Often with CNC communication products including CIMCO DNC-Max server, the server hosting the software resides on a single network. Some companies and government agencies have requirements that don’t allow their CNC Controls to be accessible on their main networks. This is actually a smart policy and you might have read about the SIEMENS vulnerability or other high profile hacks of networks using assorted devices such as credit card terminals connected to corporate networks. If you wish to better isolate our system but still need access to another network, there is a way to accomplish this by implementing two networks with your CIMCO/DNC communications server participating on both, allowing the shop floor network to be completely isolated.

In Ethernet LANs, dual-homing is a network topology whereby a networked device is built with more than one network interface. -Wikipedia

In our example the DNC Max server resides on the machine that participates on two distinct networks but does not allow traffic to pass between the two, but both interfaces are active at all times. This allows the server to be backed up and managed the way all other assets are but isolates the CNC Controls that are connected to it, preventing them from accessing or being accessed by any other computers or devices on your network. The communications components of DNC Max server will only be accessed from the private CNC network, while the client portion can be accessed on the rest of the network. This allows access to only the mission critical components of the CIMCO software such as your programmers being able to store and send files to the DNC-Max server but the CNC network only able to send/receive to DNC-Max and nothing else. This is an over-view of the concept of multi-homed DNC Max installation. With some basic understanding of TCP/IP Networks and the installation guide available in the CIMCO Documentation you should have most of what you need to plan the installation. If you have questions about your specific environment you can contact us with your questions or leave them in the comments at the bottom of this article. As always it is best to consider professional installation if any of this is foreign to you. Here is a diagram demonstrating the concept addressed in this article:

Left: Simple Network Right: Dual Homed CNC Machines Isolated

Planning your Dual Homed DNC Max Install

There are a three (item #’s 1-3) unique steps that a dual homed DNC-Max install requires before downloading and installing CIMCO DNC Max on your soon to be dual homed CNC Communications server. There is also 1 special consideration during the installation process (item #4).

1. Determine an (un-used) IP Address subnet for the private CNC LAN.
2. Install a second network card (if not already present) and a network to all the devices on the private LAN.
3. File management considerations.
4. DNC-Max installation considerations.
5. Firewall considerations – for extra credit

Choosing an IP Address Subnet

The most critical issue when choosing this subnet is to make sure it is a private address range that is not already in use anywhere on the larger main network. In larger organizations you will probably have to request this from your IT or Network group as they will know which address ranges are in use. Without turning this into a network tutorial, network routers and firewalls can be configured to access a number of different private and public networks. If the IP Address range you choose exists somewhere else on your network it is likely to cause problems for the DNC Max Server machine accessing valid resources on the existing network. The list of private networks is available per RFC-1918, in our example we’ll be using 10.0.1.0/24 for the private CNC network and we’ll pretend that the main network is 192.168.122.0/24, here is a list of all the private ranges that are allocated (source: wikipedia):

RFC-1918 IPv4 Space

You will assign one of these addresses to your private network adapter on the DNC Max Server, in our example we’ve chosen 10.0.1.1. Each CNC Control and network device (such as Moxa Nport devices) with an ethernet port will be assigned a unique address on that subnet. It is a good idea to store all of this information in a spreadsheet or google doc for later reference.

Creating the Private Network

You will need to install a second network card on the machine acting as the DNC Max Server. This network card will be configured using TCP/IP and be sure to leave the default gateway completely blank when configuring the settings. In our example the settings would look like this for the Private network adapter:

IPv4 Settings for Private Network Dual Homed Example

In addition to the network card an isolated network (meaning: completely separated from the Main LAN and only connected to the ethernet based CNC Controls, Moxa Nport or similar ethernet to serial adapters, and the “new” second network card on the server) will need to be in place. This network requires Cat5 or above network cabling and an appropriately matched switch with enough ports to connect all the devices to the private LAN. If you are unsure how to do this and don’t have the resources in house it’s probably a good idea to hire a company that has experience installing Ethernet cabling in an industrial environment.

File Management Considerations

All of the files required to run your programs on your CNC Machines will need to be accessible on the dual-homed DNC Max Server. You will want to take appropriate steps to ensure that this server is backed up sufficiently to protect those files. This is an area where a little careful planning can go a long way. If you traditionally stored the files elsewhere on the network, you may require some additional steps to relocate or mirror the files to the Dual-Homed server. This could represent an opportunity because you could make it so only known good programs are stored on the dual-homed DNC Max server and completely isolate any files that are not approved for production. If you require more control over your files than Windows permissions allow you should also consider Manufacturing Data Management or CIMCO NC-Base as alternatives to gain much more control over those digital assets.

