Chapter 4 — Industrial protocols at the operator's level
Lesson map
Lesson 04 published. Map, example, EX013.
flowchart TD
N0["Learning outcomes"]
N1["4.1 What the protocols carry"]
N2["4.2 Why authentication is missing"]
N3["4.3 Normal patterns"]
N4["4.4 Do not experiment"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX013"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 What the protocols carry"]
N2["4.2 Why authentication is missing"]
N3["4.3 Normal patterns"]
N4["4.4 Do not experiment"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]
[Learning outcomes]
|
v
[4.1 What the protocols carry]
|
v
[4.2 Why authentication is missing]
|
v
[4.3 Normal patterns]
|
v
[4.4 Do not experiment]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX013]
Learning outcomes
You will (1) describe what Modbus/TCP and similar industrial protocols carry; (2) explain why many lack authentication; and (3) recognise normal versus unusual protocol use from a description.
4.1 What the protocols carry
HMIs and PLCs exchange values: temperatures, speeds, counts, start and stop bits. Modbus, published by the Modbus Organization, is one widely used example; over Ethernet it is called Modbus/TCP and normally uses port 502. A request says "read registers 100–110" or "write value 180 to register 205". Other common families include EtherNet/IP and PROFINET; the idea is similar.
At HPFL HMI-1 reads values from PLC-FILL and PLC-WRAP such as speeds and temperatures, and sends writes when operators press buttons. ENG-LT uses a separate programming connection to change PLC logic. Knowing which connections are expected is what lets anyone notice an unexpected one.
4.2 Why authentication is missing
Classic Modbus has no built-in way to check who sends a request. If a device can reach the PLC on port 502, it can usually read and often write. This was acceptable when the network was a closed cable inside a cabinet. It is not acceptable once that network connects to offices or the internet, which is why segmentation (Chapter 12) carries so much weight.
At HPFL this means that the firewall and VLANs are the main protection for PLC-FILL and PLC-WRAP. If an office PC could reach port 502 on either PLC, it could send writes that look exactly like those from HMI-1. Report any sign of such a path immediately, without trying it.
4.3 Normal patterns
On a healthy line the pattern is boring: HMI-1 reads the same registers every second, and writes happen when operators press buttons. A new device sending writes, or reads of unusual register ranges, is worth reporting. You do not need to decode packets yourself; you need to know what normal looks like and who to call.
Writing the normal pattern down also helps after changes. If a new device is added to the line, the expected pattern is updated in the same change ticket. A monitoring tool run by the network owner can then compare actual traffic with the written pattern, as in Tomás's notebook entry.
4.4 Do not experiment
Sending test requests to a live PLC can change outputs. Protocol learning happens on a simulator or a lab PLC, never on the line.
The controls engineer can arrange time on a lab PLC or simulator if you want to practise. Even read requests to a live controller add load and can disturb older devices. If you are curious about what a register holds, ask the engineer rather than querying the PLC on the line. Learning on a lab PLC lets you make mistakes safely and see their effects without risk.
Worked example (synthetic HPFL)
The controls engineer shows Tomás a summary from the line's monitoring tool: HMI-1 reads PLC-WRAP every second; ENG-LT connected twice last month during approved changes. Tomás notes "writes only from HMI-1 and ENG-LT" as the expected pattern in his notebook.
Synthetic case — HPFL. The monitoring summary is invented.
Errors and limits
Some newer protocol versions add security features, but plants run old devices for decades; assume the weakest common case unless the owner confirms otherwise.
Exercises
- EX013 — A write request. In plain words, what does "write 180 to register 205" do on PLC-WRAP if register 205 is wrapper speed? Rubric: 3 = sets speed to 180, physical change immediately; 2 = changes a value; 1 = reads; 0 = none.
- EX014 — Port 502 reachable. A vendor tablet on the line VLAN can reach port 502 on PLC-FILL. Why is that a concern? Rubric: 3 = no authentication so tablet can read/write process values; 2 = "unauthorised access"; 1 = slow network; 0 = none.
- EX015 — Spot the unusual one. Which is unusual: (a) HMI-1 reading every second, (b) VIS-CAM writing to PLC-WRAP, (c) ENG-LT during an approved change? Rubric: 3 = (b) with reason; 2 = (b) only; 1 = other; 0 = none.
- EX016 — Learning safely. Where should Tomás practise sending Modbus requests, and why not on the line? Rubric: 3 = simulator/lab PLC; requests change live outputs; 2 = place only; 1 = "after hours on line"; 0 = none.
Synthesis
Industrial protocols move process values with little or no authentication, so reachability equals control.
Continue studying — chapter 04 of 18
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →