OT Security for an Extrusion Line: Zones, Conduits and IDMZ in Practice

A fifth machine, a new concept

For a manufacturer with two sites we developed a drilling unit as the fifth machine of an extrusion line – after extruder, water bath, haul-off and saw. If you buy a machine, the safety concept comes from the manufacturer. If you build it yourself, you have to write it. And “safety” here means three things at once: that nobody gets hurt, that the electrical and mechanical design follows the rules, and that the machine cannot be manipulated over the network.

We put all of that into one document covering all three levels, which was approved by management. This article describes the thinking behind it.

OT security: thinking in zones

The approach comes from IEC 62443: you divide the network into zones with similar protection needs and define conduits – the controlled transitions between them. For the extrusion line it looked like this:

• Machine zone: the controller, the drives, the peripherals. Only what the machine needs gets in.
• Line zone: the five machines among themselves, plus the operator stations.
• IDMZ: an industrial DMZ between the production network and the office network. Data that has to go up – measurements, states, orders – passes through a defined point, never directly.
• Office/IT zone: everything else.

The drilling unit has one peculiarity: the controller is a Phoenix Contact PLCnext, and the operator interface is a FastAPI client that talks to the controller via OPC UA. That connection is a conduit and is treated as one: authenticated, restricted to the necessary nodes, documented.

Why a hardening script for machine networks

A concept on paper is good. A script that applies the concept to the network device is better. So we built a hardening script for machine networks that enforces the basic rules: disable unused ports, restrict management access, remove default passwords, switch off protocols nobody needs.

The reason is simple: machine networks grow. A tablet is added, a camera portal, a Node-RED dashboard. Every device brings its default configuration. Without a repeatable script the network gets a little more open with every addition – and nobody notices until something happens.

Functional safety according to EN ISO 13849-1

The second level is the one about people. For every hazard – crushing at the axes, the drilling spindle, the clamp – we determined the required performance level and designed the safety function accordingly: emergency-stop circuit, guards, safe states.

One detail we want to highlight: the unit’s clamping brake has its own firmware on an ESP32. Its fail-safe logic is: stop the spindle without releasing the clamp. That sounds trivial, but it is exactly the kind of decision that has to be made deliberately and documented, rather than left to the accident of power-on order.

Electrical and mechanical safety

The third level is the classic one: schematic in EPLAN Electric P8 with supply, emergency stop and motor circuits, bill of materials, terminal diagram. Mechanically: covers, protected areas, labelling. This is not exciting engineering, but it is the part that gets checked first at acceptance – and the one most often missing on self-built machines.

Acceptance and change process

The part of the concept that matters most in the long run has nothing to do with technology: how is the machine accepted, and what happens when someone changes it?

We defined:

• An acceptance checklist across all three levels, worked through and signed before release
• Every change to the controller, safety circuit or network goes through a short assessment: does it touch a safety function? Does it open a new conduit?
• Changes are versioned – the controller software lives in the repository, the schematic has a revision state

Without this process the finest concept is void after the first “quick fix” on a Friday afternoon.

What we take away

• OT security, functional safety and electrical safety belong in one document because they influence each other
• Zones and conduits make sense for a single line too, not just for large plants
• A hardening script is the insurance against gradual erosion
• The change process decides whether the concept still holds in two years

Takeaway

A self-built machine is an opportunity to get safety and security right from the start instead of patching them on later. The effort for the concept was modest compared to the development itself – and it is what made management approval possible in the first place.