EXPERION PKS

RELEASE 501

Control Firewall User's Guide

EPDOC-XX20-en-501B
April 2018
Disclaimer
This document contains Honeywell proprietary information. Information contained herein is to be
used solely for the purpose submitted, and no part of this document or its contents shall be
reproduced, published, or disclosed to a third party without the express permission of Honeywell
International Sàrl.
While this information is presented in good faith and believed to be accurate, Honeywell disclaims
the implied warranties of merchantability and fitness for a purpose and makes no express
warranties except as may be stated in its written agreement with and for its customer.
In no event is Honeywell liable to anyone for any direct, special, or consequential damages. The
information and specifications in this document are subject to change without notice.
Copyright 2018 - Honeywell International Sàrl

-2-
Contents 3
Chapter 1 - About this guide 4
1.1 Revision History 4
Chapter 2 - Introduction 5
2.1 About this guide 5
2.1.1 Revision History 5

Chapter 3 - Control Firewall Overview 6

3.1 About CF9 6
Chapter 4 - Control Firewall Planning and Design 7
4.1 General Planning References 7
4.2 Identifying Control Firewall Components 7
Chapter 5 - Control Firewall Installation and Upgrades 9
5.1 Installation Declarations 9
5.2 Installing CF9 Input/Output Termination Assembly CC-
TCF901 10
5.2.1 Fiber media reference specifications 10
5.2.2 To mount CF9 IOTA 11
5.2.3 To wire CF9 IOTA 12

5.3 Installing Control Firewall CC- PCF901 15

5.3.1 To install CF9 15

5.4 Installing Optional Fiber Optic Module CC-FSMX01 or CC-

FMMX01 16
5.4.1 To install optional fiber optic module 16

5.5 Upgrading Control Firewall Firmware 17

Chapter 6 - Control Firewall Configuration 19
6.1 Adding CF9 to network 19
Chapter 7 - Control Firewall Operation 20
7.1 Control Firewall Startup 20
7.2 CF9 LED Descriptions 20
Chapter 8 - Control Firewall Maintenance 22
8.1 Periodic Checks 22
8.2 Recommended Spare Parts 22
8.3 Replacing Failed Control Firewall 22

-3-
 CHAPTER

1 ABOUT THIS GUIDE

1.1 Revision History

Revision Date Description

A November 2017 Initial release of the document.
B April 2018 Added attention under the section Upgrading Control Firewall
Firmware

Intended audience
Personnel who are responsible for integrating Series C form-factor components with the
Experion system.
Prerequisite skills
l Basic mechanical skills.
l Familiar with using this Experion application
o Configuration Studio

How to use this guide

This guide is primarily a hardware reference for installing the Control Firewall in a Series C
cabinet and interpreting the light emitting diode (LED) indications.

Related Documents
For information about related functions and tasks, see:
l Configuration Studio Overview
l Fault Tolerant Ethernet Status Display User's Guide
l Control Hardware Planning Guide

-4-
 CHAPTER

2 INTRODUCTION

l About this guide

2.1 About this guide

2.1.1 Revision History

Revision Date Description

A November 2017 Initial release of the document.
B April 2018 Added attention under the section Upgrading Control Firewall
Firmware

Intended audience
Personnel who are responsible for integrating Series C form-factor components with the
Experion system.
Prerequisite skills
l Basic mechanical skills.
l Familiar with using this Experion application
o Configuration Studio

How to use this guide

This guide is primarily a hardware reference for installing the Control Firewall in a Series C
cabinet and interpreting the light emitting diode (LED) indications.
Related Documents
For information about related functions and tasks, see:
l Configuration Studio Overview
l Fault Tolerant Ethernet Status Display User's Guide
l Control Hardware Planning Guide

-5-
 CHAPTER

3 CONTROL FIREWALL OVERVIEW

l About CF9

3.1 About CF9

The nine-port, Control Firewall (CF9) serves as the Fault Tolerant Ethernet (FTE) communications
center for a given Series C control network. It consists of a Control Firewall module that plugs into
its associated CF9 input/output termination assembly (IOTA) as shown in the following figure.

Figure 3.1 Control Firewall (CF9) and IOTA

The CF9 provides eight ports for FTE connections to C300s and Series C FIMs within a Series C
cabinet as well as FTE Bridge modules (FTEB) in a Series A Chassis I/O chassis. It has a ninth port
for an uplink connection to the supervisory FTE network and level 2 control area. It provides
network security by
l Rejecting all Ethernet messages not needed for control,
l Giving priority to traffic on downlink ports over ingress traffic on the uplink port, if the fabric
becomes saturated, and
l Allowing only valid C300-compliant messages to pass on to the C300 domain.

-6-
 CHAPTER

4 CONTROL FIREWALL PLANNING AND DESIGN

This chapter contains the following topics.

l General Planning References
l Identifying Control Firewall Components

4.1 General Planning References

Please refer to the following documents for planning and design details for the Experion system
in general and the Fault Tolerant Ethernet supervisory network. For the sake of brevity, this Guide
does not repeat the applicable general guidelines, considerations, cautions, and so on that are
covered in these other Guides.
l Control Hardware Planning Guide
l Server and Client Planning Guide
l Fault Tolerant Ethernet Overview and Implementation Guide

4.2 Identifying Control Firewall Components

The following table identifies the Control Firewall components that will be needed to provide a FTE
interface with a Series C control system. The CC/DC prefix in a model number means the
component's printed wiring boards are coated to provide additional protection from the
environment and the CU prefix means the boards are uncoated.

Component Description Honeywell

Model
Number
Control Firewall Module (CF9) Module mounts on CF9 Input/Output Termination CC-
Assembly (IOTA). PCF901
CF9 Input/Output Termination Provides physical connection to Control Firewall CC-
Assembly (IOTA) module and FTE cables. Mounts on carrier in Series TCF901
C cabinet.
CF9 Input/Output Termination Provides physical connection to Control Firewall DC-
Assembly (IOTA) for Series C module and FTE cables. Mounts on backplane in TCF901
Mark II Series C Mark II cabinet.
Horizontal 9 Port FTE Control Provides connection for eight FTE cables from in- CC-
Firewall Input Output cabinet controllers. The 9th port provides an uplink HCN911
Termination Assembly (IOTA) to the FTE supervisory network.
Ethernet Cables Please see Planning Your Series C Control System In
Control Hardware Planning Guide for information
about Ethernet cables.
Single Mode Fiber Module FTE Single-Mode Fiber Module that plugs into one CC-

-7-
Chapter 4 - Control Firewall Planning and Design

Component Description Honeywell

Model
Number
(SMFIO) port of IOTA. FSMX01
Multi-Mode Fiber Module FTE Multi-Mode Fiber Module that plugs into one CC-
(MMFIO) port of IOTA. FMMX01

ATTENTION
A combined IOTA is introduced for C300 and CF9 modules for use with the UHIO in TDC
Basic cabinet migrations. For more information about the UHIO IOTA, see Series C I/O User's
Guide.

-8-
 CHAPTER

5 CONTROL FIREWALL INSTALLATION AND UPGRADES

This chapter contains the following topics.

l Installation Declarations
l Installing CF9 Input/Output Termination Assembly CC-TCF901
l Installing Control Firewall CC- PCF901
l Installing Optional Fiber Optic Module CC-FSMX01 or CC-FMMX01
l Upgrading Control Firewall Firmware

5.1 Installation Declarations

ATTENTION
This equipment shall be installed in accordance with the requirements of the National
Electrical Code (NEC), ANSI/NFPA 70, or the Canadian Electrical Code (CEC), C22.1. It is
intended to be mounted within an enclosure or suitable environment acceptable to the
local authority having jurisdiction, as defined in the NEC, or authorized person as defined in
the CEC.

CAUTION
Electrostatic discharge can damage integrated circuits or semiconductors if you touch
connector pins or tracks on a printed wiring board. Follow these guidelines when you
handle any electronic component:
l Touch a grounded object to discharge static potential,
l Wear an approved wrist-strap grounding device,
l Do not touch the wire connector or connector pins,
l Do not touch circuit components inside a component,
l If available, use a static safe workstation,
l When not in use, keep the component in its static shield box or bag.

-9-
 Chapter 5 - Control Firewall Installation and Upgrades

CAUTION
Unless the location is known to be non-hazardous, do not:
l connect or disconnect cables,
l install or remove fuses, terminal blocks, and so on, while the component is powered.

CAUTION
Do not connect Control Firewalls to interfaces configured for uplinks. Configure all Control
Firewall interfaces for portfast before attaching the Control Firewall. Otherwise, interfaces
connected to Control Firewalls will be blocked and cause loss of view upon recovery of a root
switch in a network, which causes recalculation of the switch spanning tree topology.
Control Firewalls do not use spanning tree.

5.2 Installing CF9 Input/Output Termination Assembly CC-

TCF901
l Fiber media reference specifications
l To mount CF9 IOTA
l To wire CF9 IOTA

5.2.1 Fiber media reference specifications

Single-Mode Fiber Optic module CC-FSMX01

This module uses a dual-jacketed, dual-fiber cable (yellow) with an LC connector. Its applicable
specifications are as follows.

Medium Single-Mode Glass Fiber 9/125

Wavelength 1300 nm
Maximum Distance 15 km (9 miles)
Connector LC
Voltage 3.3 V
Temperature Industrial -40 C to +85 C (-40 F to +185 F)
Form Factor SFP
Power 1 W Approximately

Multi-Mode Fiber Optic modules CC-FMMX01

This module uses a single-jacketed, dual-fiber cable (Orange) with an MT-RJ connector. Its
applicable specifications are as follows.

Medium Multimode Dielectric Fiber 62.5/125

Wavelength 1300 nm
Maximum Distance 2 km (1 mile)
Connector MT-RJ
Voltage 3.3 V
Temperature Industrial -40 C to +85 C (-40 F to +185 F)

- 10 -
 Chapter 5 - Control Firewall Installation and Upgrades

Form Factor SFF

Power 1 W Approximately

5.2.2 To mount CF9 IOTA

CAUTION
Be sure you do not fully tighten the IOTA mounting screws before installing and tightening
the screws in the 24V + and COM terminals to keep these screws from binding during IOTA
installation.

Series C IOTA size is 6 inches.

1. Select desired mounting location on carrier and align mounting holes in IOTA with screw hole
locations on the carrier. See the following dimension drawing for details.
2.
l Be sure component side of IOTA is facing up. Secure IOTA to carrier using screws,
washers and spacers provided.
l Insert spacers and washers between bottom of IOTA and top of carrier.
l Only tighten mounting screws half way.

3. Tighten the screws in terminals 24 Vdc + and COM (logic ground) to the vertical bus bar to
connect the cabinet resident 24 Vdc power supply to the IOTA.
4. Fully tighten the mounting screws.
5. Repeat Steps 1 to 4 to mount the second CF9 IOTA immediately below the one that was just
installed.
6. This completes the procedure. Go to Wiring IOTA for connection details.

- 11 -
 Chapter 5 - Control Firewall Installation and Upgrades

Figure 5.1 Mounting Dimensions for CF9 IOTA CC-TCF901

5.2.3 To wire CF9 IOTA

CF9 connection requirements
l You must always connect the Control Firewall uplink port to a Cisco switch.
l You must not stack the Control Firewall.
l You must connect the Control Firewall to an interface configured for portfast.
l You must connect All Series C FIMs and C300s to a Control Firewall.
l You must connect any FTE Bridge (FTEB) module communicating to a C300 to the same
Control Firewall as the C300.
l You may connect FTEB/C200 and FTEB/Series A FIM to level 1 configured switches according
to the established best practices. For FTEB/Series A FIM, you also have an option to connect to
a Control Firewall.
l It is valid for an FTEB to be connected to a CF9, only when it is for a Series A FIM.
l It is invalid for a CF9 to host a C200 through FTEB.
1.
l Connect yellow FTE cable from FTE A link, L1/L2 Ethernet switch to the J3 connector on
the Control Firewall (CF9) to be used as the FTE A link (yellow cable)
l Connect green FTE cable from FTE B link, L1/L2 Ethernet switch to the J3 connector on
another Control Firewall (CF9) to be used as the FTE B link (green cable) redundant IOTA.

- 12 -
 Chapter 5 - Control Firewall Installation and Upgrades

2. Route yellow cables from four J4 and four J5 connectors on the CF9 for FTE A links to
corresponding FTE A ports on C300s, Series C FIMs, and FTE Bridge modules, as required.
3. Route green cables from four J4 and four J5 connectors on the other redundant CF9 IOTA for
FTE B inks to corresponding FTE B ports on C300s, Series C FIMs, and FTE Bridge modules,
as required.
4. This completes the procedure. Go to the next section.

- 13 -
Chapter 5 - Control Firewall Installation and Upgrades

Figure 5.2 Typical Connector Locations on CF9 IOTA for Series C

- 14 -
 Chapter 5 - Control Firewall Installation and Upgrades

Figure 5.3 Typical Connector Locations on CF9 IOTA for Series C Mark II

5.3 Installing Control Firewall CC- PCF901

l To install CF9

5.3.1 To install CF9

The following caution is not applicable for Series C Mark II.

- 15 -
 Chapter 5 - Control Firewall Installation and Upgrades

CAUTION
Use only a #2 Phillips screw driver to carefully tighten the long gray plastic screw on the
Module's face. Do not use either a #1 Phillips screw driver or a battery powered screw driver
to remove or install the plastic screw as this can damage the screw head.

1. Align CF9 connector pins over the connector/slot on the IOTA labeled as Control Firewall 9
Module.
2. Carefully press down on the CF9 module until it is fully seated in the connector.
3. Use the screws provided to secure the CF9 module to the IOTA. The screws must be tightened
to 1.3 Newton-meters.
4. Repeat Steps 1 to 3 to install other CF9s on their IOTAs, as required.
5. This completes the procedure. Go to the next Section.

5.4 Installing Optional Fiber Optic Module CC-FSMX01 or CC-

FMMX01
l To install optional fiber optic module

5.4.1 To install optional fiber optic module

Use the following procedure to install an optional fiber optic module on a CF9 IOTA. This procedure
assumes that this is an initial installation for the CF9 IOTA and no prior uplink RJ-45 plug
connection has been made.

CAUTION
This caution is not applicable for Series C Mark II.
Only use a #2 Phillips screw driver to carefully loosen or tighten the long gray plastic screw
on the CF9 Module's face. Do not use either a #1 Phillips screw driver or a battery powered
screw driver to remove or install the plastic screw as this can damage the screw head.

ATTENTION
For Series C Mark II CF9, do not connect FTE switch with fiber cable and RJ-45 cable at the
same time.

1. If the CF9 IOTA is installed on a carrier in a cabinet, loosen the screws holding the Control
Firewall module to the IOTA and remove the module from the IOTA so power is removed from
the J2 connector on the IOTA. (It is not necessary to completely remove the long gray plastic
screw located on the module's face.)
2. Carefully align the pins in the bottom of the fiber optic module with the sockets in the J2
connector on the IOTA and gently push down on the module until it is fully seated.

- 16 -
 Chapter 5 - Control Firewall Installation and Upgrades

3. Tighten the two screws in the base of the module to secure it to the IOTA as shown in the
following example illustration.

4. Connect appropriate fiber optic cable to the LC or MTRJ plug provided with the fiber optic
module.
5. Plug the cable plug into the fiber optic module port as shown in the example illustration below.

