A while back I stumbled across the spec for an equivalent system in England, where the generator has dedicated fibre to the local substation, where the data passes through a `Modbus/TCP -> 4-20mA -> Modbus/TCP` "firewall" before being allowed anywhere near the network's SCADA system.
The spec noted that this did seem a bit convoluted and they would hopefully find a better way of achieving comparable security soon...
@russss I'm quite familiar with both Modbus and 4-20mA stuff and I don't get how this would work at all.
Maybe a Modbus to HART over 4-20mA and back again with something doing appropriate access control in the middle. My memory of the HART system is old and I'm not sure it can support access control, although I guess it could have been cobbled on in the 25 years since I last dealt with it but it all sounds insane.
@mw1cgg @russss I presumed that each coil / register is translated from a digital value, to an analog 4-20mA, before being re-digitised on the other side and presented to the next Modbus device.
That said, I'm also not convinced that's even remotely a sane approach... or how it offers the "total security" that seems to be touted, if the Modbus stuff on the unsecured side can't be trusted.
I've also seen a bunch of "data diodes", which seem to be mostly Serial or UDP over a one-way fibre link.