DNC Max Server Installation Considerations

Once the pre-requisite steps are all complete you will be ready to install DNC Max server. This should be done by or with careful guidance from a qualified CIMCO re-seller or installer.  There is one setting under Server Configuration/Network Settings that where the IP Address of the Private LAN interface will need to be entered:

Bind the DNC Max Server to the Private IP Address

With the noted exceptions the rest of the DNC-Max installation and configuration will be handled normally. We hope that this guide is useful to you, if you are looking to isolate your CNC Network we believe the information will be helpful, there are other ways to manage network traffic including VLANS, static routes and firewall rules. This article is provided purely for informational purposes. Please consult a professional for assistance. If you like, we have a network of dealers and installers ready to help you with your DNC Max Server installation.

Firewall Considerations – Extra Credit

One area where you can further limit access is within Windows Firewall on the DNC Max server. For example, a typical practice might be to give DNC-Max client port access to only the main network interface, while limiting the private CNC network access to just the DNC Max server and other required ports for devices such as the Moxa N-Port device.

Not keeping good backups can place your business in peril. Your CIMCO DNC Max communications system is part of the revenue/production process so it’s very critical to be able to easily recover from a server failure. There is a way to easily generate a backup that can be used to restore your configuration in the event of an accidental modification, hardware failure or other catastrophic event with the server hosting the software.

Backing up DNC Max Server

In order to backup your DNC Max Server configuration, run the DNC Max Client. From within the client choose the “Setup” option the “Backup Server Configuration” as pictured:

Select the option “Backup Server Configuration”

Save the resulting file in a safe location, at any point you can use that file to restore the DNC Max Configuration to an existing or new installation.

Other Considerations for Backing up CIMCO DNC Max

Keep in mind that CIMCO DNC Max may not be the only critical product running on your server. Be sure to account for all other products CIMCO or otherwise. One nice thing about most of the CIMCO Products is that there are no registry entries. That means that as long as none of the files are in use, you can backup the directory for easy restoration in the future without having to go through the installation process. There are situations where this is not enough, such as if you are running a license server, NC-Base, CIMCO PDM or MDC-Max. Consult your CIMCO Reseller before finalizing your business continuity planning for your CIMCO Software. Alternatively you can always contact us to discuss your setup and if we can’t help you we’ll certainly try to get you pointed in the right direction.

Wireless DNC, MDC and other shop floor devices have some great benefits. When you are considering the question of wired vs wireless, there are some potential issues that you will want to consider. The intention of this article is to help you make an informed decision on whether or not wireless has a role to play in your DNC, MDC or other similar solution.

Wireless shop floor solutions offer many benefits including:

• Ease of deployment
• Ease to move/relocate assets
• Relatively low initial implementation costs
• Can be used where wired networks are not possible

We should of course, consider the potential down-sides.

Potential Down-sides to Wireless on the Manufacturing Plant or Shop Floor

Every conversation about technology should not emphasize only the benefits. It should include an honest, informed discussion about the potential problems. The potential problems with wireless shop floor solutions are:

• They can be vulnerable to outside influences, jamming, and interference
• The hardware is more expensive to upgrade than wired
• Speed and performance (if shared with other devices)

Wireless vulnerability to outside influences, jamming, and interference

The greatest concern for some facilities will be the security of the system – e.g. prevention of unauthorized access to the network. For a moment lets assume that the wireless encryption you are using is up to date, maintained, tested, and proven in terms of security such as the current current Moxa Wireless equipment we recommend as a CIMCO dealer.

Even a secured Wireless Network is Still Vulnerable to Outside Influences

While it is unlikely, it is possible that someone with a inexpensive device and a desire to harm your business can disrupt your wireless network by creating a strong signal that mimics yours causing a direct conflict. The result of this conflict is a disruption of your wireless data and an inability to reliably reach your CNC machines with your DNC or return signals from your MDC system. The only protection from this is Radio Frequency Shielding, which varies based on the materials used and can be quite expensive.

There are simple manufactured devices that jam just about any wireless signal. Here is a video that demonstrates a simple home made wifi jammer which could be used to disrupt your wireless shop floor solution. It is unlikely that you will be victimized by one of these devices, and the devices are illegal to operate (in the US and much of the world), it is a possible situation that a business in a highly competitive industry could face.

What about inside interference?

If you do happen to have a well shielded facility, it is still possible that wireless radios or devices that can interfere within your own walls can potentially disrupt your wireless shop floor solutions. Every cell phone, laptop, many printers and a plethora of other devices contain wireless radios. Every wireless radio can be configured or have a defect that can cause a disruption of your wireless infrastructure.

The key is to be prepared to address these issues, should you be faced with them.

Wireless Upgrade Costs

Wireless hardware has a shorter obsolescence cycle than Ethernet wired devices. Wireless devices cannot be run forever, eventually they will become obsolete and vulnerable to hackers. Keep in mind the cost to replace the devices when this occurs.

