Meet the Future: Edge Programmable Industrial Controllers

A new kind of industrial controller simplifies and secures automation and IIoT projects, while reducing cost and complexity

 

Download this white paper as a pdf

New projects

The manufacturer

Last year a glass products manufacturing company in Ohio presented their automation engineers with a new project: data from manufacturing lines needed to appear in a web-based user interface (UI) the company’s supervisors already used. 

The UI showed production goals and sales from the company database. Supervisors needed to see real-time production figures in order to compare them to goals and sales and adjust production accordingly. 

How hard could it be? Almost everything was on premises.

• Field devices on the manufacturing lines were wired to local programmable logic controllers (PLCs), with field device values in counts.
• Getting data from the PLCs required device-specific communication drivers. The engineers purchased and installed them, chose the desired points, and mapped the points in a spreadsheet. Data in counts had to be converted to engineering units.
• Next, the PLC data was networked to a PC-based HMI (human-machine interface) and a SCADA (supervisory control and data acquisition) system. These systems required the engineers to configure data tags, drivers, and polling rate assignments. 
• Then, working with their information technology (IT) department, the engineers also configured the HMI and the SCADA system to transport the data into the company database.
• Additional programming was required to make the data available to supervisors.

Though expensive and complicated, it worked. The engineers and the IT personnel could finally get back to other projects they’d had to put on hold while figuring this one out. They wished there had been an easier, less costly solution. 

And then the company realized that their supervisors needed more information from the manufacturing lines, as well as a way to control some process elements. In addition, new production lines were being planned to manufacture a different kind of glass. The new lines would require control and a similar complex architecture to share data with the supervisors’ interface. 

The OEM

At about the same time, an original equipment manufacturer (OEM) in California was rethinking its machine design. The OEM built ovens that were suited for a wide variety of industrial and commercial applications, and the company wanted to differentiate its ovens from those of its competitors in order to increase sales. 

Feedback from customers pointed to three ways they could improve:

• Make it easier for customers to integrate the oven with process control systems 
• Add human-machine interface (HMI) options so customers could more easily monitor and control the oven’s operation
• Reduce customer costs, especially for operation and maintenance

The OEM’s engineers explored a number of ways to achieve these customer requests. 

They thought about ways to simplify integration with popular process control systems—for example, drivers for an OPC UA server. But because control systems are proprietary, a driver would have to be developed separately for each system. Since the company’s ovens were used with many types of systems, a one-at-a-time approach would not be cost effective.

Integration with existing HMIs would run up against the same problem. The engineers considered other options for an HMI, including an improved interface on the machine itself and even a mobile app. These ideas sounded possible but expensive to develop. 

Reducing customer costs seemed even more difficult. All their ideas depended on data. If they could get operational data from in-place ovens at customer locations, they could analyze it to improve their products’ efficiency. 

Data like that could also reduce customer costs by providing a new level of service. For example, the OEM could track burner ignitors, anticipate failures, and call the customer in advance to avoid unplanned downtime. Scheduled maintenance would likely be reduced as well, replaced by preventive maintenance and even predictive maintenance, to determine the likelihood of failures before they occur. 

Customers would appreciate these cost reductions and new services. But to get oven data from a customer’s site, the OEM would have to gain access to the customer’s network. The customer’s IT department would have to open incoming firewall ports and allow the OEM to request, or poll, the data. IT departments would never allow such a potential breach to their network security. 

How could the OEM redesign their ovens to meet their customers’ wishes and differentiate their products in the market, without spending so much time and money and causing major security problems?

The challenge of the IIoT

These two projects touch on three main challenges most automation engineers find today with the industrial internet of things: complexity, security, and expense. Usually the extent of these challenges is not obvious before a project begins; the challenges become more clear once the project is underway. Any IIoT or data-intensive automation application seems to end up involving far more complexity, many more security risks, and much greater investment in time and money than many companies want to expend or can afford. 

Getting data from the edge of the network—from the sensors and actuators in factories, commercial buildings, and remote sites—to the databases and people who need to use that data can be daunting. Bi-directional communication, for control as well as monitoring and data acquisition, can be even tougher. 

Most control systems and equipment use protocols and networks that are proprietary or specific to automation, for example, EtherNet/IP, Modbus, Profibus, serial, OPC. But computers and mobile devices use standard Ethernet or wireless networks and open protocols and standards, like TCP/IP, HTTP/HTTPS, JSON, and RESTful APIs. 

Translating data between these systems and moving it to where it’s needed involves a lot of expense and middleware: computers, gateways, drivers, parsers, custom software, licenses. As soon as data moves outside its immediate network or off premises—for use in the company computer network, or remote locations, or on a tablet or smartphone connected to the internet—middleware increases and security concerns balloon. A typical setup includes many steps, as shown in this diagram:

IIoT Challenge:

 

A different approach to automation and the IIoT

As controls engineers, we’re familiar with PLCs (programmable logic controllers) and PACs (programmable automation controllers). Both have been used and improved over many years, incorporating capabilities that used to be found only in SCADA systems, adding communications with Microsoft® Windows®-based HMIs, running on standard Ethernet networks, and so on. 

But increasingly, we need more from our automation systems. For the kinds of applications we want to do now and in the future, we need a different approach that simplifies connections and communication—a different product that does much more than a PLC or even a PAC. We need an automation product that shrinks or eliminates the middleware and lets us move data from where it’s produced to where it needs to be in much fewer steps. 

Fortunately that product is available. It’s called EPIC—an Edge Programmable Industrial Controller. An EPIC device eliminates middleware and shrinks the steps required to get the data we need, thus reducing complexity, lessening security risks, and decreasing the time and expense required for installation and maintenance.

IIoT Solution:

What exactly is EPIC? Let’s take a look at each part of the acronym and see what it means for the automation applications we’re building, today and tomorrow. 

Edge

All data acquisition starts at the edge, because that’s where data is produced. A manufacturing line or shipping department in a factory, refrigerated rooms or barcoded containers in a warehouse, pumps and pipes and storage tanks at remote sites: all are at the edge of the network and all have data that could be used to improve processes and profits. 

If we can get that data directly from the source, then we know it’s accurate. So an EPIC device sits at the edge and connects directly to sensors and actuators through its I/O, the inputs and outputs that gather sensor data and send control commands. It also connects to existing PLCs or other devices to gather their data and issue commands, if needed.

An EPIC device at the edge of the network actively works on the data as well, filtering out anomalies, labeling, storing and transmitting only by exception to reduce unnecessary volume, and converting values from one protocol to another. All this preprocessing makes operations, enterprise, and business cloud applications far more efficient. 

Because it is the single source of truth for data, an EPIC device can also securely share this data with software and equipment, including other control systems, building management systems, databases, cloud services, and others. 

An edge device like this has:

• Integrated hardware and software that can perform control, monitoring, data acquisition, operator interface, edge data processing, and analytical functions
• Quad-core processing power on a real-time, open-source operating system
• Two or more independent Ethernet network interfaces to segment a trusted network (for example, an internal automation network) from an untrusted one (for example, a network with internet access)
• Gateway functions and a configurable internal firewall to control access to all network interfaces
• Authentication and encryption built into all communications; no default usernames or passwords
• User account creation and management based on required access to specific software on the system
• Support for modern security standards, for example PKI-standard certified connections to servers and clients using SSL/TLS  certificates
• Standard Ethernet network interfaces and standard modern computer ports like USB and HDMI for communications
• Multiple methods for communicating via standard automation and internet protocols
• Multiple software options for programming and data communications
• An integrated, user-configurable, web-based HMI that runs in a web browser, independent of device screen size, manufacturer, or operating system
• An integrated high-resolution color touchscreen for local configuration of I/O and networks, troubleshooting, and system visualization
• Agency approvals and compliance for hazardous areas 
• Ratings for a wide range of operating and storage temperatures and relative humidity

Far more than just a controller, an EPIC’s open-source operating system and quad-core processing provide the intelligence and speed of a computer. Its programming and communication options, PC-like ports, solid-state drives, and file space offer options not available on a PLC or PAC. For example, you can store project files (like panel drawings, P&IDs, installation notes) on an EPIC device, so they can be accessed in the field by authorized technicians. 

For visualization, an EPIC device includes software for building a web-based, mobile-ready HMI. The HMI is not limited to data and controls from one manufacturer only, but can let authorized users see and send data and manipulate controls, if required, for multiple automation systems, software, and cloud services. Visible on the EPIC’s touchscreen, this HMI is web-based and therefore also available to authorized users on computers, laptops, tablets, and smartphones.

Other options may also be available on an EPIC device. One example is open-source Node-RED for wiring together devices, databases, cloud applications, and APIs (application program interfaces) with simple logic flows. Another is built-in integration with SCADA/HMI/MQTT software such as Inductive Automation®'s Ignition. 

Programmable

An EPIC device is not a PLC, not a PAC, and not a PC, but like them it must be programmed for control. An EPIC device gives you several programming options, some of which reflect traditional automation tools and others that come from PC and internet backgrounds.

You can program control using familiar automation tools like flowcharting or any IEC 61131-3 compliant language, including:

• Function Block Diagram (FBD) 
• Structured Text (ST) 
• Sequential Function Charts (SFC) 
• Ladder Diagram (LD)

If you are more familiar with higher level languages, you can gain access to an EPIC’s open-source OS and choose to build custom programs in languages you know, such as C/C++, Java, Python, or others. 

An EPIC device does not limit your programming options like PLCs and PACs or force you to learn a new programming language in order to use it. Instead, it lets you leverage what you already know, so you can build control, data exchange, and HMI programs more quickly. 

Industrial

As engineers, we often have to place controllers in severe environmental locations. One problem with PCs in industrial automation is that an off-the-shelf PC cannot be trusted to stand up to harsh environments. Only a much more expensive industrial PC will work. 

In contrast, EPIC devices grew from real-world automation experience and were designed to withstand tough conditions. Industrial-grade components and processors are designed for long life. UL hazardous locations approval and ATEX compliance are standard. Operating temperature ranges are wide, for example, -20 to 70 °C. EPIC I/O is hot swappable. 

Stainless-steel chassis come in various sizes to fit enclosures or machine designs and can be DIN-rail or panel mounted. 

Controller

At heart, an EPIC device is a real-time industrial controller designed to run control applications—a device that does everything we have always expected from a PLC or PAC. Programmed with standard automation tools we already know, like flowcharting, structured text, and even traditional ladder logic, an EPIC works just like a PLC or PAC in a control system. 

But an EPIC device is much more than just a controller. Its I/O modules offer multiple channels. Modules with isolated channels are available. Analog, discrete, and even serial I/O accept a variety of signals, with each channel usually software configurable. 

Because EPICs were designed by control engineers, they include features that simplify commissioning and troubleshooting:

• A built-in touchscreen, usable with a finger, a stylus, or while wearing gloves
• A web-based system management application to configure I/O and networking on the touchscreen in the field, or using a computer or mobile device
• I/O module specs and wiring diagrams viewable in the field, on the device
• Spring-clamp terminals and integrated, covered wireways that accommodate a variety of wire sizes
• LEDs on each I/O module that indicate module health and discrete channel status 

An EPIC System

Taken as a whole, an EPIC system offers significant options for automation and IIoT projects that help future-proof your investment. 

Security—Unlike older automation controllers, an EPIC device includes tools to help you make your system as secure as possible. Security starts when you are required to set up an administrator account before you can use the device—there is no default username or password. A firewall is built in, communications are encrypted, user authentication is required, and inbound connections are blocked by default. It’s still your responsibility to follow best practices and ensure the security of your system, but an EPIC device gives you the tools to help. 

Gateway functions—Because it has more than one independent network interface, an EPIC device can keep your control system network segmented from untrusted networks. An untrusted network, for example, would be a company computer network with an internet connection, which might be accessible by unauthorized users, including hackers.

Included HMI—Visualization to the system is built into an EPIC. The included HMI runs on the EPIC’s integrated touchscreen or remotely on any brand computer or mobile device with a web browser. You determine the data that appears in the HMI, which is not limited to the EPIC but can include any data and controls from equipment, software, and online sources that are appropriate for your project and your users. You also control all user access rights to the HMI, based on role. 

Data communications—When data from an EPIC device needs to be used in other systems or software, many methods are provided to do so, including ports on the controller and a variety of software and protocols to make data transfer easier.

Scalability—An EPIC system is modular, so I/O can be changed or added to meet changing needs. More EPICs can be added when your application grows. An EPIC device can act as a supervisory controller for other EPICs or industrial controllers and for remote edge I/O, or each EPIC can run independently and share needed data. 

Control—For traditional real-time control, an EPIC system offers reliable I/O channels and multiple options for control programming, including flowchart-based programming and familiar standard languages like ladder logic and function block diagram. 

Software upgrades—Like a smartphone or computer, an EPIC device can be updated to add new features just by installing a software upgrade. You don’t have to replace hardware or change field wiring, and you don’t even have to be where the EPIC is located, although you can be if you wish. Upgrades are installed through the EPIC’s web-based management program, either from the EPIC’s onboard touchscreen or from a computer or mobile device. (See Software Upgrades Protect and Preserve Investments.)

Meeting the challenge

So how could an EPIC device help our glass products manufacturer and our OEM with their projects?

Glass manufacturer

The glass products manufacturer already uses PLCs to control their existing manufacturing lines. An EPIC device can connect to these existing PLCs and communicate their data. 

The manufacturer won’t need to purchase PLCs for the new lines they’re going to add, however. EPIC processors can be used instead, connecting their I/O directly to sensors and actuators to provide control, while communicating data wherever it is needed. 

Because the EPIC provides data in standard engineering units, no conversion software is required. Once configured with plain-language names, I/O channels are available automatically as tags in all EPIC software, so no spreadsheets are needed to keep track of points.

Incorporating production goals and sales from the company’s database is simpler with an EPIC, which includes software such as Node-RED to acquire that data through pre-built nodes. Data from all sources—PLCs, sensors and devices wired to the EPIC, and the company database—is easily made available to authorized users in the EPIC’s HMI software. 

Using EPIC devices also makes future changes or expansion easier and more secure. In addition to providing connections to PLCs and databases, an HMI, and real-time control, an EPIC can also move data among SCADA systems, OPC servers, business systems like MES and ERP, and cloud services and software. 

Data from new sources can be added to the system without middleware. IIoT connections are encrypted and authenticated. New data, controls, and authorized users can be easily added to the HMI, with changes pushed out to users. You can see the possibilities in the image below. 

OEM

The OEM’s engineers discovered the solution to both their security and cost concerns when they learned about EPIC devices. 

An EPIC in the oven replaces the PLC or industrial PC (or both) that used to be required. The EPIC is wired directly to sensors and actuators in the oven and provides control, monitoring, data processing, communication, and visualization in a single unit.

For control programming, the OEM can use flowcharting, IEC 61131-3 languages, or Secure Shell access (SSH) for a custom program running on the Linux OS.

For an improved HMI, the OEM has choices:

• On smaller ovens, the EPIC’s built-in touchscreen can provide local visualization.
• On larger ovens, an industrial monitor can be added, plugged into the EPIC’s HDMI port. 
• For all ovens, the OEM can build a secure web-based HMI for use on computers and mobile devices. This HMI can be used by customers and also by the OEM.

Because the EPIC’s system management software is web-based, the OEM can apply software updates and manage the oven from their location, rather than having to go to the customer’s site. 

Secure data from customer sites

Perhaps the greatest advantage of an EPIC device for the OEM, however, is the ability to get the data they want from their ovens at customer sites, without causing security issues for the customer. 

In addition to the usual request/response method for data communication, an EPIC offers another method: publish/subscribe. 

Publish/subscribe, or pub/sub, works by setting up a central broker, either on premises or in the cloud. The broker handles all data communications. Each data source sends data to the broker only when it changes (report by exception). Equipment and software that need data subscribe to only the data they need, and they receive it from the broker only when it changes. 

Most important from a security standpoint, all communications are device-originating, outbound-only connections from the EPIC to the broker over secure, encrypted connections. (Secure, device-originating, outbound connections are normally permitted by most IT departments.) Once initiated, data can flow in both directions. Firewalls allow outbound communications, so there’s no need to open unsecure ports in firewalls. Security is maintained and IT involvement is reduced. (Read an article on pub/sub.) 

Because it greatly reduces network traffic and maintains security, a pub/sub communication method is ideal for remote locations. With an EPIC in their ovens, the OEM can set up a pub/sub broker at their facility or in the cloud and transfer data from ovens at customer sites, via outbound communications, anywhere they need to use it. For example:

• In the HMI for monitoring and controlling
• In a database for analysis to improve oven design
• In software for tracking individual customer service
• In online artificial intelligence and machine learning services for analyzing wear and determining preventive maintenance schedules, or predicting when failures might occur to reduce or eliminate downtime.

EPICs available now

The first EPIC device arrived on the industrial automation market in 2018 from Opto 22, a controls manufacturer with more than 50 years of experience, who designed their groov EPIC® system to meet the present and future needs of automation engineers. Since its release, regular software updates for the EPIC continue to add significant features.

Manufactured in the U.S.A., Opto 22’s groov EPIC has the characteristics of an edge programmable industrial controller discussed in this white paper. Part number GRV-EPIC-PR2 includes hardware features like these:

• Open-source Linux® OS, industrial quad-core ARM® processor, solid-state drive, 22 GB user file space 
• Two independent Gigabit Ethernet network interfaces; plus two USB ports for serial networking, WiFi adapter, or other uses; and an HDMI port for an external or touchscreen monitor
• Integrated high-resolution color touchscreen for system configuration, management, and HMI
• Guaranteed-for-life I/O modules (discrete, analog, serial, universal I/O, power & energy monitoring) with 8-64 channels per module and a wide variety of signal types. I/O is hot-swappable and self-discovering. Channel-to-channel isolation is available.:
• Stainless-steel 4-, 8-, or 16-module chassis, DIN-rail or panel mounted, with integrated power supply (AC, DC, or pass-through)
• Easy-access spring-clamp terminals with a covered wireway; 28–14 AWG wire
• Wide -20 to 70 °C operating temperature range
• UL Hazardous Locations approval and ATEX compliance

groov EPIC processor security features include:

• Independent network interfaces to segment trusted networks from untrusted networks
• Built-in, configurable device firewall
• User accounts and authentication required for access (manage accounts locally or through LDAP)
• Data encryption and security certificate management
• Opto 22 cryptographically signed build

This EPIC device also offers an array of software for control programming, HMI development and runtime, and data sharing (all software is included in the EPIC processor’s purchase price except as noted):

• Web-based system management software for tool-less configuration, commissioning, and debugging, onboard and from anywhere on the network 
• Flowchart-based control programming with optional scripting 
• Control programming using any IEC 61131-3 compliant control languages, including Function Block Diagram (FBD), Structured Text (ST), Sequential Function Charts (SFC), and Ladder Diagram (LD), through the CODESYS® Development System
• HMI software for building and securely viewing operator interfaces from the EPIC’s touchscreen and from any mobile device or PC with a web browser
• Ignition or Ignition Edge® (products of Inductive Automation®) to connect to any OPC UA server, with OPC-UA drivers to Allen-Bradley® and Siemens® PLC systems and Modbus®/TCP devices (extra cost)

• Ignition or Ignition Edge running on the EPIC device at the edge of your network, no PC needed, for SCADA, HMI, and more (extra cost)
• Publish/subscribe method for efficient data communications (MQTT transport protocol with Sparkplug payload; extra cost)
• Open-source Node-RED for wiring together APIs, cloud applications, and databases using pre-built nodes
• RESTful API to the EPIC processor and HMI software
• Optional secure shell access (SSH) for developing and running a custom application using C/C++, Python, or other languages

Looking ahead

As we’ve seen, EPIC devices offer a new kind of industrial controller—an edge programmable industrial controller that not only gives automation engineers real-time control for all kinds of traditional automation applications, but also positions them to be able to provide the IIoT and data-based tasks companies want to do now. 

