Programmable Logic Controller Virtualization

During this year’s S4x19 Conference in South Beach Miami, I delivered a presentation on the current and potential future state of Programable Logic Controller (PLC) virtualization. The topic was an exercise in predicting the future of PLCs and investigating the feasibility of a virtualized and commoditized PLC. My approach in the presentation was to use the Socratic method and attempt to ask and answer challenging questions to create debate and spur critical thinking. I plan to follow a similar approach in this article as I detailed some of the finer points of my presentation.

Certainly, future predictions are always an exercise in futility, however I have observed a trend in the Operational Technology (OT) space that the same innovations seem to lag the IT space by roughly 10 to 15 years. Even the advent of the first PLC by Modicon (now Schneider Electric) in 1969 occurred about 15 years after some of the first transistor computers were developed in the early 1950s.

How do we define virtualization? Virtualization is simply software that looks and behave like specific hardware. In the past six decades of IT, no other advancement has offered more quantifiable benefits than virtualization. The implications of virtualization within IT have been massive:

• Reduced Cost
• Increased Flexibility
• More Scalability
• Improved Reliability
• Performance Gains

So why hasn’t this virtualization trend extended down into the OT space?

Well, actually it has. It has just taken about a decade for the OT industry to vet and incorporate it. Over the past decade, we have seen more and more virtualization in OT environments and more vendors fully supporting their SCADA and DCS platforms running within a virtualized environment.

In the early 2000s, the control system industry saw a few different Windows-based “SoftPLCs” try and fail to move into the market such as:

• Steeplechase Software Inc – Visual Logic Controller (VLC)
• Rockwell Softlogix

More recently we have seen a number of DCS vendors deploy virtualized controller CPU in situations where they need to either increase performance beyond what their current line of controllers are capable of achieving or when they need to reduce the cost of the controllers for strategic accounts. These Virtualized DCS controllers run on commodity IT hardware such as Windows or Linux servers. Often, these virtualized DCS controller products do not appear in product catalogs or even have a SKU number.

So it’s all well and good to assume that OT will always follow IT, but what problem are we trying to solve here exactly by virtualizing PLCs?  PLCs have worked just fine without virtualization, why would we want to mess with a good thing here?

In the past 60 years of PLCs we have seen very little change to their form factor.  If you look at a picture of the first Modicon PLC in 1969, you will notice that it looks very similar to modern PLCs and that the CPU, rack, and slots are still easily recognizable. Innovations have occurred all around this form factor, but this original design has stood the test of time. If we look at the attributes that were called out by the 1968 General Motors RFP that led to the creation of the PLC, we can still see that these attributes are still an important part of modern PLCs.

Of course, the PLC could always be more cost-effective, more reliable, more robust in industrial environments, more modular and easier to support. Could virtualization help PLCs to become faster, cheaper and more robust? And how do we even virtualize a PLC?

If you think of how we can run Windows, Linux or BSD in VMWare or VirtualBox, imagine doing the same with GE, Schneider and Rockwell all on the same PLC hardware. Full PLC virtualization would allow you to run a Schneider Electric Unity XL programming environment and then migrate to a Rockwell Automation Studio 5000 environment without changing any hardware assets in the field.

Yes, we are seeing vendor CPU virtualization today, but that is only a quarter of the requirements for “full” PLC virtualization. A PLC is not just one piece of hardware. The other components of a PLC would also need to be virtualized to achieve vendor inter-operability:

1. CPU
2. Backplane(s)
3. Cards
4. Network

Going back to our definition of virtualization: “software that looks and behaves like specific hardware.” A virtual PLC software container would need to be created to behave like a specific vendor’s CPU, Backplane, Rack, IO Cards and Network – running on more generic commodity OT and IT hardware. For example:

• PLC CPUs that are running virtualized on generic industrial PCs
• DCS Controllers that are running centrally on generic IT server hardware (like we are already seeing today)
• Fiberoptic Backplane – switched deterministic and/or real-time Ethernet fabric system
• Virtualized IO Cards – ARM based standalone endpoints
• Commodity power supplies / support for redundant commodity power supplies
• Support for redundant commodity IO Cards / Controllers

So what’s the point of this virtual PLC software container? What kind of benefits would there be to the OT industry?

#1 Cost – cost reduction has been the primary driver behind IT virtualization.
Wait… Are PLCs expensive?

Yes. Very.

