Summary
Machine monitoring needs data from the CNC. The CNC does not need to be on the plant network, and it does not need to reach the internet.
Put each CNC, or each cell, in its own small network. Let one collector read data from it on the protocol the monitoring software uses. Let the collector send the data on, and keep the machine itself off the internet. Nothing else reaches the CNC. This matters most for controls that still run Windows XP or other operating systems that will never be patched.
What machine monitoring needs from a CNC
Every monitoring setup does the same thing, whatever the product. It reads a few signals from each machine: running or idle, spindle load, feed override, part count, program name and alarms. It sends them to an application that turns them into utilisation, downtime reasons and OEE.
The data comes from the machine in one of three ways:
- The control's own interface, when the CNC exposes data over the network.
- An open standard such as MTConnect or OPC UA, through an agent or adapter on or next to the control.
- An adapter or sensor on the machine, which reads signals the control cannot provide. Older machines often need this.
In each case, the network requirement is small: one collector needs to talk to the CNC on one protocol. The rest of this post explains how to give the collector that access and nothing more.
How CNCs usually become exposed
The monitoring software does not expose the CNC. The shortcuts taken to connect it do.
- The machine goes onto the plant network. The quickest way to connect a CNC to a collector is to plug it into the same flat network as everything else. Every PC in the plant can then reach the CNC, and the CNC can reach them.
- The machine sends data to the cloud directly. In some setups, each machine, or an agent on it, sends data straight to the internet. The machine then has a route out.
- Remote support uses its own path. The machine builder installs a modem or VPN router in the cabinet to support the control. It sits next to the monitoring connection and gives its own route in.
- Program transfer is added. Once the CNC is on the network, file shares and DNC appear, often with broad permissions. USB sticks still move between office PCs and controls.
You do not need any of these to monitor the machine.
Five steps to connect a CNC without exposing it
1. Give each CNC, or each cell, its own small network. The machine keeps its IP address and its configuration. The change is in what it can reach and what can reach it. On most shop floors, this step reduces exposure the most.
2. Allow one collector to reach the CNC on the data protocol. The collector reads MTConnect, OPC UA or the control's interface. It is the only device with a path to the CNC for monitoring, and only on that protocol.
3. Let the collector send data on, outbound only. If the monitoring application runs on site, the collector sends data to it. If the application runs in the cloud, the collector sends the data out, and the CNC has no route to the internet. You secure and update one device instead of forty machines.
4. Give program transfer its own path. The CNC can reach one controlled file transfer source. Do not use a share that the whole network can write to.
5. Give remote support its own path. When the machine builder needs access, a named person gets a recorded session to that one machine for a set time. The builder's modem or VPN link can stay, but it ends at the gate and never uses the monitoring connection.
The monitoring software does not see any of these changes. It receives the same data from the same collector.
Where to put the collector
Put the collector between the machines and everything else, and manage it as a server. It talks to every monitored CNC, so give it the attention you give any system with that much access.
- Its own segment. The collector sits in its own small network. It can reach the CNC segments on the data protocol and it can reach the monitoring application. Office PCs cannot reach it.
- Read access only. Monitoring reads status and counters. If the protocol and the product allow it, the collector should not be able to write to the control. Ask the provider what the collector is able to do, as well as what it does.
- Kept current. You can patch the collector, unlike the XP control. Put it on the normal update cycle.
- Named administrators. The people who maintain it, on your team or at the provider, sign in with their own accounts. Remote administration uses the same controlled path as machine support.
Once this is in place, adding the next machine to monitoring means adding one policy entry for one more segment. You do not need a network project.
How to connect a CNC that still runs Windows XP
Many shops have one. The machine is mechanically fine, cuts good parts, and runs a control on Windows XP or another old Windows release. Microsoft ended extended support for Windows XP in April 2014, so there are no security updates. Upgrading the control is usually a project with the machine builder, if it is possible at all. Modern antivirus and endpoint agents will not install on it.
You cannot protect this machine from the inside. All of its protection has to sit in front of the machine, on the network:
- It talks to the collector on the data protocol, and to nothing else.
- It reaches the one file transfer source it needs for programs.
- It never reaches the internet, and nothing on the internet reaches it.
- Remote support reaches it only through a named, recorded session.
With these controls, the risk of the unsupported operating system is contained. The machine can keep cutting parts for years. You can decide on the upgrade when it makes sense, and the monitoring project does not force the decision.
How Trout Access Gate fits
Access Gate works at the network level. Nothing is installed on the CNC, the PLC or the HMI, which old controls require. Access Gate divides the shop floor into overlay enclaves between zones. It isolates legacy CNC and PLC networks from engineering, ERP and corporate IT, with no re-addressing or rewiring of the machines. A policy sets which collector reaches which machine on which protocol.
For machine builder support, the same appliance acts as a bastion. It keeps the builder's VPN or 4G link. The builder signs in with MFA and reaches one authorised machine over one authorised protocol within a time window, and the session is recorded. Access Gate connects several directories at once, so your staff can use your corporate directory and machine builders can use a second Active Directory or the directory built into Access Gate. Everything runs on premise.
For more on remote access, see secure remote access to a PLC and secure remote access to an HMI. If your machine builders already use a gateway in the cabinet, how Ewon remote access and Talk2M work describes that path.
Five steps to take this week
- List the machines you plan to monitor, with the control model and operating system of each. Mark every machine on Windows XP or another unsupported release.
- Ask the monitoring provider which device talks to which. Find out which device reads each machine, over which protocol, and which device sends data off site.
- Find the other paths into each CNC. Look for modems and VPN routers in cabinets, file shares, DNC and USB. Write them down.
- Plan the segments before the rollout, so each machine goes directly into its own network and never onto the plant network.
- Keep the collector as the only device that sends data out, and keep remote support on its own named, recorded path.