EPIC devices free you to focus on what you want to do: connect legacy systems and smart systems, get data, transform it into actionable information, visualize it when and where you want, and perform real-time control. 

Because EPIC systems are so scalable, they can be applied to smaller applications and then expanded with virtually no limitation. You can see how EPIC can work for you before committing significant resources.

An EPIC device offers a simple, secure, maintainable, and cost-effective solution for data communication. If solving your latest challenge involves complex steps, expensive middleware, or security issues, take a look at an EPIC device. You may very well find it can shrink those steps, reduce your costs, and help provide the security you need.

What do you want to do?

Software Upgrades Protect and Preserve Investments

As software becomes an increasingly important component of hardware-based products, you can now receive free or nearly free improvements to products you’ve already purchased, through software upgrades.

We are used to software upgrades in the consumer world, for example in electric vehicles and smartphones. Opto 22 follows a similar path with their groov EPIC platform, providing regular upgrades since the platform’s introduction in May 2018. These upgrades, often driven by user requests, protect and enhance customers’ investments. 

Here are some examples of improvements and new features for groov EPIC, all provided through simple software upgrades:

• Add WiFi support 
• Add the ability to run an Ignition Perspective® project on your groov EPIC display or on an external monitor connected via HDMI
• Add new groov I/O modules: serial modules, universal I/O module, power & energy monitoring module
• Add access to groov I/O through a RESTful API
• Update all included software with new versions and features
• Allow users to give Opto 22 Support personnel secure, remote access to their groov EPICs to help diagnose and troubleshoot problems
• Improve security certificate and network management
• Let users choose whether network configurations remain intact when installing a firmware update
• Add I/O batch operations, SNMP support, native OPC UA server, support for Docker® containerization for Secure Shell access (SSH) users, and more

These upgrades provide a host of substantial improvements to products already purchased and installed, at no cost to users. Each of these upgrades can be incorporated while preserving all existing user programs and configurations by following instructions pushed out to each groov EPIC owner.

Will this trend of providing software upgrades be followed by other industrial automation vendors? Only if their business model allows it.

• Many automation products contain only the hardware resources required to support existing functionality. This limitation makes it difficult or impossible to provide software-only upgrades with substantial improvements, such as removing the tag limit on the Ignition Edge software supplied with groov EPIC.
• Many automation vendors rely on support as a profit center. They charge for support and expect users to pay for any product improvements. Software upgrades do not fit this business model.
• Many vendors also prefer to delay substantial improvements until they release new versions of their hardware products. To get the improvements, customers must rip out old hardware and replace it with new products. 

In contrast, Opto 22 views support as a fundamental service they provide as part of their customer commitment. The company takes an expansive view of support, and that includes software upgrades to improve performance to existing hardware, now and in the future.

About Opto 22 Products

Opto 22 industrial automation products include the latest groov EPIC edge programmable industrial controllers and groov RIO edge I/O, as well as field-proven legacy products like SNAP PAC and solid state relays (SSRs).

With groov products, you can collect, process, view, and exchange data where it's produced—at the edge of the network—and securely share data among databases, cloud platforms, web services, PLC systems, and other systems and equipment. groov products give you built-in cybersecurity and multiple control programming options including CODESYS, plus Node-RED, Inductive Automation's Ignition Edge, and MQTT communications.

Opto 22 products are ideal for OEMs and machine designers, process control, machine monitoring, power and energy monitoring, predictive maintenance, remote installations like water-wastewater and oil & gas, SCADA, and industrial internet of things (IIoT) applications. 

Join us at industry events.

Built for the future, with experience from the past

For over 50 years customers like you have counted on Opto 22's reliable, open standards-based products for industrial automation, remote monitoring, and data acquisition. We offer a unique product philosophy: Here Today, Here Tomorrow. That means:

• We design new products for the long term, with features you’ll need tomorrow.
• We provide upgrade paths, so your existing systems will work with new ones. 
• We keep building older products as long as we can find required components. 
• And we support all our products for FREE as long as you have them.

Learn more about Opto 22
See what customers say about Opto 22