Are there lots of them out there?  Is cost reduction in OT really a driver for big companies?

When I published my article on Linkedin about PLC virtualization a GM of one of the top 3 energy companies reached out in excitement. Even with their 50,000+ global employees, the number of OT devices in their global ICS environments dwarfed their global IT assets by more than double. Another person who reached out to me when I posted on the topic of PLC virtualization was a controls engineer of a biotech company. He felt that the dynamic nature of their business did not fit into the traditional cost and form-factor of a PLC and wanted to know what I had learned about the current state of PLC virtualization.

How could virtualization reduce OT costs?

1. It would create a “PC-compatible”-like version of the PLC and open the door for more vendors to enter the space with commodity devices that could still run the high-quality engineering tools provided by the major vendors.
2. Customers would no longer be locked into a single vendor for all hardware. Fieldbus and other open standards have already helped with this vendor lock-in issue over the years. However, many customers are still at the mercy of the PLC / DCS vendor for most of their hardware and software for decades after their initial deployment.
3. Disrupting the electrical distributor model – Today you must purchase PLC / DCS software and equipment through authorized re-sellers who have the special training to support the install of the vendor specific hardware.  More generic, commoditized hardware would eliminate the need for these middlemen and the additional margins they are putting on these products.

#2 Flexibility

Flexibility was one of the original drivers of General Motors RFP for the PLC. They were looking to solve the hardwired relay-logic rats nest problem they encountered every time they released a new car model and needed to modify their assembly lines.

Could a fully virtualized PLC improve OT flexibility?

1. Ability to move between product vendors seamlessly. For example a drug manufacturer might run Rockwell for one product run and after they turn around the plant they might move to a Schneider Electric based system for the next product run.
2. Lower cost hardware allows for more advanced automation. PLCs are so cost prohibitive that they likely are inhibiting innovation in OT environments.
3. Create a virtual version of your running process and test process updates against live data to see how changes could impact the system.

#3 Support

Could “full” PLC virtualization make it easier for field technicians and automation engineers to run and maintain control systems?

We have already seen that virtualization within Level 2+ in OT environments makes it easier to deploy patches, create backups and support endpoint protection definitions.
What functionality could be gained through “full” PLC virtualization?

• Roll-back functionality:
  Virtualized testing environment for testing new firmware would allow for the creation true to life simulated version of the running plant (as the underlying software on the PLCs will not even know that it is in a simulation).
• Virtual Snap-shot:
  By creating a VM snapshot before applying a security patch, changes can be rolled back in case of failure. VMs can be cloned for sandboxed testing, prior to deployment into production. VM instances could be live migrated, allowing for reduced downtime every time a physical device needs to be stopped.

#4 Performance:

We have seen that virtualization in IT can allow resources to be pooled together and clustered to increase performance and reliability. Would these benefits also apply in a “full” PLC Virtualization environment?

• We are already seeing DCS Controllers running virtualized on commodity IT hardware to scale performance in large ICS environments.
• Most PLC CPUs today do not have anywhere near the processing power of a commodity IT CPU. Even by leveraging industrial PCs are PLC CPUs there could be considerable performance gains. Of course Industrial PCs are not engineered to have a 10 to 15-year lifespan (as is the case with a PLC CPU) but this risk could be offset with clustering and additional levels of redundancy.

#5 Cybersecurity

Are there cybersecurity benefits to a fully virtualized PLC stack?

• Virtualization of the PLC backplane and network allow for “Software Defined Networking” (SDN) capabilities. An ICS SDN allows for granular control over the East to West network traffic which has traditionally been a challenge in ICS environments. This capability can allow for the creation of a so-called “zero trust network” environment around the PLC layer.
• A virtual container could also allow for a software firewall to control traffic in and out of the PLC.
• The virtual container environment would be running on a Linux or Windows environment which is much more robust to network attacks than the Real-time Operating Systems (RTOSs) traditionally deployed on PLCs.

Certainly, there are some challenges ahead for “full” PLC virtualization to become a reality. For example, there are some fundamental challenges with the deterministic nature of PLCs and the indeterministic, performance focused nature of IT virtualization. Also, it is unlikely for “Full” PLC virtualization to occur without one or more vendors getting involved in this dramatic technology shift. However, the vendors that work to create this potential reality would have greater market influence as the “VMWare of OT.”

The companion slides to this blog can be viewed here: