Emerson Exchange 365

• Not Answered

Will a download after activation of "Enable Unlock Inhibit key Switch" change a CRC-value of the SIS-components

Hello.

We are using DV v14.3.1 with SIS functionality

Standard type of layout:   ACN => SZ-CTRL => CSLS => LS Charms

The system is in production and fully running. Due to increasing Cyber Security efforts, we want to establish a - from our poinit of view - new routine to lock/unlock the installed SZ-CTRL and CSLS. For the CSLS part we want to use the software "lock"- functionality and the hardware "unlock inhibit key switch" on the CSLS-carrier as well. Therefore we have to active the "Enable Unock Inhibit Key Switch" setting in the Security-Tab at the properties-dialog of the CSLS in the DeltaV Explorer. After activation a download will be necessary. 

The questions is: will the download and the changed properties influence the CRC-values (device, firmware or IO) or will they stay the same?

Thanks for your support!

Best regards, Stefan

Stefan Müllner
Senior Plant Engineer - Automation & Systems

KremsChem Austria GmbH

• SIS
• CSLS
• lock
• crc
• keyswitch

Stefan Muellner

• 12 May 2021 4:05 PM
• Cancel

2 Replies

• Sergio Diaz

  

  • 12 May 2021 5:10 PM

  Stefan,
  There are multiple CRCs tracking changes on different aspects of the configuration. For example, the IOCRC capture changes in the IO (CHARMS), this CRC will not be impacted by enabling the hardware key. The firmware CRC will not be impacted either as there are not changes in firmware. The device CRC will change as you are modifying a setting on the CSLS properties. What is important is that the CRCs for SIS modules will remain the same as they are not affected by changes in the CSLS properties.
  
  As side note, for CSLS major revision 2 is possible to enable enhanced access control to further hardening on-line changes. Enabling that checkbox requires more evaluation as this setting also prevent writes from CALC blocks.
  
  DeltaV v14 offers another way to enforce physical presence before unlocking CSLSs via the key switch on the SZ controller (this requires special ethernet ports on the SZ). You could also put an IPD to enforce physical presence for unlocking logic solvers.
  
  Regards,
  
  Sergio

  • Cancel
• Tadeu Batista

  

  • 12 May 2021 5:42 PM

  In reply to Sergio Diaz:

  Just to illustrate what Sergio just mentioned

  Before enabling Unlock Inhibit Key Switch and downloading the logic solver

  

  After enabling Unlock Inhibit Key Switch and downloading the logic solver

  

  Both overall control module CRC and LogicCRC also remain unchanged.

  

  Rgs,

  • Cancel