6. If applicable, install the Control Firewall module on the IOTA.

7. This completes the procedure.

5.5 Upgrading Control Firewall Firmware

You can update the Control Firewall firmware using the Control Firewall Update tool. You can
launch the tool from the Configuration Studio or as a standalone tool. Refer to the About the
Control Firewall Update tool topic in the System Definition and Configuration online help for
information on launching the tool. Refer to the Software Change Notice (SCN) supplied with your
Experion system for the latest firmware version and file location details.

- 17 -
Chapter 5 - Control Firewall Installation and Upgrades

ATTENTION
Don't upgrade a CF9 pair together, since it may cause a LOV situation, make sure that you
have identify each pair,, During the time of upgrade, if it is possible use only, one instance of
the tool at a time.

- 18 -
 CHAPTER

6 CONTROL FIREWALL CONFIGURATION

This chapter contains the following topic.

l Adding CF9 to network

6.1 Adding CF9 to network

You can add a Control Firewall (CF9) to be visible on the Network Tree in Configuration Studio.
Please refer to the Adding and Configuring Switches and Control Firewall topic in the System
Definition and Configuration help in Configuration Studio for details.

- 19 -
 CHAPTER

7 CONTROL FIREWALL OPERATION

l Control Firewall Startup

l CF9 LED Descriptions

7.1 Control Firewall Startup

The following table summarizes the stages the CF9 goes through after power is applied to its IOTA
during startup. The CF9 repeats these stages every time power is cycled Off/On or the pins on its
reset pad are shorted.

1. Power Light Emitting Diode (LED) lights (green).

2. Status LED is red while the CF9 runs its power-on self test (POST).
3. When the CF9 POST completes, the Status LED turns green and the FTE port LEDs blink
green and off for all connected ports when there is traffic, and remain steady green for
connected ports when there is no traffic. The LEDs for unconnected FTE ports are off.

7.2 CF9 LED Descriptions

The following illustration and table identify and describe the indications associated with the LEDs
on the CF9.

- 20 -
Chapter 7 - Control Firewall Operation

Figure 7.1 LEDs on CF9

LED State
Off Green Red Blinking Green Green with
Brief Flicker
Power No Power Power On See Note 1 - -
Status No Power or Normal Running POST See Note 2 -
Fault Operation
Downlink Ports No Power or No Link Present, - Link Present, Too Many
1 to 8 Cable No Traffic Traffic Attached
Connected Devices
Uplink Port No Power or No Link Present, - Link Present, -
Cable No Traffic Traffic
Connected
Notes
1. The - indicates the LED is never in this state.
2. The CF9 has detected a soft failure and is working in a diminished state. Typical causes are
a disconnected uplink port cable or a downlink port with too many attached devices. (Only
one device can be attached to a CF9 downlink port.)

- 21 -
 CHAPTER

8 CONTROL FIREWALL MAINTENANCE

This topic includes the following topics.

l Periodic Checks
l Recommended Spare Parts
l Replacing Failed Control Firewall

8.1 Periodic Checks

The following table identifies checks that you should make periodically (every 3 to 6 months) to
keep the CF9 in good working condition.

Check . . . Possible Corrective Action . . .

That all light emitting diodes If LED is not lit or has dimmed, you must replace the CF9 module,
(LED) are working. since LEDs are not field replaceable.
That all connections are Secure connections, as needed.
secure.
That cable insulation is not Replace cables, as required.
worn or cracked.
That IOTA is secure. Tighten mounting screws.

8.2 Recommended Spare Parts

The following table provides a list of parts that you may want to keep on hand for backup

Part Name Part Number Description Quantity per

10/100
Control CC- or CU- Series C Control Firewall Module 1/5
Firewall PFB401
CF9 IOTA CC- or CU- Nine-Port Ethernet Input/Output Terminal 1/2
TFB401 Assembly
Fuse 51506438- 800 mA, 250V quick-acting fuse on Input Output 4/25
341 Terminal Assembly
SMFIO CC-FSMX01 Single-Mode Fiber Optic Module Optional
MMFIO CC-FMMX01 Multi-Mode Fiber Optic Module Optional

8.3 Replacing Failed Control Firewall

Just reverse the steps in the previous installation procedures for mounting and wiring the CF9

- 22 -
Chapter 8 - Control Firewall Maintenance

and its associated IOTA, as required. You can replace the CF9 module without removing the IOTA.
Please observe the following cautions and warnings.

CAUTION
We recommend that you proceed with extreme caution whenever replacing any component
in a control system. Be sure the system is offline or in a safe operating mode. Component
replacements may also require corresponding changes in the control strategy configuration
through Control Builder, as well as downloading appropriate data to the replaced
component.

CAUTION
Unless the location is known to be non-hazardous, do not :
l connect or disconnect cables,
l install or remove fuses, terminal blocks, and so on,

while the component is powered.

CAUTION
This caution is not applicable for Series C Mark II.
Only use a #2 Phillips screw driver to carefully loosen or tighten the long gray plastic screw
on the CF9 Module's face. Do not use either a #1 Phillips screw driver or a battery powered
screw driver to remove or install the plastic screw as this can damage the screw head.

CAUTION

Be sure you use the following sequence when removing an IOTA.

l Only loosen the IOTA mounting screws half way.
l Remove the screws in the 24V + and COM terminals.
For Series C Mark II, remove the combo cable.
l Remove the mounting screws and the IOTA.

- 23 -
Notices
Trademarks
Experion®, PlantScape®, SafeBrowse®, TotalPlant®, ControlEdge™, and TDC 3000® are registered
trademarks of Honeywell International, Inc.
OneWireless™ is a trademark of Honeywell International Sàrl

Other trademarks
Microsoft and SQL Server are either registered trademarks or trademarks of Microsoft Corporation
in the United States and/or other countries.
Trademarks that appear in this document are used only to the benefit of the trademark owner,
with no intention of trademark infringement.

Third-party licenses
This product may contain or be derived from materials, including software, of third parties. The
third party materials may be subject to licenses, notices, restrictions and obligations imposed by
the licensor. The licenses, notices, restrictions and obligations, if any, may be found in the
materials accompanying the product, in the documents or files accompanying such third party
materials, in a file named third_party_licenses on the media containing the product, or at
http://www.honeywell.com/ps/thirdpartylicenses.

Documentation feedback
You can find the most up-to-date documents on the Honeywell Process Solutions support website
at:
l http://www.honeywellprocess.com/support

If you have comments about Honeywell Process Solutions documentation, send your feedback to:

l hpsdocs@honeywell.com

Use this email address to provide feedback, or to report errors and omissions in the
documentation. For immediate help with a technical problem, contact your local Honeywell
Process Solutions Customer Contact Center (CCC) or Honeywell Technical Assistance Center
(TAC).

How to report a security vulnerability

For the purpose of submission, a security vulnerability is defined as a software defect or weakness
that can be exploited to reduce the operational or security capabilities of the software.
Honeywell investigates all reports of security vulnerabilities affecting Honeywell products and
services.
To report a potential security vulnerability against any Honeywell product, please follow the
instructions at:
https://honeywell.com/pages/vulnerabilityreporting.aspx
Submit the requested information to Honeywell using one of the following methods:
l Send an email to security@honeywell.com.
or
l Contact your local Honeywell Process Solutions Customer Contact Center (CCC) or Honeywell
Technical Assistance Center (TAC) listed in the “Support” section of this document.

- 24 -
Support
For support, contact your local Honeywell Process Solutions Customer Contact Center (CCC). To
find your local CCC visit the website, https://www.honeywellprocess.com/en-US/contact-
us/customer-support-contacts/Pages/default.aspx.

Training classes
Honeywell holds technical training classes about Experion PKS. These classes are taught by
experts in the field of process control systems. For more information about these classes, contact
your Honeywell representative, or see http://www.automationcollege.com.

- 25 -