The reason for the quicker obsolescence is due to wireless devices using different methods for encryption and communication. Features such as frequency ranges and encryption methods are at least partially locked in to the devices when they are manufactured. As the technology evolves these systems can become obsolete. They become obsolete because manufacturers tend to emphasize the latest wireless specifications, so the older products don’t get the needed security upgrades or just simply can’t support the latest wireless spectrum.

Wireless requires more careful consideration, testing and validation before going through these upgrades. CIMCO does validation testing on Moxa hardware as new versions become available. Because wireless is dependent on both the access point and the endpoint device, this testing is more involved. Considering that wireless hardware itself has a premium of 30-50% over the wired counterparts and the cost can add up quickly.

Wireless Network Speed Limits

Wireless limitations extend beyond just vulnerabilities and long term viability, they are also limited speed. Bandwidth affects how far you can scale and will face bandwidth limitations much more quickly than a wired solution will. DNC and MDC do not use much bandwidth but wifi networks are often shared with other devices. Bottlenecks in your network can affect your DNC, MDC or other wireless connected devices. Wireless networks require more careful planning to make sure adequate signal strength is present to provide a reliable connection.

Wired Ethernet specs when following proper guidelines will provide very high performance at great distances. Simple 100 Mbps gear is more than sufficient for a typical DNC solution. This means Cat5e or Cat6 wired solutions should exceed your needs for the distant future. Depending on your environment this expense may be more or less expensive, particularly when you take into account the potential obsolescence of wireless devices.

One Size Does Not Fit All

Keep in mind, there is no magic bullet, each situation is unique. The best approach is to gather the facts, understand the requirements and determine the best solution. One size does not fit all, especially with wireless DNC and similar technologies.

Planning For Wireless

Now that we know what some of the potential problem areas are and we’ve taken those in to account. What can we do to reduce the risks associated with wireless DNC or MDC? Make sure that the group responsible for your wireless infrastructure has adequate resources to maintain. These are some of the steps that they will likely take:

• Evaluate existing interference utilizing a Spectrum Analyzer
• If outside interference is a concern implement RF Shielding (Construction materials, paint and window film)
• If the data on your network is of sensitive nature perform penetration testing.
• Assist with the creation of policies to prevent inside interference (mobile hotspots to be turned off on smart phones, etc)

Depending on your situation, these costs can add up giving more weight to the Ethernet wired option (to Moxa Nport devices such as 5110A).

Making an informed decision on Wireless Shop Floor Solutions or DNC

Wireless technology is very useful for many things, but you should understand the risks for mission critical wireless DNC or related systems. Truly understanding the risks will help you decide if it is right for you. We carefully review each customer case and don’t push wireless because it is the easy route for CIMCO DNC Max or CIMCO MDC implementations. The best option can only be determined with careful consideration.

Just because we can doesn’t mean we should, informed decisions about wireless shop floor solutions are essential.

If you’ve owned or worked with any CNC equipment, you know that issues come up from time to time. Sometimes these issues affect your Machine Data Collection or your program sending and/or receiving. CIMCO provides a very useful debug feature for these very cases. This quick tip shows you how to use debug to see what is happening with one of your machine ports to maybe get some clues to share with your maintenance staff or to channel your own inner problem solver to resolve the issue.

Accessing CIMCO DNC Max Debug

To access port debug the feature must be enabled in the DNC-Max client you intend to run it on. You may already have it enabled, you can check by looking in the lower right hand corner for the Debug tab, if you see it you can skip the next step:

If it is not present, you need to enable the feature. This requires starting DNC-Max client and accessing Setup/Client Settings. Click the DNC-Max client shortcut and access Setup/Configure Client:

Then under client configuration check Show Debug and click okay. You may be prompted to restart the client for the setting to take effect.

Now you can access the port that was giving you trouble, but before you do, know that the standard log also contains useful information. The information you can review in the normal log include MDC messages, file transfers, errors, etc. It is basic info though, and usually you are breaking out the big guns because in most cases an RS-232 based machine is having issues and you’re wanting to see exactly what the DNC-Max server is seeing line by line to determine a possible culprit such as an incorrect baud rate or other parameter. Here is an example of a regular port log:

With debug enabled and started you will see a live view of everything happening with the port:

As you can see above you see even the actual g-code that is being transferred, errors will also appear. This information may provide you with some valuable insights if you are having an issue, but more importantly you can save the log and send it to us or your CIMCO support provider:

Just be sure to remember to turn it off using “Stop Log” when you are done debugging to avoid wasting resources. It is not advisable to run debug all the time on all your ports, it is intended for short term use while sorting out an issue or setting up a new port.

Bonus info: if you are sending this to us, a backup of the server configuration would also be really helpful.