15.3 OPC, Network Addressing, and Segmentation

Section 15.2 set the architecture. This section is the PE failure catalog that sits on the same 4.F bullets — OPC, network addressing, and the way a LAN is segmented — plus the leftover 4.A bus and I/O traps that show up when someone parks safety or fast analog on the wrong scan.

Addressing collisions and duplicate IPs

A duplicate IP means two hosts claim the same Layer 3 identity. Ethernet has no referee. Each host answers ARP for that address. The switch CAM table and the ARP caches around it flap. Symptoms are intermittent loss of an HMI, a controller that “comes back after a ping from the right PC,” and a second device that works until the first one boots. The defensive controls are a documented IP plan, DHCP only where you intend it (rarely on controllers), and a management tool that detects a conflict — not a hope that devices will negotiate.

Fieldbus and remote I/O have their own collisions. Two PROFIBUS slaves with station 12, two HART devices with the same long tag in one gateway, two EtherNet/IP adapters cloned from the same IP, are 4.A topology/protocol limits expressed as addressing. Cloning a running project into a second unit without a unique address pass is how plants ship a latent collision.

OPC adds a third namespace. Classic OPC DA clients subscribe to an item ID (often a dotted path such as PlantA.11-FIC-101.PV). OPC UA clients subscribe to a NodeId and may also display a browse name. If the DCS tag is renamed in the controller but the OPC mapping table is not rebuilt, clients keep the old path. They may show stale quality, a bad status, or — worse — a live value from a different node that inherited the old name. Two plants sharing one OPC server multiply that risk because tag namespaces collide unless the server prefixes by plant.

Switch loops, storms, and ring redundancy

Ethernet without a loop-breaking protocol is not a mesh; it is a loop. If two switches are cross-connected with two patch cords and spanning tree is off, a broadcast or multicast frame is copied forever. That is a broadcast storm in qualitative language: utilization goes to the ceiling, latency explodes, and controllers miss I/O. You do not need an attack to get there. A well-meaning spare cord is enough.

Defensive design:

• Run RSTP (or the vendor equivalent) on every managed switch in a tree/ring that is not using a dedicated ring protocol.
• For process rings, use a ring protocol the vendor supports (MRP, vendor RSTP rings, PRP/HSR where the exam stem is high-availability process Ethernet). The point is one active logical path plus a blocked or parallel redundant path that takes over on failure — not two active loops.
• Disable unused ports, lock speed/duplex where the plant standard says so, and do not leave an unmanaged office switch in the control ring.

Hubs still appear in old stems. A hub is a single collision domain. It is not a segmentation tool. Replace it with a switch; do not add a second hub “for redundancy.”

NAT at the DMZ

Network address translation (NAT) at the DMZ rewrites the addresses Level 4 sees so office hosts never hold the real Level 2 controller IPs. Combined with a firewall allow-list, NAT is a segmentation control: even a mis-aimed client cannot address 192.168.10.20 on the control LAN because that prefix does not exist on the business side. NAT is not encryption and not authentication. Pair it with OPC UA certificates or a jump host, and with no inbound DCOM.

Do not NAT as a way to overlap two plants that both use 192.168.10.0/24 and then hope OPC item names stay unique. Overlapping prefixes are an addressing collision. Give each plant a unique prefix or terminate each plant at its own OPC UA server in the DMZ with plant-qualified NodeIds.

Time sync: NTP, PTP, and sequence of events

Sequence of events (SOE) is only as honest as the clocks. Network Time Protocol (NTP) is the usual plant-wide software method. Expect millisecond-class agreement on a quiet LAN, worse across overloaded WAN links. That is often enough for alarm lists. It is not enough to order two breaker trips 200 µs apart.

Precision Time Protocol (PTP, IEEE 1588) uses hardware timestamping on supporting NICs and switches (transparent or boundary clocks). Expect microsecond-class (often better) agreement when the path is engineered. Substation, turbine, and high-speed SOE systems specify PTP for that reason.

The PE trap is mixing sources: HMI clocks on NTP from the office, SOE cards on a free-running CPU clock, and a historian that stamps arrival time instead of source time. After a trip, the “first” event is whichever packet was slowest. Defensive control: one time design — GPS or a grandmaster where justified, PTP on the SOE LAN, NTP only for non-SOE hosts — and historians that store the device timestamp, not the collector’s arrival time.

I/O integration traps: remote I/O scan versus safety (remaining 4.A)

4.A still owns signal types, buses, topologies, and limitations. The leftover trap on a networking paper is treating remote I/O as a free extension of the safety rack.

A BPCS remote I/O adapter on Ethernet might scan analog every 200–500 ms once you add RPI, switch queues, and controller tasking. A safety instrumented function that must drive a trip in 100 ms cannot live on that scan even if the same cabinet is nearby. IEC 61511 independence also objects: safety I/O belongs on the SIS, with its own diagnostics, proof-test story, and failure direction — not as a cheap alias of BPCS remote I/O.

Other 4.A/4.F crossovers:

• A process fieldbus with spur-length and terminator rules is not an Ethernet homerun. Over-length spurs drop devices; they do not “just slow down.”
• Mixing IS and non-IS in one multicore is a classification failure, not a bandwidth trick.
• Putting SIS peer-to-peer on the business Wi-Fi SSID is both a media failure (15.1) and a segmentation failure (this section).

Worked example: two plants, one OPC server, stale data after a tag rename

Plant A and Plant B both run similar crude units. A shared OPC DA server in the central rack room browses both DCS systems. Plant A’s flow controller was FIC-101. During a shutdown, instrument engineering renames it to 11-FIC-101 to match the new tagging spec. The DCS compile succeeds. The OPC mapping spreadsheet is not regenerated. Corporate dashboards still subscribe to PlantA.FIC-101.PV.

What the clients show depends on leftover configuration: some keep a cached last value with uncertain quality (stale); some resolve the short name against Plant B, which still has a live FIC-101 (wrong plant); some show bad quality and look like a network failure. The LAN is fine. Fiber is fine. The failure is addressing: one server, two plants, an item path that is not unique and not updated.

The repair is architectural, not “reboot the switch.” Give each plant its own OPC UA server or a mandatory plant prefix in every NodeId, rebuild mappings as a management-of-change step with the DCS download, and have clients subscribe to NodeIds — not to leftover Classic paths. Put the corporate readers on the DMZ replica, not on the live DA server.

Segmentation control versus typical failure