide to creating an ICS lab , including HMI, EWS, PLC, and other critical components. 1. Lab Architecture Overview Key Components in an ICS Lab: HMI: Graphical interface for controlling industrial processes. Engineering Workstation (EWS): Used to configure PLCs and SCADA systems. PLC: Controls physical processes (e.g., motors, valves). SCADA System: Supervisory control and monitoring of ICS networks. Historian: Logs and stores process data for analysis. Networking Components: Virtualized switches, routers, and firewalls to segment ICS networks. Attacker Machine: Kali Linux or Metasploit for penetration testing. 2. Choosing the Virtualization ...
Read more